What Gridinsoft observed on Adescargar.net
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260820055201-69c476b3
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent review did not reproduce phishing, so the Phishing category was removed. The site remains classified as Suspicious Website because it distributes or routes users to unverified APK and MOD APK objects, including protected self-signed samples whose provenance could not be established. No specific malicious payload was identified in the reviewed samples.
Analyst findings
Review 4 documented observations View evidence
The public site returned an Android application and game download catalog that included pages advertising APK and MOD APK files.
-
HTTP status
200 -
Final URL
https://adescargar.net/ - Page element Public catalog entries and navigation advertised Android APK and MOD APK downloads.
The reviewed Netflix APK page used same-site intermediate download pages that linked to two APK files hosted on MediaFire.
- Public artifact URL https://adescargar.net/netflix-apk/download/0/
-
Redirect destination
https://www.mediafire.com/file/zfue7cv208gh7sh/Netflix_Mirror+Pro+v8.9.0.apk/file - Public artifact URL https://adescargar.net/netflix-apk/download/1/
-
Redirect destination
https://www.mediafire.com/file/4nhmy22jzv25q8s/NetFlix+Mirror+v9.72.0.apk/file
Two APK objects from the reviewed flow were downloaded without execution and inspected statically. They used package names com.netmirror.app and com.netflix.mirror, were signed by a self-signed certificate identifying the signer as Modding, and contained Jiagu protection components. The requested permissions were limited to network state, Internet access, notifications in one sample, and application-specific receiver permissions; this review did not identify a specific malicious payload.
- File SHA-256 91d57e03a8439eefb1444a7ab4ea4fff8409d3d6e5048981e479d2f9da8e92c9
- File SHA-256 05144121254c6f9f27bf03996354f52cb4ae0da587285c940bd820c0b22bc341
- MIME type application/vnd.android.package-archive
- Certificate fact Both sampled APKs were signed with a self-signed certificate whose subject included O=Modding and CN=Hex.
- Analyst observation Static inspection found Jiagu protection components in both samples; no sample was executed.
The reviewed root, application detail, and download pages did not present an impersonated sign-in flow or a credential-collection form. The existing Phishing classification was not reproduced in the reviewed scope.
- Analyst observation No impersonated login or credential-harvesting form was observed on the reviewed pages.
Scope and limitations
- Only two APK objects from one application page were sampled; the full download catalog was not exhaustively reviewed.
- The APK review was static only. The files were not executed, and protected application code could not be fully validated.
- This verdict does not state that every file on the site is malicious or safe; object-specific analysis may produce different results.
Help protect others by sharing this page on social media! The more people who know about adescargar.net, the fewer chances they have to deceive someone else. Help others evaluate adescargar.net by sharing this page on social media!