f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726.apk
- SHA256 f6da0d9f1d74f2f80cd4d69183a78ccc1b3679689419262c9704787cea754726
-
Android dropper: runtime DEX/class loading of a staged payload
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
-
Root, emulator and instrumentation-framework detection
Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.