On-premises Android malware analysis

See what an APK really does.

APKScan pulls apart suspicious Android apps with deterministic static analysis, a grounded local-GenAI layer, an ML classifier, and an isolated sandbox — and hands you an explainable, auditable risk score for the banking-fraud threat model.

Open the dashboard See how it works

$ apkscan analyze suspicious.apk --mode high_recall --pdf report.pdf

The APKScan dashboard — upload an APK, watch the pipeline run, review the verdict.

The threat model

Built for how banking malware actually behaves.

Indian banking-fraud campaigns don't look like textbook viruses. APKScan's rules and detections are shaped around the techniques these apps really use.

layers

Overlay attacks

Fake screens drawn on top of legitimate banking apps to capture credentials.

accessibility_new

Accessibility abuse

Accessibility services hijacked to read screens, tap buttons, and grant permissions.

sms

SMS / OTP interception

Silent reading and forwarding of one-time passwords to defeat 2FA.

keyboard

Keylogging & screen capture

Recording keystrokes and screen content to harvest sensitive input.

settings_remote

RATs & droppers

Remote-access trojans and staged droppers that fetch payloads after install.

account_balance

Automated transfer systems

ATS logic that moves money directly from a compromised device.

How it works

One pass. Ten stages. A logged trail behind every verdict.

An APK enters a single-host async pipeline. Each stage records its evidence, so the final score is explainable end to end.

01UploadHash & dedupe

02QueueAsync worker

03Static analysisMulti-tool extract

04Dynamic sandboxOn escalation only

05Feature storeCanonical schema

06GenAI interpretGrounded, cited

07Scoring engineRules + ML fusion

08ReportPDF & JSON

09StorageHashed, isolated

10ExportSTIX 2.1 API

GenAI explains — the deterministic rule layer decides the verdict.

What's inside

Deterministic where it counts. Interpretive where it helps.

construction

Multi-tool extraction

Features pulled from a battery of analyzers, plus certificate, Firebase, and domain checks.

MobSFAndroguardAPKiDQuarkYARA

rule

Deterministic rule scoring

Permission weights, dangerous combinations, Quark behavior scores, and YARA hits — the layer that decides every verdict.

psychology

Grounded local GenAI

Qwen2.5-Coder via Ollama interprets code. Every claim must cite a concrete artifact; ungrounded claims are withheld.

forest

ML classifier

RandomForest & XGBoost over permission/API features, with SHAP feature-importance explanations and drift monitoring.

verified

Explainable verdict

A 0–100 risk score, a Benign / Suspicious / Malicious band, severity and confidence — backed by a full evidence log.

description

SOC-ready output

PDF & JSON reports, MITRE ATT&CK mapping, STIX 2.1 IOC export, and analyst sign-off on high-severity verdicts.

Built on a hardened, open stack

Governance posture

Samples may be live malware. The system is built to assume it.

dns

On-premises by default

Everything runs on your own hardware. No sample or report data leaves the host.

cloud_off

Commercial LLM off by default

Local models only. External LLM egress stays disabled unless governance explicitly enables it.

shield

Untrusted by construction

Every APK-derived string is treated as data, never instructions — prompt-injection is isolated by design.

fact_check

Auditable & access-controlled

A hash-chained, tamper-evident audit log, with JWT auth across admin / analyst / viewer roles.

Run your first scan.

Drop an APK into the dashboard and watch the pipeline turn raw bytes into an explainable verdict.

Open the dashboard View on GitHub