Deeper than VirusTotal. No infra like MobSF. Upload an Android APK — or an iOS .ipa for static analysis — and get MITRE ATT&CK Mobile mappings, MASVS/MASTG coverage, STIX 2.1 exports and Frida dynamic analysis — in minutes.
Or browse a file. No registration — APK / XAPK / AAB / DEX / IPA up to 150 MB.
By uploading you confirm you have the right to analyze this file and accept our Terms and Privacy policy.
From manifest analysis to deep DEX bytecode inspection
Identifies banking trojans, stalkerware, ransomware, aggressive adware, and government spyware using heuristic analysis and YARA rules.
Every finding mapped to ATT&CK for Mobile tactics and techniques — T1417, T1444, T1636, and more. STIX 2.1 export for SIEM/SOAR integration.
Bytecode-level analysis with androguard: call graph, source-to-sink data flows, dead code detection, and decompilation with JADX.
Detect third-party SDKs and check against OSV.dev for known CVEs. Identifies Meta SDK, Firebase, Adjust, ironSource, and 50+ others.
Compares APK certificate against known publisher fingerprints to detect repackaged apps and certificate spoofing attacks.
Findings cross-referenced against OWASP Mobile Top 10 (2024) and MASVS v2. Automated compliance scoring per domain.
Extracts domains and IPs, resolves them, and checks against threat feeds including MalwareBazaar, AbuseIPDB, and URLhaus.
Export findings as PDF (executive summary), JSON, STIX 2.1, or Markdown. Ready for GitHub issues, JIRA, and SIEM ingestion.
Monitor package names and get notified when a new variant is analyzed. Browser notifications, in-app alerts, email, and webhooks.
Android — full static + dynamic coverage. iOS — full static analysis (no runtime).
Static + dynamic analysis. 35+ analyzers, MITRE ATT&CK Mobile, MASVS/MASTG coverage, ML engine (F1 0.9873).
Full static analysis: Info.plist (ATS, URL schemes, privacy), signing & entitlements, deep Mach-O binary checks (PIE/ASLR, stack canaries, encryption, insecure functions, code signature), iOS YARA rules (jailbreak, Frida/Substrate, private APIs) and weighted risk scoring — plus strings/secrets/network IOCs and VirusTotal. No dynamic/runtime or ML model on iOS yet. Talk to us →
Three lines of YAML — upload, wait for verdict, fail the build per your policy. Same outputs on every platform.
include: remote: template. YAML →
Drop-in step.yml. Manifest →
Shared library function. Groovy →
Publishable Orb. Source →
Step template. YAML →
# .gitlab-ci.yml — one drop-in include, that's it
include:
- remote: 'https://droidwatch.app/ci/gitlab/scan.yml'
variables:
DROIDWATCH_APK_PATH: app/build/outputs/apk/release/app-release.apk
DROIDWATCH_FAIL_ON: "Malicious|High Risk"
Designed so a banking CISO or a DPO can sign off without exception forms.
Every analysis runs in a worker with a restrictive seccomp profile, cap_drop ALL and CPU/memory limits. No access to private networks or other tenants.
Docker or Kubernetes deployment with Kustomize manifests and KEDA autoscaling. APKs and reports never leave your perimeter.
Data Processing Addendum (Art. 28) published, per-plan retention, self-serve account export/deletion. Sub-processors disclosed.
Reports optionally encrypted with AES-256-GCM (DWE1 envelope). Append-only audit log in PostgreSQL with an immutable trigger.
Controls already in place: MFA, audit log, structured logging, backups + DR plan. Request the current trust pack at [email protected].
If you opt in to the public threat feed, only hashes, domains and IPs are shared — never the binary or uploader metadata.
Start free. Scale when you need to.
Quick answers to what SOC analysts, fintech security teams and CISOs ask before signing up.
