MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 049db028ac8f2fb4bf12d812df976b2078e753f14dda55f0275141df0c430f1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	049db028ac8f2fb4bf12d812df976b2078e753f14dda55f0275141df0c430f1d
SHA3-384 hash:	8c31987f96456d770ba17db5376b1d306431021151029d59c538121fc4f196b582e0614594f6d5edc46299345b9373a8
SHA1 hash:	cc3ada299f590cd123f8ffc439e55bd5d017c2d1
MD5 hash:	c5ac3fa0f333d3d2a363c3858b79c5a8
humanhash:	river-indigo-avocado-quebec
File name:	WinMate_VM5.apk
Download:	download sample
File size:	33'176'686 bytes
First seen:	2026-05-08 09:52:16 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	786432:hfuQD+dkRb8EWYnxvp0qgQFicXZko+Htb1c9m1U5xjrMRXWzbX:96d0jWYxh0q5icpkpHR1ymsdj
TLSH	T138773322A77B446EC4BA647F086826F157AA0E41C526E72F55703235FA33B904F94FF2
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	mohit
Tags:	android apk malware signed Winmate

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

277

Origin country :

IN

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android bangbang_reinforcement base64 crypto evasive fingerprint generisk obfuscated packed signed

Link:

https://www.filescan.io/uploads/69fdb291df14f1cb2acda648/reports/3c00a575-6892-4340-96b4-ad7d0d0e0124/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/c5ac3fa0f333d3d2a363c3858b79c5a8/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

apk

Link:

https://opentip.kaspersky.com/049db028ac8f2fb4bf12d812df976b2078e753f14dda55f0275141df0c430f1d/results?tab=lookup

Nucleon Malprob Malware

Score:

81%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/049db028ac8f2fb4bf12d812df976b2078e753f14dda55f0275141df0c430f1d

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Android.Malware.Generic

Threat name:

Android.Malware.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-01-30 22:21:01 UTC

File Type:

Binary (Archive)

Extracted files:

1458

AV detection:

3 of 24 (12.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aso3akfmr4x3jpys3ajn7f3leb4oou7rjxnfl4bhkfa56dcdb4oq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://tria.ge/reports/260508-lzrfmsaw8l/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/049db028ac8f2fb4bf12d812df976b2078e753f14dda55f0275141df0c430f1d