The analyzed benign apps from different categories were collected during my [master thesis][1] originated at Technische Universit?t Berlin. The dynamic analysis was performed on several LG Nexus 5 devices with Android API 23. It was part of a hybrid analysis. The activities and services of the malware were started. The [Xposed framework][3] with the [Droidmon][4] module were used to log the API calls. The default [hooks.json][5] with 64 API calls was utilized. Every Malware app is uniquely identified by its sha256 sum. Please find more information on my [github profile][6]. [1]: https://github.com/goorax/master_thesis/blob/master/master_thesis.pdf [3]: http://repo.xposed.info/ [4]: https://github.com/idanr1986/droidmon [5]: https://github.com/idanr1986/droidmon/blob/master/hooks.json [6]: https://github.com/goorax/master_thesis