MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d
SHA3-384 hash:	0769b6758c584aebad636b390c0ff6eb579ca8a29b4f064ea15d07efa5d02b570a19046b7b4493704503f5e39abe5cdc
SHA1 hash:	04582e7f26dc5f789b5358f1547d2c2b223f61a6
MD5 hash:	c61cfedbd17b50dcdce2b00e86fa5a7c
humanhash:	beryllium-pennsylvania-south-nineteen
File name:	01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d.bin
Download:	download sample
File size:	9'483'878 bytes
First seen:	2026-10-01 13:17:39 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:/lT3h+c/ORzpuCPU7t4rxKjTG49D/nz5DntlBM8uQqcbO:/l1+coz4IUh4r0jTftlBM8ycbO
TLSH	T137A612308E5C1822C436BB7594EF1B9373BC93060301E63F27BCA6693DD7B969A42975
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	unknown
Reporter	whack_sh
Tags:	zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 64 file(s), sorted by their relevance:

File name:	data.bin
File size:	101 bytes
SHA256 hash:	5828fb4d50400fa4fe4a004c297d9ee006225666ec0adc84824599f29554cfd9
MD5 hash:	83a62eea16289eb9e926ee867d04a695
MIME type:	application/octet-stream

File name:	classes2.dex
File size:	55'201 bytes
SHA256 hash:	d18bc9067ae17b59f9ffe9a419d1211c47163eeac86d512f7ec54dd6e2f49c0a
MD5 hash:	4eef55f558ec0d1a0988554976d02921
MIME type:	application/octet-stream

File name:	collections.kotlin_builtins
File size:	16'200 bytes
SHA256 hash:	ae4d1a5a1a414bf3611889783496bc00d157af2b3a8e9ff6061aff9763a04214
MD5 hash:	62acb91d31f62755574e75d1824fb761
MIME type:	application/octet-stream

File name:	iQ.xml
File size:	7'866 bytes
SHA256 hash:	aec8ccb2d999fdea0187dfce431f4dc896f19b748962edab330446b0884a1b55
MD5 hash:	c1435720baf9bc2358c8af0688775a18
MIME type:	application/octet-stream

File name:	config.bin
File size:	210 bytes
SHA256 hash:	5c1823cb294dce3b05f88a7e7602b2edf018ab425a1e7d1e35bcbb4bf1d44cf8
MD5 hash:	f350017c0a2d76ad284b274a6bfa8fa5
MIME type:	application/octet-stream

File name:	baseline.prof
File size:	290 bytes
SHA256 hash:	4e39bdda986b7335324639bac0f161c8805f24c6b15efe14027a83f7fd41989e
MD5 hash:	19bbeddb0f0a3da8d865107cfdb28154
MIME type:	application/octet-stream

File name:	a0.xml
File size:	32'870 bytes
SHA256 hash:	fefbda9b1191247996b6e30457af79741f91a003b813a87827aaa522eef816f8
MD5 hash:	cbb93d6f24d049264593297e575e82fa
MIME type:	application/octet-stream

File name:	session_ltksugkb.dat
File size:	491 bytes
SHA256 hash:	b2979a8225c27da156283aa0f39bbde78906ff545a43ff742aeaa9e2b08fa926
MD5 hash:	17aa3fdd88e71743b859383f59bd3898
MIME type:	application/octet-stream

File name:	classes.dex
File size:	256'610 bytes
SHA256 hash:	94ba8ab2cee949ebe5208efc770142a06fa0c0d3701ac1da0078a0a338217291
MD5 hash:	ed9b92318c4a865eb8cb150501833262
MIME type:	application/octet-stream

File name:	Ws.xml
File size:	33'741 bytes
SHA256 hash:	f83636513e81fa4b7db0d5171e7eed8f5990df28049bb13867dce23ff5415460
MD5 hash:	93b12177c68c5d293dd6731fe913d619
MIME type:	application/octet-stream

File name:	xN.xml
File size:	20'902 bytes
SHA256 hash:	3878a0bec7008a8559b97fa8b259369c21049e46f81c43f70a48ca56b41f3e4e
MD5 hash:	de8386bf83b6724909147d3d0bd74999
MIME type:	application/octet-stream

