Deeper than VirusTotal, no infra like MobSF. Upload an Android APK — or an iOS .ipa for static analysis — and get MITRE ATT&CK Mobile mappings, MASVS/MASTG coverage, STIX 2.1 exports and Frida dynamic analysis — in minutes.
Or browse a file — APK · XAPK · AAB · DEX · IPA up to 150 MB, no registration.
By uploading you confirm you have the right to analyze this file and accept our Terms and Privacy policy.
From manifest analysis to deep DEX bytecode inspection.
Identifies banking trojans, stalkerware, ransomware, aggressive adware and government spyware using heuristic analysis and YARA rules.
Every finding mapped to ATT&CK for Mobile tactics and techniques — T1417, T1444, T1636 and more. STIX 2.1 export for SIEM/SOAR integration.
Bytecode-level analysis with androguard: call graph, source-to-sink data flows and dead code detection. JADX decompilation — hardcoded secrets and insecure code paths read straight from the source — is included from Pro upwards.
Detects third-party SDKs and checks OSV.dev for known CVEs — Meta SDK, Firebase, Adjust, ironSource and 50+ others.
Compares the APK certificate against known publisher fingerprints to detect repackaged apps and certificate spoofing attacks.
Findings cross-referenced against OWASP Mobile Top 10 (2024) and MASVS v2, with automated compliance scoring per domain.
Extracts domains and IPs, resolves them and checks them against MalwareBazaar, AbuseIPDB and URLhaus.
Export findings as PDF (executive summary), JSON, STIX 2.1 or Markdown — ready for GitHub issues, JIRA and SIEM ingestion.
Monitor package names and get notified when a new variant is analyzed — browser notifications, in-app alerts, email and webhooks.
Android — full static + dynamic coverage. iOS — full static analysis (no runtime).
25+ independent analyses, MITRE ATT&CK Mobile, MASVS/MASTG coverage and an ML engine (F1 0.9873). Frida dynamic analysis: SSL pinning, accessibility abuse, SMS interception, overlays and runtime DEX dumps.
Full static analysis: Info.plist (ATS, URL schemes, privacy), signing & entitlements, deep Mach-O binary checks (PIE/ASLR, stack canaries, encryption, insecure functions, code signature), iOS YARA rules (jailbreak, Frida/Substrate, private APIs) and weighted risk scoring — plus strings/secrets/network IOCs and VirusTotal. No dynamic/runtime or ML model on iOS yet. Talk to us →
Drop the file into the chat you are already in. The skill talks to this engine — not to tools on your laptop — so it answers with the attacker’s C2, the MITRE ATT&CK techniques and a verdict, in about eight kilobytes.
Read the docs → No account needed to try it
Three lines of YAML — upload, wait for verdict, fail the build per your policy. Same outputs on every platform.
# one drop-in include, that's it
include:
- remote: 'https://droidwatch.app/ci/gitlab/scan.yml'
variables:
DROIDWATCH_APK_PATH: app/build/outputs/apk/
release/app-release.apk
DROIDWATCH_FAIL_ON: "Malicious|High Risk"
Designed so a banking CISO or a DPO can sign off without exception forms.
Every analysis runs in a worker with a restrictive seccomp profile, cap_drop ALL and CPU/memory limits. No access to private networks or other tenants.
We never share submitted files. Only de-identified IOCs — hashes, domains, IPs — reach the public threat feed, and you can opt out per upload.
Data Processing Addendum (Art. 28) published, per-plan retention, self-serve account export/deletion. Sub-processors disclosed.
Reports optionally encrypted with AES-256-GCM (DWE1 envelope). Append-only audit log in PostgreSQL with an immutable trigger.
Controls already in place: MFA, audit log, structured logging, backups + DR plan. Request the current trust pack at [email protected].
If you opt in to the public threat feed, only hashes, domains and IPs are shared — never the binary or uploader metadata.
Start free. Scale when you need to.
