6180ced96b5f13d0fa66fc76e9a390fd134462da158cef5073e5204bcacaba6f.apk
- SHA256 6180ced96b5f13d0fa66fc76e9a390fd134462da158cef5073e5204bcacaba6f
-
Android dropper: runtime DEX/class loading of a staged payload
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
-
Boot-triggered restart with disguised foreground service
Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.
-
Notification listener abuse for OTP and message theft
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.