File name:	coroutines.kotlin_builtins
File size:	3'498 bytes
SHA256 hash:	211a497f0e2b97134914b7af246c3576f361b2bc0614be4e599260f726e497a1
MD5 hash:	fc73d9b91d399100ceb9ef8de4519085
MIME type:	application/octet-stream

File name:	kotlin.kotlin_builtins
File size:	24'025 bytes
SHA256 hash:	28c35fd8d4a466d9b367270c90570d1678dace03a765176d5f6e947ebf2272b3
MD5 hash:	2a2a774b5a83c14775750c14f9a2a0d7
MIME type:	application/octet-stream

File name:	S8.xml
File size:	30'377 bytes
SHA256 hash:	b0d146ada68ba5c8ee5314153f814a32b1aa53cd8033bbef393b059750512d43
MD5 hash:	4c799ae767612b91f83aed3286e57a32
MIME type:	application/octet-stream

File name:	vxokfemvlh_21727.idx
File size:	827'340 bytes
SHA256 hash:	1a1f86a59dad7d9bfbc39e55b6fe7262b1c745ddf69aa3268911579d37d84261
MD5 hash:	5f47b5923ae69ce96cb8d40238485171
MIME type:	application/octet-stream

File name:	reflect.kotlin_builtins
File size:	10'325 bytes
SHA256 hash:	ac910eb9dfd400494f4cff3ebaa5446553e8c6715b0158c656ddc4b0beee85bb
MD5 hash:	8368e2ed1e17fe996adf67812512aed9
MIME type:	application/octet-stream

File name:	frxilxob
File size:	5'751 bytes
SHA256 hash:	39762713571b34bf4ccc20b985060fdda84480bc11e3b7edc1492a648c60fd7d
MD5 hash:	952ee7df120fd560985ea71fa1f3b693
MIME type:	application/octet-stream

File name:	sync_ncajxymxnc.bin
File size:	184 bytes
SHA256 hash:	20a5bd92e326726ea841ab5149b9cb6aaa87fb021f66a8a7c97c11823902c4b0
MD5 hash:	c570bea6a191db2a93d1e49da4ba610e
MIME type:	application/octet-stream

File name:	annotation
File size:	188 bytes
SHA256 hash:	246ae2b5b51d4a5ec0d7999fcba8514f485e90c6f566e6a9c1f7083ef342f503
MD5 hash:	5f74ffaac55c41f1e43dacbc6f81e271
MIME type:	application/octet-stream

File name:	c6.xml
File size:	24'670 bytes
SHA256 hash:	7e2d22affd17a1401f7fdb804d98847e019b17102191d4ef08e43c81cdaaf1aa
MD5 hash:	7969cd345f23e22a269fd8fca87bd171
MIME type:	application/octet-stream

File name:	df.xml
File size:	27'060 bytes
SHA256 hash:	8a966b03621302bc7d38b59749547895e53b45aaa2eb428bc88c2da76ed82de1
MD5 hash:	dd60fe4a1c60ed9f3a1d46d6a2ae303e
MIME type:	application/octet-stream

File name:	session_zmavrutkfk.bin
File size:	465 bytes
SHA256 hash:	8474197fb05fdcfa5f5750c4d9cf960cd8eb34a304b256d78bf426cd8e0db935
MD5 hash:	b4fd57e56a0d20759fb154c63105d53f
MIME type:	application/octet-stream

File name:	w33wdu
File size:	6'278'468 bytes
SHA256 hash:	5bc11e69bd823c01b92deaae5549343dbed053ec98ae94e14772527adc4dddcc
MD5 hash:	66a6fdbb998a5eaedb0c72fd5b250404
MIME type:	application/octet-stream

File name:	internal.kotlin_builtins
File size:	8'507 bytes
SHA256 hash:	89aada15fdf52bf960ff9bd564225d1b3b6c35548fe2961f7231532c6221c6a2
MD5 hash:	e13fda6c8cdd54c434a4ca9a4461e096
MIME type:	application/octet-stream

