Suspicious
Android app flagged as PUA by 2 low-tier engines; direct-IP contact to legitimate CDN infrastructure; no malware consensus or malicious behaviour observed.
2e82e82fbdaee6af1c…d013be2005The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This Android APK presents mixed signals. Two engines flagged it as PUA/Riskware, but tier-1 engines remained silent and no consensus family emerged. The direct-IP contact heuristic fired because the app contacted external IPs without DNS queries — a pattern typically associated with malware C2 evasion. However, the contacted IPs are predominantly legitimate CDN and cloud services (Google DNS, Cloudflare, AWS), suggesting the app uses hardcoded IP fallbacks for resilience rather than malicious intent. The app's behaviour shows ambient Android techniques (location services, system discovery, C2 communication) consistent with a mobile app collecting telemetry, not offensive malware activity. The file is unsigned, moderately prevalent (112 submitters), and has no external intelligence hits. The generic PUA labels and low detection rate (2/67) suggest either a false positive or a low-risk potentially unwanted app rather than a confirmed malware threat.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 2/67 malicious (AhnLab low-trust, BitDefenderFalx tier2); tier1Malicious=0; no tier-1 family consensus
Both detections flagged as adwarePua (PUP/Android.SigKpm.1302671, Android.Riskware.TestKey.rA) — generic PUA labels, not named malware family
Contacted IPs include legitimate infrastructure (8.8.8.8 Google DNS, Cloudflare, AWS, Google CDN) — not a malicious C2 cluster
behaviour: 0 offensive MITRE techniques; 9 ambient (location services, system discovery, C2 communication) consistent with mobile app telemetry
prevalence: medium (112 submitters, 123 submissions); no external intel hits (CIRCL, YARAify, MalwareBazaar); 1 dropped child inspected, 0 malicious
- No tier-1 engine detections (Kaspersky, Microsoft, ESET, Avast, BitDefender all silent)
- Contacted IPs are legitimate cloud infrastructure (Google, Cloudflare, AWS), not malicious C2
- No malicious dropped children (1 inspected, 0 malicious)
- No external intelligence hits (CIRCL, YARAify, MalwareBazaar)
- Moderate prevalence (112 submitters, 123 submissions) suggests known app in circulation
- Direct-IP contact without DNS queries (bypasses domain-based blocklists)
- Generic PUA/Riskware labels from 2 engines (low consensus)
- Unsigned APK with no signer history
- Obfuscated code and runtime-module loading
- Location tracking and telephony permissions
This file shows mixed signals consistent with either a low-risk PUA or a false positive. If you obtained this from an official app store, the risk is likely low; if from a third-party source, verify its legitimacy before use. Monitor for unexpected data usage or permission abuse.
sigkpm corroborated by 1 source
- VT (75 engines)sigkpm
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- 9b713f18b47d98a05669…72d9b9Never scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 20 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence104.21.35.85 · 172.67.223.179 · 8.8.8.8
2 detections across 75 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- onstream-mobile-v1.2.0 onstreamapp.app.apk
- Size
- 21.75 MB
- MIME type
- (unknown)
- Detected type
- Android
- SHA-256
- 2e82e82fbdaee6af1cf47d1f5870a4b309d89d243ce666488c364dd013be2005
- MD5
- c1d87bfce447487e51b5a9d00565fb42
- SHA-1
- 44e82bf8fa3806f79a9f9d37386ef685353342ef
- First seen (VT)
- 4/15/2026, 7:49:31 PM
- Last analysis (VT)
- 6/7/2026, 10:54:17 PM
- First scan (MalwareTips)
- 6/18/2026, 5:43:44 PM
- Last scan (MalwareTips)
- 6/18/2026, 5:43:44 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.