Source: worked on something similar a long time ago
Likely hash based scanning like most virus scanners. It will have a set of signatures for various types of malware (keyloggers, local DNS servers, etc), and looks through the apk (which is just a zip file) for things it knows are bad like financial malware added to the app.
Their process for adding signatures to their database and how they label them is fully opaque and completely up to them, like any other antivirus company. So they could incorrectly label things intentionally and you’d have no way to know.
given your device is now compromised you should probably get a new one unless you trust android is able to fully remove the app. Because some financial malware will intercept 2fa sms from your bank.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Source: worked on something similar a long time ago
Likely hash based scanning like most virus scanners. It will have a set of signatures for various types of malware (keyloggers, local DNS servers, etc), and looks through the apk (which is just a zip file) for things it knows are bad like financial malware added to the app.
Their process for adding signatures to their database and how they label them is fully opaque and completely up to them, like any other antivirus company. So they could incorrectly label things intentionally and you’d have no way to know.
given your device is now compromised you should probably get a new one unless you trust android is able to fully remove the app. Because some financial malware will intercept 2fa sms from your bank.
The Google Play app fails to include a libre software licence text file, like GPL. We do not control it, anti-libre software. Very dangerous!