Exploits often have very distinct signatures. For example, z4root uses exploits to gain root access to a device. These techniques for privilege escalation can be known to an anti-virus program, an flag any app that contains similar API calls.
Lookout uses some advanced techniques. For example, it can determine the difference between adware, and an app with advertisements.
- Displays advertising outside of the normal app experience
- Harvests unusual personally identifiable information, or
- Performs unexpected actions as a response to ad clicks; appropriate user consent entails providing a clear alert in the application that
allows the user to accept or decline before any of the above behaviors
For runtime checks, it can observe dynamically generated content. For example, I could write a malware program that intends to send data to http://evil.example.org. If I hard coded that into the app, it would be flagged by their domain filters before being installed. If I instead set up a server at http://imnotevil.com, that would return a redirect to http://evil.example.org on the third request from an IP, it would need to be checked at run time.
I recommend reading their blog for the various exploits they've discovered.