Safe
Zero tier-1 engine detections across 75 engines; 3,407 submitters; contacted hosts are legitimate Google/Firebase infrastructure.
d0f133e073fc34ddda…2d9f9b97a7The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The evidence strongly supports a safe classification. All 17 tier-1 engines report the file as undetected, and no tier-1 consensus on any malware family exists. The heuristic rule 'MalwareTips.Synth.DirectIpC2' fired because the app contacted external IPs without using DNS, but inspection reveals those IPs belong to Google, Cloudflare, and Firebase — standard cloud services used by Android apps for telemetry and remote configuration. The file's prevalence (common_old, 353 days, 5,692 submissions) is inconsistent with novel malware. Behaviour analysis shows only ambient MITRE techniques typical of Android apps (network communication, device info queries, GPS checks, clipboard access) with zero offensive techniques. No malicious sandbox verdicts or malicious dropped children were detected. Community comments are conflicting, with one researcher scoring it 'Clean' and another flagging obfuscation — but the absence of tier-1 consensus and the benign contacted hosts override the obfuscation concern.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/67 malicious; tier1Malicious=0; tier1ReportedClean=17 (Kaspersky, Microsoft, BitDefender, ESET-NOD32, Fortinet, Avira, Emsisoft, F-Secure, GData, Ikarus, DrWeb, Avast, AVG all silent)
prevalence.classification='common_old' — 3407 unique submitters, 5692 submissions since 2025-06-30; widely distributed, inconsistent with novel malware
contactedIps: 15 IPs inspected, all resolve to Google (142.251.*, 172.253.*), Cloudflare (172.67.*), Firebase infrastructure — no known-malicious hosts in our URL cache
behaviour: 0 offensive MITRE techniques; 9 ambient techniques (T1071, T1406, T1409, T1421, T1422, T1424, T1426, T1430, T1573) typical of Android apps; no malicious sandbox verdicts; no malicious dropped children
triggeredHeuristics 'MalwareTips.Synth.DirectIpC2' fired on pattern (direct IPs, no domains) but contacted hosts are legitimate cloud services, not C2 infrastructure
- Zero tier-1 engine detections across 17 high-trust antivirus engines
- Contacted hosts are all legitimate Google, Cloudflare, and Firebase infrastructure
- File is widely distributed (3,407 submitters, 5,692 submissions) with no consensus malicious verdict
- No malicious sandbox verdicts, no malicious dropped children, no offensive MITRE techniques
- Community researcher scored the file 'Clean' (20/100)
- File is obfuscated (ProGuard or similar), which is common in both legitimate and malicious Android apps
- Heuristic rule flagged direct-IP contact pattern, though the IPs resolve to legitimate cloud services
- One community researcher flagged sensitive permissions and obfuscation techniques
This file is safe to use based on tier-1 engine consensus and benign contacted infrastructure. If you have concerns about the app's permissions or behaviour, review the Android manifest and consider whether the requested permissions align with the app's intended function.
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- 6c8288c4332da47f57c5…1e5938Never scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 20 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence104.21.88.154 · 172.67.216.55 · 172.253.115.94
0 detections across 75 engines
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- copy.apk
- Size
- 17.61 MB
- MIME type
- (unknown)
- Detected type
- Android
- SHA-256
- d0f133e073fc34dddad298e7dd6a695d935e0dbd2a627d74a402792d9f9b97a7
- MD5
- f2455f0a47fe709aeb49e531d6052eb8
- SHA-1
- afa78dfc56daa35a51a3041187a1cf22655ccf7b
- First seen (VT)
- 6/30/2025, 5:54:11 AM
- Last analysis (VT)
- 6/13/2026, 2:44:05 PM
- First scan (MalwareTips)
- 6/18/2026, 4:58:36 PM
- Last scan (MalwareTips)
- 6/18/2026, 4:58:36 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.