Antiy Persistent Threat Analysis System (PTA-mobile) is a dynamic behavior analysis system developed by Antiy Labs for analyzing Android applications. It uses sandbox technology to perform fine-grained, scene-based dynamic behavior analysis on Android apps, capturing runtime behaviors that static analysis techniques may miss due to obfuscation or code reinforcement. The system monitors and records over 200 dynamic behaviors across 26 categories including calls, SMS, network activity, database access, address book interactions, and media operations. It captures runtime network data such as URLs, IPs, SMS, email, and FTP communications, and extracts intermediate files generated during application execution. PTA-mobile generates detailed dynamic analysis reports combining behavioral logs, network communication records, runtime screenshots, and intermediate files. It includes a static analysis plug-in that uses a threat knowledge base to supplement dynamic findings. The system is available in two deployment forms: - Server: Deployed as an independent analysis system with high-volume processing capabilities. - Mobile: A portable form factor using real mobile devices as the analysis carrier. PTA-mobile is designed for use by mobile application security auditors, malware analysts, security researchers, government agencies, and enterprise security teams. It can be linked with the Antiy Persistent Threat Detection System (PTD) for traffic monitoring and malicious file analysis, and supports integration with other security products via an open collaborative service interface.