MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a592e8cbc7f6ece7de140a8f49c359fbf152f3d7bab474eb0f52f521f3e56c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

KATARU

Vendor detections: 6

Intelligence 6 IOCs YARA 12 File information Comments

SHA256 hash:	0a592e8cbc7f6ece7de140a8f49c359fbf152f3d7bab474eb0f52f521f3e56c3
SHA3-384 hash:	326152e14991229c8e9feda8c91ead144c5c29655ce527a2511974dc56580cbd9d0b9bc7532d737aaaf328dbee2d0793
SHA1 hash:	43e9cba57c708bb1593340af21134313dabcea11
MD5 hash:	7fdaf98b6a09696670f4adb54ddde2df
humanhash:	montana-queen-idaho-mirror
File name:	0a592e8c_h_45.198.224.164_j.apk
Download:	download sample
Signature	KATARU Create hunting rule
File size:	587'432 bytes
First seen:	2026-10-29 14:50:33 UTC
Last seen:	Never
File type:	apk
MIME type:	application/vnd.android.package-archive
ssdeep	12288:VfIkAYLQ40OF/UOobYt1WS+iJ1/GaIPjBHWC2rhdr9F0wp:qknQ40OFToba1WLc1uaIdSrhdh2s
TLSH	T187C42382EAED2153C49F0F335E4F4823A76E59F13913779D6EB0A9A95072DDC4A00BE4
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	deepfield
Tags:	apk ddos kataru mirai signed unknown

Code Signing Certificate

Organisation:	Android Debug
Issuer:	Android Debug
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-10-17T01:05:27Z
Valid to:	2056-10-09T01:05:27Z
Serial number:	01
Intelligence:	505 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	5e02b9b6ef2a7e55fa4bbc7201f6cb91237380993f0c61e1386e54f71005d74c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30435.LC.UNOFFICIAL

Result

Link:

https://incinerator.cloud/#/public/report/7fdaf98b6a09696670f4adb54ddde2df/detail

Application Permissions

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read phone state and identity (READ_PHONE_STATE)

display system-level alerts (SYSTEM_ALERT_WINDOW)

modify global system settings (WRITE_SETTINGS)

Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

interact with device admin (BIND_DEVICE_ADMIN)

update component usage statistics (PACKAGE_USAGE_STATS)

modify secure system settings (WRITE_SECURE_SETTINGS)

directly install applications (INSTALL_PACKAGES)

Verdict:

Malicious

File Type:

apk

First seen:

2026-10-29T06:37:00Z UTC

Last seen:

2026-10-29T06:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0a592e8cbc7f6ece7de140a8f49c359fbf152f3d7bab474eb0f52f521f3e56c3/results?tab=lookup

Score:

81%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/0a592e8cbc7f6ece7de140a8f49c359fbf152f3d7bab474eb0f52f521f3e56c3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0a592e8cbc7f6ece7de140a8f49c359fbf152f3d7bab474eb0f52f521f3e56c3/

Threat name:

Linux.Worm.Mirai

Status:

Malicious

First seen:

2026-10-29 05:25:19 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bjms5df4p5xm47pbicupjhbvt67rklz5povuotvq6uxvehz6k3bq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

android defense_evasion persistence

Link:

https://tria.ge/reports/261029-r8bpfabd98/

Behaviour

Acquires the wake lock

Makes use of the framework's foreground persistence service

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/0a592e8cbc7f6ece7de140a8f49c359fbf152f3d7bab474eb0f52f521f3e56c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	ELF_IoT_Persistence_Hunt Create hunting rule
Author:	4r4
Description:	Hunts for ELF files with persistence and download capabilities

Rule name:	ELF_Packer_Dropper_Fileless_Armhf Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects obfuscated Linux ELF packers/droppers featuring ChaCha20/RC4 decryption, memfd_create/execveat fileless execution capabilities, and unique binary artifacts.

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	MIRAI_OHSHIT_payload Create hunting rule
Author:	AfterPacket
Description:	MIRAI_OHSHIT ELF payload -- compiled-in C2 set, all architectures
Reference:	https://github.com/Afterpacket/drosera-threat-intel

Rule name:	NSVPS_Hydra_SSH_Bruteforce Create hunting rule
Author:	sanad (NSVPS-SOC)
Description:	Hydra SSH brute-force campaign credentials pattern from NSVPS honeypot

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	setsockopt Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for setsockopt() red flags

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample