MalwareLensAI: An Automated Malware Reverse Analysis Platform Based on Generative AI

MalwareLensAI is an end-to-end AI-driven malware analysis platform designed specifically for bank security teams. It combines static analysis, multi-stage intelligent pipelines, and the Google Gemini large model to enable automated deep reverse engineering of APK files. This platform aims to address the pain points where traditional antivirus software is ineffective against new malware and manual reverse engineering is time-consuming, providing a solution that combines the speed of automation with the depth of expert-level analysis.

Mobile Financial Security Threats

In the field of mobile financial security, malicious Android applications pose a severe threat to the banking industry: counterfeit bank apps stealing credentials, SMS interception bypassing two-factor authentication, overlay attacks for phishing, and abuse of accessibility services to execute unauthorized transactions.

Limitations of Traditional Methods

• Traditional antivirus software relies on signature databases and is ineffective against new/obfuscated/repackaged malware;
• Manual reverse engineering is thorough but time-consuming, requiring deep Android expertise.

Needs of Bank Teams

There is an urgent need for tools that combine the speed of automation with the depth of expert-level analysis.

MalwareLensAI adopts a front-end and back-end separation architecture:

• Front-end: Responsive interface built with Next.js 15 and React 19;
• Back-end: FastAPI provides RESTful API services.

Core tech stack includes: androguard (APK parsing), Google Gemini (AI analysis), ReportLab (PDF report generation).

Platform workflow: After uploading an APK, a threat profile is built through a multi-stage intelligent pipeline.

The core of the platform is a nine-stage sequential analysis pipeline:

1. APK Fingerprint Extraction: Obtain basic information such as cryptographic hashes, package metadata, and signature certificates;
2. DEX Bytecode Reverse Engineering: Reconstruct real API call signatures;
3. Dual-Layer Static Detection: Match method reference patterns and scan string pools (URLs, IPs, etc.);
4. Evidence-Driven Threat Intelligence: Multi-signal rule engine that classifies only when multiple independent pieces of evidence converge (e.g., OTP theft requires SMS permissions + SmsManager API);
5. Behavioral Capability Assessment: Predict runtime capabilities based on permissions, components, etc., without the need for a sandbox;
6. AI Malware Analyst: Gemini inference generates expert analysis, falling back to the rule engine when no API key is available;
7. Explainable Risk Scoring: 0-100 scale with transparent weight display;
8. MITRE ATT&CK Mapping: Automatically map to the mobile technology framework, including technical IDs and evidence chains;
9. Professional Report Generation: Generate PDF reports (executive summary, findings, evidence, etc.).

1. Evidence-driven detection: Each behavior classification requires multiple independent evidence sources;
2. AI fallback mechanism: Automatically switches to the rule engine when no Gemini API key is available;
3. Explainable risk scoring: Transparently displays the contribution weights of each factor;
4. MITRE ATT&CK mapping: Aligns with industry-standard threat models;
5. Pure static architecture: No need for Docker, emulators, or runtime environments, reducing deployment complexity.

Application Scenarios

• Full workflow automation of APK analysis for bank security teams;
• Real-time dashboard displaying aggregated metrics (threat distribution, risk trends, etc.);
• Generate PDF reports for regulatory compliance, incident response records, and security audits.

Value

• Responsive dark theme interface with real-time progress tracking and interactive visualization;
• Simplify complex analysis processes and improve team efficiency.

MalwareLensAI combines generative AI with traditional static analysis techniques to provide bank security teams with a fast and in-depth malware analysis solution. Its evidence-driven design and explainable scoring mechanism serve as a credible example of AI applications in the security field. In the future, the platform will continue to provide scalable, automated analysis capabilities for teams handling large numbers of APK samples while maintaining expert-level analysis quality.