Android is open source software, which means developers who don't work for Google are allowed to see the sourcecode and create a range of applications to work with it.
They capture samples via honey pots and customer reports, un-package them, reverse engineer the executables so they can see the sourcecode, and try to figure out what the malware is doing.