Is release.apk safe?
Two tier-1 engines identify this young Android package as ReVPN-related riskware or PUA, while runtime and external research provide no malicious corroboration.
Four of 75 engines flagged the APK, including Kaspersky and Sophos, primarily with ReVPN, risk-tool, or PUA labels. One completed sandbox found no offensive-only behavior or malicious outcome, but direct-IP traffic lacked a complete host-reputation check, leaving meaningful uncertainty.
3ab64620df975832a0…59a6b3f464d02dRecommended next actions
Before installing
Do not install it until the source and publisher can be verified independently.
If you already installed it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from Google Play or the developer's official store.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
Four of 75 engines flagged the APK, including Kaspersky and Sophos, primarily with ReVPN, risk-tool, or PUA labels. One completed sandbox found no offensive-only behavior or malicious outcome, but direct-IP traffic lacked a complete host-reputation check, leaving meaningful uncertainty.
The detections are limited to 4 of 75 engines, but two come from independent tier-1 engines, so they cannot be dismissed as low-trust noise. Their labels describe ReVPN-related riskware or a potentially unwanted Android application rather than a consistently identified trojan family. One completed sandbox produced no malicious verdict and recorded no offensive-only techniques. However, the APK contacted numerous IP addresses directly, and no complete reputation cross-check is available for those hosts. No malicious child, researcher-rule match, or known-malicious intelligence record independently corroborates the detections, making the evidence mixed rather than conclusive.
What We Detected
Four of 75 antivirus engines flagged the APK. Kaspersky identified a ReVPN-related Android risk tool, Sophos called it an Android PUA, and BitDefenderFalx used a generic Android riskware label. Two detections came from tier-1 engines, although there was no strong agreement on a specific malware family.
Threat Behavior
One completed sandbox observation produced no malicious verdict and recorded five ambient Android techniques, with no offensive-only techniques. The application contacted numerous external IP addresses without recorded application domains, which triggered a direct-IP traffic heuristic. Because the contacted-host reputation check was not completed or saved, those no complete contacted-host reputation result was available or malicious. One dropped child was inspected, but no malicious child was established.
What To Do Now
Avoid installing this APK unless its source and intended VPN or proxy functionality can be independently verified. Prefer the developer's official store listing or release channel, keep mobile protection enabled, and remove the application if its permissions or network activity do not match its stated purpose.
Where this verdict could be wrong4 caveats
- 15 of 17 tier-1 engines reported no detection, so the two tier-1 risk-tool/PUA findings are not broad consensus.
- The completed sandbox returned no malicious verdict and observed no offensive-only MITRE techniques.
- No CIRCL, MalwareBazaar, or YARAify match corroborated a known malware family.
- The APK is only three days old, limiting the value of its current detection and prevalence history.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 4 of 75 engines reported a detection.
- 15 of 17 tier-1 engines reported no detection.
- One completed sandbox produced no malicious verdict and no offensive-only techniques.
- No malicious dropped child was identified.
- CIRCL, MalwareBazaar, and YARAify supplied no known-malicious corroboration.
- Two tier-1 engines flagged the APK as ReVPN-related riskware or PUA.
- The package is only three days old, so its reputation history is limited.
- Static tags include obfuscation, reflection, and bundled native ELF content.
- Direct-IP traffic was observed without a complete host-reputation assessment.
- The generic filename 'release.apk' provides little publisher or product context.
Do not sideload the APK until its developer and official distribution source are verified. Keep endpoint and mobile protection enabled, and use an established app-store build where available.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete4 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial19 runtime contacts were observed without a completed reputation cross-check.
YARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 5MITRE ATT&CK techniques
- 0spawned processes
- 19network contacts
- 0filesystem & mutex artifacts
What this file does
Observed actions and their security significance
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
release.apk
3ab64620df975832a0574a11b9176191e81ba75c56128a5b8359a6b3f464d02d
01Uploaded file
Files
Created or changed
- Dropped fileDerived
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
No child-file verdict was available.
02Dropped-file analysis
Network
Hosts contacted
- Contacted hostObserved
173.194.194.94
Contact observed during runtime.
03Isolated runtime analysis - Contacted hostObserved
172.67.151.52
Contact observed during runtime.
04Isolated runtime analysis - +1 more recorded observation in Analyst mode
4 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 173.194.194.94
- 172.67.151.52
- 173.194.193.138
- 104.21.64.137
- 142.251.156.119
- 173.194.206.106
- 142.251.155.119
- 172.217.119.4
- 185.199.109.133
- 185.199.111.153
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- 7080cb592d5149c858b2…1291caNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 4 / 75engines flagged
- 21sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
4 of 75 antivirus engines flagged the file, including BitDefenderFalx and Kaspersky.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 21 times from 21 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: release.apk — 3ab64620df975832a0574a11b9176191e81ba75c56128a5b8359a6b3f464d02d
ProvenanceObservedSourceUploaded fileObserved at - 04
Dropped file: 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca — No child-file verdict was available.
ProvenanceDerivedSourceDropped-file analysisObserved at - 05
Contacted host: 173.194.194.94 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Contacted host: 172.67.151.52 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: pua
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
Behavioral heuristics matched patterns associated with malware. Corroborating evidence determines how much weight they carry.
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence173.194.194.94 · 172.67.151.52 · 173.194.193.138
4 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- release.apk
- Format
- Android
- Code signing
- Not applicable to this file type
- Size
- 46.0 MB
- Last analyzed
- Sep 25, 2026, 10:45 AM UTC
3ab64620df975832a0574a11b9176191e81ba75c56128a5b8359a6b3f464d02dSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't install it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this app and use a fresh copy from a trusted source. Get a fresh copy from Google Play or the developer's official store.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is release.apk safe, or is it malware?
What is release.apk?
How many antivirus engines detected release.apk?
I already downloaded and installed release.apk — what should I do?
How do I remove release.apk?
What kind of malware is release.apk?
What is the SHA-256 hash of release.apk?
How up to date is this analysis of release.apk?
Community
Member reviews and reports for this exact file hash.