While researching about malware analysis for Android, I found that there are few applications that were removed from the Google Play Store because they were found to be malware.
I guess Android Antivirus applications running on a smartphone detects that these applications are malware.
Case: My guess is right:
I am wondering how these antivirus applications can suspect an application whether that is a malware or not.
What are the parameters they use to justify that the suspected application is a malware?
How does a real-time antivirus like Avast or Avg (for Android) works on this? (Any link regarding this would be helpful).
Case: My guess is wrong:
Now, if these antivirus applications don't detect any application as malware, then how come these applications are removed from the Play Store?
P.S. I was able to search only about the malware applications and I could not get the answer for my question as how they are detected. Any references would be much helpful.