Published 2026-06-07 by the Droidwatch Security Research team
Built with MIT App Inventor (appinventor.ai_david_taylor.Coronavirus_help2020) and riding a 2020 pandemic theme, Coronavirus Help lands at High Risk — 49/100, the only sub-Malicious score in this series, on 4 critical and 19 high findings. The App Inventor lineage itself shapes much of the finding profile. As always, this is static analysis only — decompiled but never executed — and one entry in the 10-sample roundup.
Sample at a glance
| Field | Value |
|---|---|
| App label | Coronavirus Help |
| Package | appinventor.ai_david_taylor.Coronavirus_help2020 |
| Version | 1.1 (code 2) |
| Min / target SDK | 7 / 28 |
| Size | 5.87 MB |
| SHA-256 | 14475b04ba91181c34d9a468768f64bc397cc30fde84e2232526de1b08e472f8 |
| MD5 | ac591eb2cab6e807f982bd3fc7edb8a6 |
| Verdict | High Risk |
| Risk score | 49 / 100 |
| ML classifier | malicious (P(mal)=1.00), model lgbm_binary |
| Findings raised | 51 (4 critical · 19 high · 18 medium) |
The verdict, in the platform's words
'Coronavirus Help' (package: appinventor.ai_david_taylor.Coronavirus_help2020, v1.1, SDK 7–28) was analyzed and received a risk score of 49/100 (High Risk).
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
dataflow |
Source-to-sink data-flow (PII → network/SMS sinks) | 15 |
jadx |
JADX decompilation deep-scan (secrets, dynamic loading, dangerous calls) | 7 |
attribution |
Build-path / developer / language attribution | 6 |
rules |
Weighted rule engine (final scoring) | 4 |
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 3 |
crypto |
Cryptography misuse (weak hashes/ciphers, ECB, insecure RNG, hardcoded keys) | 3 |
packer |
Packers / protectors, anti-analysis and root-detection (APKiD) | 3 |
strings |
String indicators, obfuscation score, reflection / dynamic-code refs | 2 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
secrets |
Hardcoded credentials, API keys and tokens | 1 |
ipc |
IPC / component-security (exported components, PendingIntents, deep links) | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
certificates |
Code-signing certificate posture | 1 |
storage |
Insecure data storage (world-readable prefs, external storage, SQLite) | 1 |
deobfuscation |
Base64 / obfuscated-string decoding | 1 |
dex_deep |
Deep DEX analysis (reflection, dynamic loading, JNI, shell exec) | 1 |
ml_intelligence |
Independent ML classifier (Androguard features, CICMalDroid-trained) | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| Data Flow: SMS Message Content → HTTP Connection (Data Exfiltration) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: Device Accounts → HTTP Connection (Data Exfiltration) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: Device ID (IMEI) → Multipart SMS (SMS/OTP Forwarding) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: GPS Location → Multipart SMS (SMS/OTP Forwarding) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| ML Engine: classified as 'Malicious' — family 'riskware' | 🟧 High | ml-intelligence | — |
| Exported Activity Without Permission: Screen1 | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Weak Cipher Algorithm (DES/RC4/Blowfish) | 🟧 High | crypto | MASVS-CRYPTO-1 · T1521 |
| ECB Cipher Mode Detected (Insecure Block Mode) | 🟧 High | crypto | MASVS-CRYPTO-1 · T1521 |
| Dynamic Code Loading (DexClassLoader) | 🟧 High | obfuscation | MASVS-RESILIENCE-2 · T1406 |
| Weak Hash Algorithm Usage (MD5/SHA-1) | 🟧 High | crypto | MASVS-CRYPTO-1 · T1521 |
| Hardcoded Secret in Code: Hardcoded credential in field declaration | 🟧 High | secrets | MASVS-STORAGE-1 · T1635 |
| Hardcoded Secret in Code: Hardcoded credential in field declaration | 🟧 High | secrets | MASVS-STORAGE-1 · T1635 |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| Data Exfiltration: Source-to-Sink Flow via Network | high | +9.8 |
| Anti-Analysis / Evasion Patterns Detected | medium | +7.5 |
| Self-Signed Certificate | low | +4.0 |
| Heavy Root Detection (Evasion / Hardening) | medium | +3.3 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1406 Obfuscated Files or Information | Defense Evasion | Using obfuscation to hide malicious code from static analysis. |
| T1422 System Information Discovery | Discovery | Malware author attribution indicators: build paths, certificate identity, langua |
| T1432 Access Contact List | Collection | Collects sensitive PII or device information. |
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
| T1521 Encrypted Channel: Asymmetric Cryptography | Command and Control | Weak or broken cryptography that fails to protect data confidentiality. |
| T1533 Data from Local System | Collection | Insecure local data storage exposing credentials and PII. |
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.