File name:	nz.xml
File size:	19'553 bytes
SHA256 hash:	390cbd4e2a577d4a5ec6af9221734ab0876751b6e92d8a98225ae336829f95b1
MD5 hash:	e7ce2c31f2fa95771aa9675d5c78f9b9
MIME type:	application/octet-stream

File name:	analytics_dmgvpsyldr.bin
File size:	116 bytes
SHA256 hash:	439396f0c9c27376e88a8c5c803ef9c230f4b94c6d78dc90e8589dbf1624908e
MD5 hash:	b080ed2cf9e940735be8667811b16253
MIME type:	application/octet-stream

File name:	9m.xml
File size:	15'957 bytes
SHA256 hash:	5b2dcd169d1ed5cc9392197964bde75b6963b1abf42202e4c90c028061b01c8b
MD5 hash:	305071f6f20ef5ed61f57c31e081a58c
MIME type:	application/octet-stream

File name:	8G.xml
File size:	4'830 bytes
SHA256 hash:	a7854ad260ebdf6fccb7ccaea3609ba7cffd3f52e51388a491757af24a1301d8
MD5 hash:	10d97e5a3416574d3b19e11c113af4f2
MIME type:	application/octet-stream

File name:	ranges.kotlin_builtins
File size:	6'511 bytes
SHA256 hash:	c3192b8802e271d635d1f6d361b3462c6d5bb8c252f0e8ca0820e42317bad6ad
MD5 hash:	ba38dbe4f9901c75d88256598c993523
MIME type:	application/octet-stream

File name:	AndroidManifest.xml
File size:	9'002 bytes
SHA256 hash:	72d7d092afa3f64f5e9023f61d6a12c79418f1c23a658946d2b2bddb00bad519
MD5 hash:	84ab3ff89d69249ca443769095e020c3
MIME type:	application/octet-stream

File name:	base.bin
File size:	188 bytes
SHA256 hash:	ac278a976d1316df08d61b611a65091fc1383f5679c8079846d749ed0642afa8
MD5 hash:	a8280768135d2965b46a7853bff6123b
MIME type:	application/octet-stream

File name:	baseline.profm
File size:	128 bytes
SHA256 hash:	2d97c6cc468039177e471687a57fd6b1f980526a5de75d659d4a3f44a595f812
MD5 hash:	601d303ef91943423586d74cbb89f17d
MIME type:	application/octet-stream

File name:	zR.png
File size:	7'384 bytes
SHA256 hash:	82c4f90839712e069d94a6025438f56654916fd3fd8bc1a0f62d80b3e4efc28e
MD5 hash:	c12c0cb412e9df188f3b5bba3208985e
MIME type:	image/png

File name:	04h
File size:	0 bytes
SHA256 hash:	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash:	d41d8cd98f00b204e9800998ecf8427e
MIME type:	inode/x-empty

File name:	vL.9.png
File size:	3'638 bytes
SHA256 hash:	34cc46509d45b88923237f6465d75c83608d2b5d1996d7c1aae0490bda410c42
MD5 hash:	0d41a3c7bdb880d9bc440da70c483b4f
MIME type:	image/png

File name:	yn.png
File size:	11'381 bytes
SHA256 hash:	5c6f28f93a5122be306679fe3e44efe1c5f5707ff58402e757e3228c3c7d5f92
MD5 hash:	c474f83f28edc8f533155b1d33aa8d99
MIME type:	image/png

File name:	analytics_lcnatwz.csv
File size:	68 bytes
SHA256 hash:	90e32326d8855c6beda6b6368efaf9220f977540f7176c6381e51c27346d7cf4
MD5 hash:	8c40588c3f59b11186eb32f6ec864ae6
MIME type:	application/csv

File name:	Gc.png
File size:	42'113 bytes
SHA256 hash:	f9357d495ad395dc4204b6aabf7a16cb240c53b019847aa5b8e51fda440a6435
MD5 hash:	186166af6704d58b12df95bd030323fa
MIME type:	image/png

File name:	2K.9.png
File size:	2'899 bytes
SHA256 hash:	dfd70d29da62e3f31bcd05877d3b9bbc4ceea8b00cb8aeacc56fc2214577848d
MD5 hash:	3aba226ecb7c6bf7a922549981908d34
MIME type:	image/png

