f84e5ccc0c78f97e27d486f22c28f7f3c8f48f7455f51ce4c89940297057fd26.apk
- SHA256 f84e5ccc0c78f97e27d486f22c28f7f3c8f48f7455f51ce4c89940297057fd26
-
Boot-triggered restart with disguised foreground service
Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.
-
Covert microphone or camera capture with exfiltration
Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.
-
Root, emulator and instrumentation-framework detection
Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.