e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000.apk
- SHA256 e939e9c32b65e10e295056d8d535e78b0a9efd26da3de036e83b3b0e9147c000
-
Android dropper: runtime DEX/class loading of a staged payload
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
-
Boot-triggered restart with disguised foreground service
Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.
-
Contact harvesting with SMS self-propagation
Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.
-
Covert microphone or camera capture with exfiltration
Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.
-
Notification listener abuse for OTP and message theft
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
-
Runtime string decryption with reflective method dispatch
Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.