afc0be54d90c0e3ffa73ac9078e8d37b086fc9088827b19fbb9f588a189d2fcf.apk
- SHA256 afc0be54d90c0e3ffa73ac9078e8d37b086fc9088827b19fbb9f588a189d2fcf
-
Android dropper: runtime DEX/class loading of a staged payload
Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.
-
Notification listener abuse for OTP and message theft
Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban
-
Root, emulator and instrumentation-framework detection
Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.
-
Runtime string decryption with reflective method dispatch
Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.