File verdict·Decided by the MT AI Engine
Our call

Suspicious

Android app flagged as PUA by 2 low-tier engines; direct-IP contact to legitimate CDN infrastructure; no malware consensus or malicious behaviour observed.

Trust score52Caution
MT AI confidence · 62%
onstream-mobile-v1.2.0 onstreamapp.app.apk
21.8 MB
2e82e82fbdaee6af1cd013be2005
Antivirus engines
2 of 75 flagged
Code signing
Unsigned
Age
First seen 2mo ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

62%Confidence
Moderate
Reasoning

This Android APK presents mixed signals. Two engines flagged it as PUA/Riskware, but tier-1 engines remained silent and no consensus family emerged. The direct-IP contact heuristic fired because the app contacted external IPs without DNS queries — a pattern typically associated with malware C2 evasion. However, the contacted IPs are predominantly legitimate CDN and cloud services (Google DNS, Cloudflare, AWS), suggesting the app uses hardcoded IP fallbacks for resilience rather than malicious intent. The app's behaviour shows ambient Android techniques (location services, system discovery, C2 communication) consistent with a mobile app collecting telemetry, not offensive malware activity. The file is unsigned, moderately prevalent (112 submitters), and has no external intelligence hits. The generic PUA labels and low detection rate (2/67) suggest either a false positive or a low-risk potentially unwanted app rather than a confirmed malware threat.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 2/67 malicious (AhnLab low-trust, BitDefenderFalx tier2); tier1Malicious=0; no tier-1 family consensus

  2. Both detections flagged as adwarePua (PUP/Android.SigKpm.1302671, Android.Riskware.TestKey.rA) — generic PUA labels, not named malware family

  3. Contacted IPs include legitimate infrastructure (8.8.8.8 Google DNS, Cloudflare, AWS, Google CDN) — not a malicious C2 cluster

  4. behaviour: 0 offensive MITRE techniques; 9 ambient (location services, system discovery, C2 communication) consistent with mobile app telemetry

  5. prevalence: medium (112 submitters, 123 submissions); no external intel hits (CIRCL, YARAify, MalwareBazaar); 1 dropped child inspected, 0 malicious

Points in its favour
  • No tier-1 engine detections (Kaspersky, Microsoft, ESET, Avast, BitDefender all silent)
  • Contacted IPs are legitimate cloud infrastructure (Google, Cloudflare, AWS), not malicious C2
  • No malicious dropped children (1 inspected, 0 malicious)
  • No external intelligence hits (CIRCL, YARAify, MalwareBazaar)
  • Moderate prevalence (112 submitters, 123 submissions) suggests known app in circulation
Points against
  • Direct-IP contact without DNS queries (bypasses domain-based blocklists)
  • Generic PUA/Riskware labels from 2 engines (low consensus)
  • Unsigned APK with no signer history
  • Obfuscated code and runtime-module loading
  • Location tracking and telephony permissions
What to do

This file shows mixed signals consistent with either a low-risk PUA or a false positive. If you obtained this from an official app store, the risk is likely low; if from a third-party source, verify its legitimacy before use. Monitor for unexpected data usage or permission abuse.

Threat family attribution

sigkpm corroborated by 1 source

  • VT (75 engines)
    sigkpm
Dropped payload

Files this sample writes at runtime

This file drops 1 child at runtime. None are currently flagged malicious in our cache.

1 unseen
  • 9b713f18b47d98a0566972d9b9Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 synthesis
MITRE ATT&CK profile
C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • DirectIpC2medium

    Sample contacted 20 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    104.21.35.85 · 172.67.223.179 · 8.8.8.8
Antivirus engine breakdown

2 detections across 75 engines

2 malicious0 suspicious73 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
1flag
Mainstream engines with mixed FP rates
Low-trust20 engines
1flag
Heuristic / generic-AI engines (high FP rate)
AhnLab-V3
malicious
PUP/Android.SigKpm.1302671
BitDefenderFalx
malicious
Android.Riskware.TestKey.rA
Hash 2e82e82fbdae… cross-referenced against 75 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
112
Hundreds of people have uploaded this — common.
Total submissions
123
Includes repeat uploads by the same source.
First seen by VT
2mo ago
Apr 15, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
4/15/2026, 7:49:31 PM
First seen (MalwareBazaar)
Last analysis (VT)
6/7/2026, 10:54:17 PM
Scanned here
6/18/2026, 5:43:44 PM
File name
onstream-mobile-v1.2.0 onstreamapp.app.apk
Size
21.75 MB
MIME type
(unknown)
Detected type
Android
SHA-256
2e82e82fbdaee6af1cf47d1f5870a4b309d89d243ce666488c364dd013be2005
MD5
c1d87bfce447487e51b5a9d00565fb42
SHA-1
44e82bf8fa3806f79a9f9d37386ef685353342ef
First seen (VT)
4/15/2026, 7:49:31 PM
Last analysis (VT)
6/7/2026, 10:54:17 PM
First scan (MalwareTips)
6/18/2026, 5:43:44 PM
Last scan (MalwareTips)
6/18/2026, 5:43:44 PM
Behavior tags
runtime-modulescontains-elftelephonyobfuscatedapkchecks-gpsreflectionandroid
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.