Quick answers to what SOC analysts, fintech security teams and CISOs ask before signing up.
Every APK is analyzed inside an isolated sandbox (seccomp + capability drop + resource limits on the worker). Files can optionally be encrypted at rest with AES-256-GCM. We never share submitted binaries — only de-identified IOCs (hashes, IPs, domains) feed our optional public threat feed, and you can opt out per upload.
No. Anonymous analyses are supported (rate-limited per IP). A free account saves your history for 7 days and raises the limits to 5 analyses a day and APKs up to 200 MB. JADX decompilation, PDF/STIX exports, webhooks and the API are part of Pro.
VirusTotal tells you if a hash is known-malicious. Droidwatch tells you why, how and what to do about it: full static + dynamic analysis, MITRE ATT&CK Mobile mapping, MASVS/MASTG coverage, banking-trojan family detection. MobSF is great open source — but you have to host, scale, patch and integrate it yourself. Droidwatch ships the same depth as a hosted multi-tenant platform with billing, collaboration, watchlists and a managed threat feed.
No. Droidwatch is a hosted service: the web platform, the REST API and the CLI we distribute. Files are analysed in an isolated sandbox, can be encrypted at rest with AES-256-GCM, and we never share submitted binaries.
HTML, JSON, CSV, PDF (executive + technical), DOCX, Markdown and STIX 2.1 for SIEM/SOAR ingestion. Findings include MITRE ATT&CK Mobile IDs and OWASP MASVS/MASTG references.
GDPR: yes — we publish a DPA (Art. 28), retention is configurable per plan, and account export/deletion is self-serve. SOC 2 Type II is on the roadmap (controls are in place: audit log with append-only trigger, structured logging, MFA, encryption at rest, backups + DR plan). Banking customers can request a current trust pack from [email protected].
Yes — REST API plus drop-in templates for six CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitrise, Jenkins, CircleCI and Azure Pipelines. Same contract everywhere: upload APK → wait for verdict → publish run_id / verdict / score / report_url → fail the build per your policy.
It depends on the size of the app. Static analysis of a 50 MB APK typically takes 2 to 5 minutes; apps over 100 MB average 8 to 10 minutes. Dynamic analysis (Frida-based) depends on the runtime budget you set, default 5 minutes.
We're typically 10–50× cheaper on a per-seat / per-app basis. We don't replace an MTD agent on-device — we're a vetting + threat-intel platform for the APKs themselves, designed for fintechs and SOCs that can't justify enterprise-MTD pricing.
Yes. We run apps in an isolated sandbox on your own device or emulator, connected through our agent and instrumented with Frida hooks for SSL pinning, accessibility abuse, SMS interception, overlay attacks, JNI bridges and runtime DEX dumps. Anti-emulator and anti-Frida bypass are built in by default. Dynamic analysis is Android-only — iOS is static analysis.
Yes — full static analysis. Upload an .ipa and we parse Info.plist (App Transport Security, URL schemes, declared privacy permissions, background modes), signing & entitlements (provisioning profile, get-task-allow, enterprise distribution, associated domains, app groups), and the Mach-O executable itself (PIE/ASLR, stack canaries, FairPlay encryption, memory-unsafe functions, code signature, @rpath dylib hijacking, linked frameworks). iOS-specific YARA rules (jailbreak detection, anti-debugging, Frida/Cydia Substrate instrumentation, private-API usage) and a dedicated weighted risk score run too, alongside the format-agnostic checks: hardcoded secrets, network IOCs, VirusTotal and fuzzy hashing. Not yet on iOS: dynamic/runtime analysis (no emulator/device install) and the Androguard-based ML model — those remain Android-only.
Whether you run a 50-person SOC, manage mobile security for a regional bank, or integrate APK scanning into a CI/CD pipeline for 100+ apps — Droidwatch Enterprise is designed for you.
No credit card required. Free plan never expires. Results in minutes.
Create free account