Analyzing Android Banking Trojans Using Permission-Based Profiling and Antivirus Engine Insights

Android banking trojans represent a persistent and evolving threat to mobile financial systems, exploiting weaknesses in the Android Operating System to compromise user credentials and disrupt institutional trust. This paper presents an analysis of their architecture, distribution methods, and operational lifecycle, underscoring the urgent need for adaptive, permission-aware defense strategies. Antivirus Engine labels using VirusTotal are used for multiple classification data which is then evaluated to assess detection consistency and reliability across variants. Using permission-based profiling, the study reveals behavioral patterns employed by leading Android banking families. A random forest classification model is used to identify core attributes such as malware type, platform, family, and variant while applying normalization rules to handle the varied terminology used by different vendors. Our findings expose commonly exploited Android permissions and high-risk access patterns in financial applications and our framework achieved an acceptable-level of malware family classification across 16 distinct families. The evaluation results underscore the importance of the consensus of the AV engine in enhancing the accuracy and reliability of the classification and demonstrate the effectiveness of combining permission-based analysis with AV intelligence. Our work advocates for a hybrid detection framework that combines static profiling with AV consensus models to improve early-stage threat identification and mobile threat intelligence.