How do Antivirus for Android detects a Malware application?

Question

While researching about malware analysis for Android, I found that there are few applications that were removed from the Google Play Store because they were found to be malware.

I guess Android Antivirus applications running on a smartphone detects that these applications are malware.

Two cases:

Case: My guess is right:

I am wondering how these antivirus applications can suspect an application whether that is a malware or not.

1. What are the parameters they use to justify that the suspected application is a malware?

2. How does a real-time antivirus like Avast or Avg (for Android) works on this? (Any link regarding this would be helpful).

Case: My guess is wrong:

Now, if these antivirus applications don't detect any application as malware, then how come these applications are removed from the Play Store?

P.S. I was able to search only about the malware applications and I could not get the answer for my question as how they are detected. Any references would be much helpful.

Answer 1

Your guess is wrong. Anti-virus applications on Android are completely unrelated. There are two ways that Google finds and removes dodgy apps and malware from Google Play.

Reports by users

Every Play Store page has a "report" button. Google investigates apps that are reported, whether that's for copyright or trademark issues, violating their policy about content (e.g. pornography), for breaking their other policies (e.g. invasive ads, interfering with other apps), or for being malware or scams.

Automatic scans

Google Play now automatically scans apps that are added by developers, hoping to detect dodgy apps like these before they can hurt users or cause problems. For obvious reasons, Google doesn't disclose details of what kind of scans they perform or how the technology works.

If a user has a malware app and it's detected by an anti-virus program, the user might choose to report it to Google Play themselves (if the malware came from there), but that's the only part that anti-virus apps on smartphones play in the process.

Answer 2

One approach Dan's answer does not cover is scanning the .apk file for known malicious libraries. This is the same way as library checkers use to show you which ad modules or other libraries an app is using: they unpack the .apk file of an app and scan the contents.

An example you can find described in my answer to APK analyzer for Linux. What I've named there as pkgname actually is the "path name" of the library (Java apps/libraries are structured like that). If some library is used frequently or solely by malware, it indicates the app using it is likely or certain to be/contain malware.