File name:	cV.xml
File size:	27'146 bytes
SHA256 hash:	769722ca4377f904eb1f9e5d7de897f7a45caca5fed936fb64b4731157fe54b1
MD5 hash:	b7bb4cdf3901b3ee9f0b55cc8806e456
MIME type:	image/x-tga

File name:	U-.9.png
File size:	1'658 bytes
SHA256 hash:	c285db7cf3e6d87e8542f939632d0d55e3c77017b7cf210f74d9b0c382549186
MD5 hash:	9841feca8a8c2244986e5167f4981a06
MIME type:	image/png

File name:	pY.png
File size:	2'720 bytes
SHA256 hash:	6b31b302dfd1121e8d1a8f258518fce8fd145c5d457f17bf84ce41165fce65de
MD5 hash:	a288b08fc72433c0b53ec647e6c18244
MIME type:	image/png

File name:	sync_dnwewg.csv
File size:	67 bytes
SHA256 hash:	b15a4806aade7b815a4f2301357f64100edb90b24ec0a3fc8f5701fabaa0ae8c
MD5 hash:	4bcc51dfb29643ef08e7f89ef99dc55e
MIME type:	application/csv

File name:	wN.9.png
File size:	1'072 bytes
SHA256 hash:	811720f30c7e4003de62dd57f831cc0c785b85a5c3b8e4fdf5408a9c4a6bef8f
MD5 hash:	899265dfe7535517632a4f88654a55f8
MIME type:	image/png

File name:	s4.png
File size:	4'052 bytes
SHA256 hash:	28bad815f5a3d275ec14638e8e76240e3db7bacf39f09ae96f890a956f68f8f5
MD5 hash:	c40d3cb8ca7a47770092936bf50b584c
MIME type:	image/png

File name:	8c.png
File size:	10'837 bytes
SHA256 hash:	8afe3ab14fd95b883498012a72d5a974548c8c54289f3e7287790b175a8228e8
MD5 hash:	c333aa893e36017104b58e9fd2e9c7f6
MIME type:	image/png

File name:	C_.9.png
File size:	1'970 bytes
SHA256 hash:	3d6687cf4aeba29bcd626524eeb9b14b2c05a721a2e18989c851ce435d7da5d0
MD5 hash:	6fac2b1f6192096f3207fa964dbe4344
MIME type:	image/png

File name:	Ma.9.png
File size:	3'297 bytes
SHA256 hash:	2c41b21e2f4062b1c0c81893118b58ec967d218b7243a668b750afbefeefc1f9
MD5 hash:	7a4d103d73a9aca183d23ffa1b040522
MIME type:	image/png

File name:	sA.9.png
File size:	2'706 bytes
SHA256 hash:	0d5ac18547a70007993b8e086e8ce6cac0f06749d9a4cae0836a2b93891a50ea
MD5 hash:	d914b77e03ab8be80e1b2f481919b995
MIME type:	image/png

File name:	gK.9.png
File size:	1'446 bytes
SHA256 hash:	958f6121f52a51110acbe4c7a0750926876efea4f4aa33a500b646b5be06b015
MD5 hash:	e593094295cbef4c09ea1cb53922cfdb
MIME type:	image/png

File name:	je.9.png
File size:	2'796 bytes
SHA256 hash:	9c1c414f0b416930efbcf1b9ff77f99e425418139add1b95b9d4dd294628ba84
MD5 hash:	0085bb03cbb3f0aa065fe5c13ee1959c
MIME type:	image/png

File name:	FS.png
File size:	14'307 bytes
SHA256 hash:	4107b5182e4061059d601a3d562a24acd7aeb048a563000add0a794c913b99a0
MD5 hash:	49a9feea10d87a46b8e4e55f7d32f2db
MIME type:	image/png

File name:	5c.png
File size:	1'115 bytes
SHA256 hash:	1b99a9687e05c42522967d30d7f94c5d6d5a71ad180df8033ded7be667bc9e01
MD5 hash:	bf5d478f8a695b1ffedacfafd033c45a
MIME type:	image/png

