Android malware; obfuscation; detection; classification

Our dataset is constructed by leveraging existing malware samples and utilizing both UTRDCL and traditional DCL techniques to load the malicious components, thereby launching attacks. In addition to the malware samples themselves, we also provide online detection reports from reputable sources, including VirusTotal, MobSF, and Bazaar (Pithus). These reports offer a comprehensive analysis of the malware samples, enabling researchers to gain a deeper understanding of the attacks and their characteristics.

This research utilizes real-world malware samples that are reinforced with the latest VM-based packers and digitally signed to ensure runtime execution. For academic research purposes only, these packed malware samples are provided as running instances to facilitate behavioral, forensic and detection analysis. Users are forewarned on the potential risks of executing unknown malicious programs, and should refrain from installing or propagating these files outside of a controlled experimental environment.

With the large-scale adaptation of Android OS and ever-increasing contributions in the Android application space, Android has become the number one target of malware authors. In recent years, a large number of automatic malware detection and classification systems have evolved to tackle the dynamic nature of malware growth using either static or dynamic analysis techniques. Performance of static malware detection methods degrades due to the obfuscation attacks.