MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce8750ef4d2df3a4d058bdb0db44e4552a8ae038a1210dd51efa7d4169fc42c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SpyLoan


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce8750ef4d2df3a4d058bdb0db44e4552a8ae038a1210dd51efa7d4169fc42c4
SHA3-384 hash: 3f4656c2d0e84d26135d68eea3fe2c0c9c8727599d8699b590876c00bf38a07a3f32b14de84511d9e8af3912339d9530
SHA1 hash: b79432734cc7e925c2eb8a1117c4367ed5a6bce5
MD5 hash: 51eb9133e3feadde267b4ad228e1d5ac
humanhash: september-papa-cardinal-snake
File name:jerry_1.9.1_46146860.apk
Download: download sample
Signature SpyLoan
Create hunting rule
File size:28'558'246 bytes
First seen:2025-11-23 12:09:44 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 786432:QZoyJIPMzROtfXyvY9Txn8jz7vAMc3dIkv7BLvfo:QikIPlNyA9TxnuwMcNBv7BL4
TLSH T15B572397FB29883FD5FB15B38D6A013277729E0086826B137654762C2D3329E4F99BC4
TrID 43.8% (.APK) Android Package (27000/1/5)
21.9% (.JAR) Java Archive (13500/1/2)
17.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
10.5% (.GL) GRASP animation (6508/7/3)
6.5% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter juroots
Tags:apk signed SpyLoan

Code Signing Certificate

Organisation:Your Name
Issuer:Your Name
Algorithm:sha256WithRSAEncryption
Valid from:2025-10-18T02:35:47Z
Valid to:2050-10-12T02:35:47Z
Serial number: b50331a55c335552
Thumbprint Algorithm:SHA256
Thumbprint: 490148231530a8d4ea479b105784d868130ae813af2699a0c381571d5c1a7051
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
RO RO
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
android base64 crypto evasive fingerprint signed
Link:
https://www.filescan.io/uploads/6922f9f5eecb08e4aa45bdb2/reports/5a169008-0c89-4d12-b985-23f09b5685d2/overview
Result
Link:
https://incinerator.cloud/#/public/report/51eb9133e3feadde267b4ad228e1d5ac/detail
Application Permissions
read external storage contents (READ_EXTERNAL_STORAGE)
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
take pictures and videos (CAMERA)
read phone state and identity (READ_PHONE_STATE)
mount and unmount file systems (MOUNT_UNMOUNT_FILESYSTEMS)
display system-level alerts (SYSTEM_ALERT_WINDOW)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
view Wi-Fi status (ACCESS_WIFI_STATE)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/ce8750ef4d2df3a4d058bdb0db44e4552a8ae038a1210dd51efa7d4169fc42c4
Verdict:
Unknown
File Type:
apk
First seen:
2025-11-22T18:10:00Z UTC
Last seen:
2025-11-22T18:24:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ce8750ef4d2df3a4d058bdb0db44e4552a8ae038a1210dd51efa7d4169fc42c4/results?tab=lookup
Score:
13%
Verdict:
Benign
File Type:
APK
Link:
https://malprob.io/report/ce8750ef4d2df3a4d058bdb0db44e4552a8ae038a1210dd51efa7d4169fc42c4
Gathering data
Threat name:
Android.PUA.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-22 23:03:10 UTC
File Type:
Binary (Archive)
Extracted files:
2465
AV detection:
6 of 36 (16.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2dvb32nfxz2jucyxwynwrhekuvivybyueqq3vi67j6uc2p4ilca._file
Result
Malware family:
spyloan
Create hunting rule
Score:
  10/10
Tags:
family:spyloan android discovery impact infostealer spyware trojan
Link:
https://tria.ge/reports/251123-pdwp1sfr91/
Behaviour
Checks memory information
Uses Crypto APIs (Might try to encrypt user data)
Queries information about active data network
Reads information about phone network operator.
SpyLoan
Spyloan family
Malware Config
C2 Extraction:
https://dverv43.q4w9l6g3w.work/
https://rNHNpr.ztt4ahr.work
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/35d7acde-6ea8-4ed5-90f1-bed2a9b90d79
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Any_SU_Domain
Create hunting rule
Author:you
Description:Detect any reference to .su domains or subdomains
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SpyLoan

apk ce8750ef4d2df3a4d058bdb0db44e4552a8ae038a1210dd51efa7d4169fc42c4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3715183/
  
Delivery method
Distributed via web download

Comments