As smartphone are becoming more common, services using smartphones are becoming more pervasive too. Among them, as mobile banking transactions are increasing, payment fraud is also rapidly increasing. These services handle sensitive information, such as users' personal information and payment information, but as they have several security vulnerabilities, they are attacked by malicious apps. This paper proposes a method of deriving malicious app detection signatures based on the behavior information, obtained by analyzing malicious apps collected through several application distribution channels, and these signatures will be used for analysis of variants of malicious apps and development of rule-based malicious app detection systems.