File name:	fO.png
File size:	28'192 bytes
SHA256 hash:	a4eda4e6f040d5cd409efe63ff0c8e84a479c072fcff0ef1e161bd041e21dfe0
MD5 hash:	488632251be3611330e36af87af20b80
MIME type:	image/png

File name:	RJ.png
File size:	28'606 bytes
SHA256 hash:	3d6a727acd61b46ea24b1cad5dc927d2e6174550af14536190bc34e738f74dc3
MD5 hash:	2035d4c7cd0c6ea4207401fb6b4215be
MIME type:	image/png

File name:	analytics_wkptven.cfg
File size:	23 bytes
SHA256 hash:	d6a031213510c70180caf02e49ea70da83b24a029d1049e80161d3d44129f136
MD5 hash:	9d375b753bc310c29e1cf1becee8178e
MIME type:	text/plain

File name:	xa.9.png
File size:	772 bytes
SHA256 hash:	3f1d892edff118cb05550fc01e87f43bf462a5bdc882773ea0b50a101a0a85cd
MD5 hash:	76b46083537fd1c5b9140c9c4c1b52c9
MIME type:	image/png

File name:	o-.png
File size:	40'906 bytes
SHA256 hash:	76e90b9aaa8ad1c4d649bf196614c2712c37e388f21b75b42d175bd31128a512
MD5 hash:	075f898599ca03832f7dde09f25d75f9
MIME type:	image/png

File name:	o_.9.png
File size:	2'296 bytes
SHA256 hash:	6feb9614b890d2ca38d0d9143891ccfa8aef36654f2bfaebeffc38ba5a48136d
MD5 hash:	7f679d662640967f354ffce1073db00a
MIME type:	image/png

File name:	pu.png
File size:	2'593 bytes
SHA256 hash:	361011599d69d9ae36172ec262ee2a8760a491b0a69c388148633bf809595641
MD5 hash:	ebdd2cb0ec69ec3cbd52bd4873bd0a08
MIME type:	image/png

File name:	z-.9.png
File size:	1'815 bytes
SHA256 hash:	05773abde18923417b142b9770021b1b91a87432614c5decb3f24a109790ca92
MD5 hash:	a9e79146924f8fa86a65777ae8e0c1b3
MIME type:	image/png

File name:	9w.png
File size:	7'313 bytes
SHA256 hash:	ffe534db9d5a057cf3668f816043cf2fa0e1a9e199342c494f7ab94ebbd5bb48
MD5 hash:	adc9e18def04f886b626c94e27d88a29
MIME type:	image/png

File name:	wb.png
File size:	16'265 bytes
SHA256 hash:	94a74b622db19aaa0edfdf3f0bfc7b4e3e05ba37f8299eb2247c38a5fe5e130f
MD5 hash:	7cca9f90c456305b3a9841715c74186b
MIME type:	image/png

File name:	lR.xml
File size:	29'737 bytes
SHA256 hash:	659c488ac064e0e0c50d26a32c184096c94a4d5402bffef98f1e3e6c06cecd5c
MD5 hash:	fe7fd1a31ae02ea5dd8075b4ef7eea88
MIME type:	image/x-tga

Vendor Threat Intelligence

No detections

Result

Verdict:

Clean

File Type:

XML File

Link:

https://app.docguard.net/01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d/results/dashboard

Gathering data

Verdict:

Suspicious

Labled as:

TR/Android.Evo

Link:

https://www.hybrid-analysis.com/sample/01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html Zip Archive

Link:

https://app.malva.re/file/c61cfedbd17b50dcdce2b00e86fa5a7c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d/

Threat name:

Android.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-01 13:18:20 UTC

File Type:

Binary (Archive)

Extracted files:

2091

AV detection:

6 of 36 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=agrlwiaowcnatxb6vbvjq2n6yg2f7srfis6h2tvthi252jn4negq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

android banker collection credential_access defense_evasion discovery impact persistence

Link:

https://tria.ge/reports/261001-qmb8ea1tey/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks the presence of a debugger

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 01a2bb200eb09a09dc3ea86a9869bec1b45fca2544bc7d4eb33a35dd25bc690d

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample