MalwareTips

File scan report

Scan another file

Verdict Suspicious

Analyzed , 3 months ago

Is cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk safe? Treat it as suspicious.

Unsigned Android APK with zero engine detections but direct-IP contact flagged by rule and extremely low prevalence.

Read the whole reasonShow less

Why Suspicious? Unsigned APK.

Limited evidence · One sign points to a problem; nothing else confirms it.

Don't install it until you know where it came from

Treat as untrusted; avoid installation until a signed version from a verified publisher can be obtained and re-scanned.

What to do now4 steps

Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.

What to do

  1. Don't install it unless you're sure where it came from.

  2. Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.

  3. If you can't confirm where it came from, delete the APK file. If you need the app, get it from Google Play instead.

If you already installed it

  1. Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.

Not sure what to do?

Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk: Suspicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 61 flagged

  • Flagged 0
  • No detection 61
  • No result 11
Filecryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk23.6 MBSHA-256 352af70965fe…72c169
  • Code signing Not applicable
  • Test run Completed
  • First seen 3y ago
None of the 61 antivirus engines that checked it flag it.

Chapter 02

Why we think so

3 points against it and 3 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

No antivirus engine flagged the sample, yet the file is unsigned, rare, and triggered a direct-IP heuristic. The contacted IP belongs to Google infrastructure with no sandbox confirmation or malicious-host correlation.

Where this verdict could be wrong2 caveats
  • Direct-IP contact to 74.125.133.188 without any domain resolution could indicate a control server evasion, but the IP belongs to Google infrastructure and no sandbox execution or malicious-host cache match exists to confirm intent.
  • Limited evidence on Android APKs is common; absence of detections does not guarantee safety when the file is unsigned and rare.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 0spawned processes
  • 1network contact
  • 0filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • Note: Connected to 1 server during the test run.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 2: FileSeen in the test run

      cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk

      352af70965fe236b8d9aa489b2e91025f5e43ab36262970d1df19635e872c169

      Uploaded file

  2. Network

    Hosts contacted

    1
    1. Evidence 2 of 2: Contacted hostSeen in the test run

      74.125.133.188

      Contacted during the test run.

      Test run

2 facts from the test run. See the full activity list.

Chapter 04

Technical details

None of the 61 antivirus engines that checked it flag it.

Sources checked

Every check behind this verdict

6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 72 enginesCompletePositive signal: 0 of 61 engines flagged it · 11 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded Details for sandbox run
Contacted hostsMalwareTips URL scannerPartial1 host contacted in the test run had no completed reputation check Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesCompleteNo rule matched
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

File fingerprint

Last analyzed
Jul 11, 2026, 8:29 PM UTC
SHA-256
352af70965fe236b8d9aa489b2e91025f5e43ab36262970d1df19635e872c169
SHA-1
d73d223f14adf645a2b60eebc398edf01fd2cf0c
MD5
c04adb6ab0a49b89fd899a975f04db81

About this file

cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk is an Android file of 23.6 MB.

Type and size
Android · 23.6 MB
Signer
Not applicable
First seen
Mar 22, 2023On VirusTotal.
Submitted by
2 distinct sourcesRarely seen: few people have submitted this exact file.

First scanned

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is this file safe, or is it malware?
cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk is rated Suspicious: some signs point to a problem, but nothing confirms it is harmful. No antivirus engine flags it; the caution comes from other evidence, such as who made it, how widely it is used or what it did in a test run. Don't install it unless you're sure where it came from. If you need the app, get it from Google Play instead.
What is this file?
cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk is an Android app (APK), about 23.6 MB. VirusTotal first saw it on Mar 22, 2023.
How many antivirus engines detected this file?
None of the 61 antivirus engines that checked it flag cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk. A clean antivirus result is not proof of safety; the caution comes from other evidence, such as who made it, how widely it is used or what it did in a test run.
I already downloaded and installed this file — what should I do?
No infection is confirmed: the rating is a caution, not a malware finding. 1) Check where it came from. If you can't confirm the source, delete it (and uninstall the app in Settings > Apps). 2) Run a full scan with your security software. 3) If the scan finds something, follow its removal steps and change passwords you typed on the device since then.
What is the SHA-256 hash of this file?
The SHA-256 fingerprint of cryptraider-dwapplications-157-[number]-c04adb6ab0a49b89fd899a975f04db81.apk is 352af70965fe236b8d9aa489b2e91025f5e43ab36262970d1df19635e872c169, and its MD5 is c04adb6ab0a49b89fd899a975f04db81. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of this file?
This report reflects the scan on Jul 11, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.