Dynamic Analysis of Android Malware Using Cuckoo Sandbox

This research investigates dynamic analysis for Android malware detection, addressing the challenges posed by sophisticated, evasive mobile threats. The study employs a controlled Cuckoo Sandbox environment within a Windows-based virtualized environment to reveal malicious runtime behaviors by dynamically executing real malware samples, including WannaCry and CryptoLocker, in isolated virtual machines. Comprehensive behavioral features, such as API usage, system calls, network activity, and file system events, are robustly extracted and analyzed. The approach enables the identification of advanced malicious techniques, including process injection and anti-forensics, which often evade static detection. Despite high detection effectiveness, the study identifies limitations related to sandbox evasion and observation windows. Recommendations are made to enhance runtime simulation and adopt hybrid analysis strategies. The findings provide a practical, scalable framework for Android malware investigation, advancing dynamic analysis accuracy and resilience for operational cybersecurity applications.