File scan report
Verdict Suspicious
Is onstream-
Two of the 51 antivirus engines that checked it identify Android riskware or potentially unwanted traits, but major antivirus engines and the sandbox summary provide no malicious corroboration.
Why Suspicious? 2 antivirus engines flag it, but no major engine agrees; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Use only a copy obtained from a verified developer channel and confirm its Android signing certificate before installation. Keep device protection enabled and deny permissions that are unnecessary for the app's stated function.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete the APK file. If you need the app, get it from Google Play instead.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumMobile malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from AndroidFind the bad app and clean your phone. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 51 flagged
- Flagged 2
- No detection 49
- No result 24
- Code signing Not applicable
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
AhnLab-V3 and BitDefenderFalx flagged this APK for potentially unwanted or test-key riskware traits, while no major antivirus engines identified malware. The sandbox summary showed no high-risk techniques or malicious verdict, but the APK was not available for static inspection and its network contacts lack a complete reputation check.
Two of the 51 antivirus engines that checked it flagged the APK, with labels describing potentially unwanted software and an Android package using a test key. None of the major antivirus engines identified malware, and there is no consensus on a real malware family. The combined sandbox summary contains no high-risk techniques, named injection targets, or malicious verdict. The sample has been submitted by 112 sources, which reduces concern that it is wholly unobserved but does not establish benignity. Because the APK contents were not available for our static analysis and the observed hosts were not fully reputation-checked, the two detections cannot be confidently dismissed.
What We Detected
Two of the 51 antivirus engines that checked it flagged this Android package. AhnLab-V3 described it as a potentially unwanted application, while BitDefenderFalx identified Android riskware associated with a test signing key. No major antivirus engines identified malware, and the labels do not establish a specific malware family.
Threat Behavior
The combined sandbox summary recorded techniques commonly seen in legitimate Android applications, with no high-risk technique, named injection target, persistence indicator, or malicious sandbox verdict. Network activity was recorded, but a complete reputation result for those hosts is not available. Our static analysis did not inspect the APK contents, so permissions, embedded code, and network configuration were not independently reviewed.
What To Do Now
Install the APK only if it came from the developer's verified distribution channel and its signing certificate can be independently confirmed. Keep Android security protections enabled, avoid granting unnecessary permissions, and prefer an official app-store version where available.
Where this verdict could be wrong2 caveats
- Two independent engines identify potentially unwanted or riskware characteristics, including use of an Android test key.
- The observed network contacts lack a complete host-reputation check, and the APK was not available for our static inspection.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines identified malware.
- The sandbox summary contains no high-risk techniques or malicious verdict.
- The sample has been submitted by 112 distinct sources.
- Two independent engines identify potentially unwanted or riskware characteristics.
- One detection specifically indicates that the Android package uses a test signing key.
- The APK contents were not available for our static inspection.
- A complete reputation check for the observed network contacts is unavailable.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 0spawned processes
- 19network contacts
- 3filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Note: Talked to servers over the internet during the test run.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
onstream-mobile-v1.2.0 onstreamapp.app.apk
2e82e82fbdaee6af1cf47d1f5870a4b309d89d243ce666488c364dd013be2005
Uploaded file
- 2
Files
Created or changed
- Evidence 2 of 5: Written fileSeen in the test run
com.maertsno.m.client_cast_analytics_data.xml
/data/user/0/com.maertsno.m/shared_prefs/com.maertsno.m.client_cast_analytics_data.xml
Test run - Evidence 3 of 5: Written fileSeen in the test run
file.txt
/data/user/0/com.maertsno.m/app_notix/subfolder/file.txt
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 4 of 5: Contacted hostSeen in the test run
104.21.35.85
Contacted during the test run.
Test run - Evidence 5 of 5: Contacted hostSeen in the test run
172.67.223.179
Contacted during the test run.
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1406
- T1409
- T1421
- T1422
- T1424
- T1426
- T1430
- T1573
Observed activity
Network contacts
1919 hosts, listed as 19 addresses. Links show the host and path only.
- IP address
104.21.35.85 - IP address
172.67.223.179 - IP address
185.199.108.133 - IP address
142.251.167.139 - IP address
142.251.154.119 - IP address
216.239.35.4
Show all 19 entries for network contacts
- IP address
172.64.145.116 - IP address
172.64.146.234 - IP address
104.18.42.140 - IP address
104.26.14.117 - IP address
18.154.101.64 - IP address
34.49.44.84 - IP address
151.101.64.176 - IP address
173.194.194.94 - IP address
104.21.64.137 - IP address
173.194.193.138 - IP address
173.194.206.106 - IP address
209.85.200.95 - IP address
209.85.145.94
Files
3Files the file created, changed or deleted.
- Written
/data/user/0/com.maertsno.m/shared_prefs/com.maertsno.m.client_cast_analytics_data.xml - Written
/data/user/0/com.maertsno.m/app_notix/subfolder/file.txt - Written
/data/user/0/com.maertsno.m/files/.crashlytics.v3/com.maertsno.m/initialization_marker
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
8.8.8.8
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 9b713f18b47d98a05669…72d9b9Not checkedno saved verdict
Chapter 04
Technical details
2 of the 51 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
- AhnLab-V3PUP/Android.SigKpm.1302671
- BitDefenderFalxAndroid.Riskware.TestKey.rA
File fingerprint
- Last analyzed
- Jun 18, 2026, 9:43 PM UTC
- SHA-256
2e82e82fbdaee6af1cf47d1f5870a4b309d89d243ce666488c364dd013be2005- SHA-1
44e82bf8fa3806f79a9f9d37386ef685353342ef- MD5
c1d87bfce447487e51b5a9d00565fb42
About this file
onstream-mobile-v1.2.0 onstreamapp.app.apk is an Android file of 22.8 MB.
- Type and size
- Android · 22.8 MB
- Signer
- Not applicable
- First seen
- Apr 15, 2026On VirusTotal.
- Submitted by
- 112 distinct sources
First scanned Updated
Antivirus consensus
2 of 51 engines flagged this file
24 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-19 engines0flagged
- Tier-231 engines1flagged
- Low-trust11 engines1flagged
View all 75 engine results
- AhnLab-V3Malicious: PUP/Android.SigKpm.1302671
- BitDefenderFalxMalicious: Android.Riskware.TestKey.rA
- AcronisClean
- AlibabaClean
- alibabacloudNo result
- ALYacNo result
- Antiy-AVLClean
- APEXNo result
- ArcabitNo result
- AvastNo result
- Avast-MobileClean
- AVGNo result
- AviraClean
- BitDefenderNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftNo result
- ESET-NOD32No result
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightClean
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookClean
- VaristClean
- VBA32No result
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is onstream-mobile-v1.2.0 onstreamapp.app.apk safe, or is it malware?
What is onstream-mobile-v1.2.0 onstreamapp.app.apk?
How many antivirus engines detected onstream-mobile-v1.2.0 onstreamapp.app.apk?
I already downloaded and installed onstream-mobile-v1.2.0 onstreamapp.app.apk — what should I do?
What is the SHA-256 hash of onstream-mobile-v1.2.0 onstreamapp.app.apk?
How up to date is this analysis of onstream-mobile-v1.2.0 onstreamapp.app.apk?
Community
Member reviews and reports for this exact file hash.