🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0374615eeca4eaa4a9d97c0de82b7e36b0c60cd40332b61c86fa0b29f7712115. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KoSpy


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0374615eeca4eaa4a9d97c0de82b7e36b0c60cd40332b61c86fa0b29f7712115
SHA3-384 hash: cd09b5e4242abf9fe912527a5e861d7ba27cd0ec63a1a60e9ba1c25a81cd60c218ad57c3db08fafb5b674f8b6cffcc53
SHA1 hash: 985fd1f74eb617b1fea17095f9e991dcaceec170
MD5 hash: bc4bcc29f12d40952c679e45a3df6a16
humanhash: foxtrot-mike-double-vermont
File name:0374615eeca4eaa4a9d97c0de82b7e36b0c60cd40332b61c86fa0b29f7712115.apk
Download: download sample
Signature KoSpy
Create hunting rule
File size:5'133'000 bytes
First seen:2025-03-14 10:19:09 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:01KPP4uOKwKenq3acSxMYM4PxzR0LB5Eg8JbR5pAAkJKm3K5NFrN7iv9zEsrqYvH:0utOVVRV5nt0lKVJbJAAkJTK5Na3vH
TLSH T13836F1D2F7D9982FC8739072CDBB52B2169A0C418A83AF437908771C68BB5C44F59BD9
TrID 50.0% (.APK) Android Package (27000/1/5)
23.1% (.VYM) VYM Mind Map (12500/1/3)
19.4% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
7.4% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter JAMESWT_WT
Tags:apk APT37 KoSpy

Intelligence

File Origin
# of uploads :
1
# of downloads :
366
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
crypto evasive expand fingerprint lolbin persistence remote
Link:
https://www.filescan.io/uploads/67d402df01edd28374afbaa0/reports/c1adbf41-89ef-4bfe-a4d2-8a9035813c46/overview
Result
Link:
https://incinerator.cloud/#/public/report/bc4bcc29f12d40952c679e45a3df6a16/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
read external storage contents (READ_EXTERNAL_STORAGE)
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)
read phone state and identity (READ_PHONE_STATE)
retrieve running applications (GET_TASKS)
display system-level alerts (SYSTEM_ALERT_WINDOW)
full Internet access (INTERNET)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
view network status (ACCESS_NETWORK_STATE)
view Wi-Fi status (ACCESS_WIFI_STATE)
prevent phone from sleeping (WAKE_LOCK)
reorder applications running (REORDER_TASKS)
Score:
88%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/0374615eeca4eaa4a9d97c0de82b7e36b0c60cd40332b61c86fa0b29f7712115
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0374615eeca4eaa4a9d97c0de82b7e36b0c60cd40332b61c86fa0b29f7712115/
Threat name:
Android.PUA.Superfluss
Create hunting rule
Status:
Malicious
First seen:
2025-02-07 19:20:49 UTC
File Type:
Binary (Archive)
Extracted files:
1316
AV detection:
7 of 24 (29.17%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=an2gcxxmutvkjkozpqg6qk36g2ymmdguamzlmheg7ifst53reekq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
android discovery execution impact persistence
Link:
https://tria.ge/reports/250314-mcl33ssjt6/
Behaviour
Registers a broadcast receiver at runtime (usually for listening for system events)
Schedules tasks to execute at a specified time
Uses Crypto APIs (Might try to encrypt user data)
Queries information about running processes on the device
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/883a0b2f-05b6-4bca-a385-a223f2c5bfe0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0374615eeca4eaa4a9d97c0de82b7e36b0c60cd40332b61c86fa0b29f7712115

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Suspicious_Latam_MSI_and_ZIP_Files
Create hunting rule
Author:eremit4, P4nd3m1cb0y
Description:Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments