Published 2026-06-07 by the Droidwatch Security Research team
The well-known downloader VidMate (com.nemo.vidmate) scores Malicious at 71/100, with 38 high findings dwarfing its 3 critical ones and 6 dangerous permissions leading the list — among the higher-scoring samples in this series. As with the rest, the verdict rests on static analysis alone — the APK was parsed and decompiled but never run — and this is one entry in our 10-sample roundup.
Sample at a glance
| Field | Value |
|---|---|
| App label | VidMate |
| Package | com.nemo.vidmate |
| Version | 4.1265 (code 41265) |
| Min / target SDK | 14 / 17 |
| Size | 12.36 MB |
| SHA-256 | 23cc19e8b943bca995fe4f08b753b485be25312ac5d175e7cf46f4a6988f1d8a |
| MD5 | 6bd7d81c11a708b453d1355e993711c8 |
| Verdict | Malicious |
| Risk score | 71 / 100 |
| ML classifier | malicious (P(mal)=1.00), model lgbm_binary |
| Findings raised | 80 (3 critical · 38 high · 30 medium) |
The verdict, in the platform's words
'VidMate' (package: com.nemo.vidmate, v4.1265, SDK 14–17) was analyzed and received a risk score of 71/100 (Malicious). The codebase shows significant obfuscation (score 6/10): single-letter class names and dense reflection use, making static analysis difficult. Dynamic analysis is recommended.
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
dataflow |
Source-to-sink data-flow (PII → network/SMS sinks) | 15 |
ipc |
IPC / component-security (exported components, PendingIntents, deep links) | 12 |
rules |
Weighted rule engine (final scoring) | 11 |
jadx |
JADX decompilation deep-scan (secrets, dynamic loading, dangerous calls) | 9 |
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 7 |
packer |
Packers / protectors, anti-analysis and root-detection (APKiD) | 4 |
supply_chain |
Third-party SDK detection + OSV/GHSA CVE lookup | 3 |
attribution |
Build-path / developer / language attribution | 3 |
icc_deep |
Inter-component communication chain analysis | 3 |
strings |
String indicators, obfuscation score, reflection / dynamic-code refs | 2 |
banking |
Banking-trojan behavioral signals (overlay, accessibility, device-admin, dropper) | 1 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
secrets |
Hardcoded credentials, API keys and tokens | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
certificates |
Code-signing certificate posture | 1 |
crypto |
Cryptography misuse (weak hashes/ciphers, ECB, insecure RNG, hardcoded keys) | 1 |
native |
Native .so library inspection (JNI bridges, suspicious strings) | 1 |
c2_intel |
C2 infrastructure intel (AbuseIPDB, Tor, high-risk geos) | 1 |
fuzzy_hash |
Fuzzy hashing for sample similarity clustering | 1 |
deobfuscation |
Base64 / obfuscated-string decoding | 1 |
dex_deep |
Deep DEX analysis (reflection, dynamic loading, JNI, shell exec) | 1 |
ml_intelligence |
Independent ML classifier (Androguard features, CICMalDroid-trained) | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| Banking Trojan — High Behavioral Signal Score | 🟥 Critical | banking | — |
| Data Flow: Password Field → HTTP Connection (Data Exfiltration) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: Device Accounts → HTTP Connection (Data Exfiltration) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| 6 Dangerous Permission(s) Declared | 🟧 High | permissions | MASVS-PLATFORM-1 · T1626 |
| ML Engine: classified as 'Malicious' — family 'benign' | 🟧 High | ml-intelligence | — |
| Exported Activity Without Permission: WelcomeActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Exported Activity Without Permission: ShortcutActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Exported Activity Without Permission: FastLoginActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Exported Activity Without Permission: SendSmsActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Exported Activity Without Permission: MainActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Exported Activity Without Permission: MusicPlayerActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| Exported Activity Without Permission: NewPlayerActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| Banking Trojan — High Behavioral Signal Score | critical | +26.4 |
| Strong Anti-Analysis / Sandbox Evasion | high | +19.1 |
| Dropper / Self-Update Capability | high | +16.4 |
| VirusTotal: Suspicious / Low Detection | high | +14.8 |
| Banking Trojan — Moderate Behavioral Signals | high | +11.2 |
| Data Exfiltration: Source-to-Sink Flow via Network | high | +9.8 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1195 Supply Chain Compromise | Initial Access | Vulnerable or compromised third-party SDK embedded in the app. |
| T1398 Boot or Logon Autostart | Persistence | Registering to execute automatically after device reboot. |
| T1406 Obfuscated Files or Information | Defense Evasion | Using obfuscation to hide malicious code from static analysis. |
| T1417.002 GUI Input Capture | Collection | Drawing overlays over legitimate apps to capture credentials entered by users. |
| T1422 System Information Discovery | Discovery | Malware author attribution indicators: build paths, certificate identity, langua |
| T1432 Access Contact List | Collection | Collects sensitive PII or device information. |
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
| T1521 Encrypted Channel: Asymmetric Cryptography | Command and Control | Weak or broken cryptography that fails to protect data confidentiality. |
| T1533 Data from Local System | Collection | Insecure local data storage exposing credentials and PII. |
| T1544 Ingestion Tool Transfer | Command and Control | Downloading and installing additional malicious payloads at runtime. |
| T1575 Native API | Defense Evasion | Malicious behavior implemented in native code to evade Java-level analysis. |
Supply chain
- Third-party SDKs detected: 3 — OkHttp, Google Play Services, Glide
- Known CVEs matched (OSV/GHSA): 3
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.