Every APK is analyzed inside an isolated sandbox (seccomp + capability drop + resource limits on the worker). Files can optionally be encrypted at rest with AES-256-GCM, and you can choose a self-hosted deployment so APKs never leave your infrastructure. We never share submitted binaries — only de-identified IOCs (hashes, IPs, domains) feed our optional public threat feed, and you can opt out per upload.
No. Anonymous analyses are supported (rate-limited per IP). Create a free account to keep history, get PDF/STIX exports, use webhooks, and access the API.
VirusTotal tells you if a hash is known-malicious. Droidwatch tells you why, how and what to do about it: full static + dynamic analysis, MITRE ATT&CK Mobile mapping, MASVS/MASTG coverage, banking-trojan family detection. MobSF is great open source — but you have to host, scale, patch and integrate it yourself. Droidwatch ships the same depth as a hosted multi-tenant platform with billing, collaboration, watchlists and a managed threat feed.
Yes. Enterprise customers get a Docker / Kubernetes deployment they run inside their own perimeter (we ship Kustomize manifests + KEDA autoscaling). Your APKs and reports stay in your tenant.
HTML, JSON, CSV, PDF (executive + technical), DOCX, Markdown and STIX 2.1 for SIEM/SOAR ingestion. Findings include MITRE ATT&CK Mobile IDs and OWASP MASVS/MASTG references.
GDPR: yes — we publish a DPA (Art. 28), retention is configurable per plan, and account export/deletion is self-serve. SOC 2 Type II is on the roadmap (controls are in place: audit log with append-only trigger, structured logging, MFA, encryption at rest, backups + DR plan). Banking customers can request a current trust pack from [email protected].
Yes — REST API plus drop-in templates for six CI/CD platforms: GitHub Actions, GitLab CI/CD, Bitrise, Jenkins, CircleCI and Azure Pipelines. Same contract everywhere: upload APK → wait for verdict → publish run_id / verdict / score / report_url → fail the build per your policy. Self-hosted Droidwatch works too — the runners pull from your instance.
Static analysis: typically 30–90 seconds for a 50 MB APK, up to a few minutes for very large bundles. Dynamic analysis (Frida-based) depends on the runtime budget you set, default 5 minutes.
We're typically 10–50× cheaper on a per-seat / per-app basis, with self-host as an option. We don't replace an MTD agent on-device — we're a vetting + threat-intel platform for the APKs themselves, designed for fintechs and SOCs that can't justify enterprise-MTD pricing.
Yes. We run apps in an isolated sandbox (local emulator BYO-device or Docker AVD), instrumented with Frida hooks for SSL pinning, accessibility abuse, SMS interception, overlay attacks, JNI bridges and runtime DEX dumps. Anti-emulator and anti-Frida bypass are built in by default. Dynamic analysis is Android-only — iOS is static analysis.
Yes — full static analysis. Upload an .ipa and we parse Info.plist (App Transport Security, URL schemes, declared privacy permissions, background modes), signing & entitlements (provisioning profile, get-task-allow, enterprise distribution, associated domains, app groups), and the Mach-O executable itself (PIE/ASLR, stack canaries, FairPlay encryption, memory-unsafe functions, code signature, @rpath dylib hijacking, linked frameworks). iOS-specific YARA rules (jailbreak detection, anti-debugging, Frida/Cydia Substrate instrumentation, private-API usage) and a dedicated weighted risk score run too, alongside the format-agnostic checks: hardcoded secrets, network IOCs, VirusTotal and fuzzy hashing. Not yet on iOS: dynamic/runtime analysis (no emulator/device install) and the Androguard-based ML model — those remain Android-only.
No credit card required. Free plan never expires. Results in under 5 minutes.
Custom pricing, on-premise deployment, dedicated SLA, and white-glove onboarding for security teams at scale.
Whether you run a 50-person SOC, manage mobile security for a regional bank, or integrate APK scanning into a CI/CD pipeline for 100+ apps — Droidwatch Enterprise is designed for you.