Published 2026-06-07 by the Droidwatch Security Research team
Media Player (com.zddapps.beststatus) scores Malicious at 65/100 on a lean 1 critical and 7 high findings, but its lead issue is a basic one: the APK carries no signing certificate at all, so its origin can't be verified. The rest of the static picture — gathered without ever running the app — follows below. This deep-dive is part of our 10-sample static-triage roundup.
Sample at a glance
| Field | Value |
|---|---|
| App label | Media Player |
| Package | com.zddapps.beststatus |
| Version | 14.8 (code 100) |
| Min / target SDK | 16 / 22 |
| Size | 0.39 MB |
| SHA-256 | 1eebd349166ee960b97650e69188a05ec8dd9f2dd060e79b8f9b51b1e06bbf2e |
| MD5 | f048862ad68eaa506925ded53d5bb152 |
| Verdict | Malicious |
| Risk score | 65 / 100 |
| ML classifier | malicious (P(mal)=1.00), model lgbm_binary |
| Findings raised | 25 (1 critical · 7 high · 14 medium) |
The verdict, in the platform's words
'Media Player' (package: com.zddapps.beststatus, v14.8, SDK 16–22) was analyzed and received a risk score of 65/100 (Malicious).
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 4 |
ipc |
IPC / component-security (exported components, PendingIntents, deep links) | 4 |
rules |
Weighted rule engine (final scoring) | 4 |
dex_deep |
Deep DEX analysis (reflection, dynamic loading, JNI, shell exec) | 2 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
network |
URLs / domains / IPs and high-risk network IOCs | 1 |
certificates |
Code-signing certificate posture | 1 |
strings |
String indicators, obfuscation score, reflection / dynamic-code refs | 1 |
crypto |
Cryptography misuse (weak hashes/ciphers, ECB, insecure RNG, hardcoded keys) | 1 |
storage |
Insecure data storage (world-readable prefs, external storage, SQLite) | 1 |
packer |
Packers / protectors, anti-analysis and root-detection (APKiD) | 1 |
fake_app |
App Authenticity & Fake App Detection | 1 |
deobfuscation |
Base64 / obfuscated-string decoding | 1 |
icc_deep |
Inter-component communication chain analysis | 1 |
ml_intelligence |
Independent ML classifier (Androguard features, CICMalDroid-trained) | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| VirusTotal: Confirmed Malicious | 🟥 Critical | reputation | — |
| ML Engine: classified as 'Malicious' — family 'riskware' | 🟧 High | ml-intelligence | — |
| Dynamic Code Loading (DexClassLoader) | 🟧 High | obfuscation | MASVS-RESILIENCE-2 · T1406 |
| Weak Hash Algorithm Usage (MD5/SHA-1) | 🟧 High | crypto | MASVS-CRYPTO-1 · T1521 |
| VirusTotal: Suspicious / Low Detection | 🟧 High | reputation | — |
| No Signing Certificate Found | 🟧 High | signing | MASVS-CODE-1 |
| android:allowBackup=true with Sensitive Storage (No Exclusion Rules) | 🟧 High | data-storage | MASVS-STORAGE-2 · T1533 |
| Dynamic DEX Class Loading Detected | 🟧 High | dropper | T1407 |
| 5 Obfuscated String(s) Successfully Decoded | 🟧 High | deobfuscation | T1406 |
| 2 Dangerous Permission(s) Declared | 🟨 Medium | permissions | MASVS-PLATFORM-1 · T1626 |
| Very Low minSdkVersion (16) — Android 16+ | 🟨 Medium | permissions | MASVS-PLATFORM-1 · T1626 |
| Boot Receiver Registered | 🟨 Medium | persistence | MASVS-RESILIENCE-1 · T1402 |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| VirusTotal: Confirmed Malicious | critical | +33.2 |
| VirusTotal: Suspicious / Low Detection | high | +14.8 |
| Dynamic Code Loading | medium | +9.6 |
| Boot Persistence: BOOT_COMPLETED Receiver | medium | +6.8 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1398 Boot or Logon Autostart | Persistence | Registering to execute automatically after device reboot. |
| T1406 Obfuscated Files or Information | Defense Evasion | Using obfuscation to hide malicious code from static analysis. |
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
| T1521 Encrypted Channel: Asymmetric Cryptography | Command and Control | Weak or broken cryptography that fails to protect data confidentiality. |
| T1533 Data from Local System | Collection | Insecure local data storage exposing credentials and PII. |
| T1544 Ingestion Tool Transfer | Command and Control | Downloading and installing additional malicious payloads at runtime. |
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.