MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0b194dab7e4600fb9e04d3c9828025ae650ed463f49f58e24f44db94a8cc3108. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 0b194dab7e4600fb9e04d3c9828025ae650ed463f49f58e24f44db94a8cc3108 |
|---|---|
| SHA3-384 hash: | 85427afc110ad565e103b5ecbc4938d2fcfdae892c4b366afeb5c1abec770801d3bf7e5940b3d399df8cecbcff8b8abe |
| SHA1 hash: | c27b0be599c78c9dce1bd4065a3a50d0dea9c8b9 |
| MD5 hash: | 5ee090269412f61f74afd1e96539de07 |
| humanhash: | earth-arkansas-august-bluebird |
| File name: | divar-11-14-17-b.apk |
| Download: | download sample |
| File size: | 74'230'437 bytes |
| First seen: | 2026-10-03 06:33:18 UTC |
| Last seen: | Never |
| File type: | apk |
| MIME type: | application/vnd.android.package-archive |
| ssdeep | 1572864:wb9mwjGnrr9+NOQGrojm1AZ4q/NH+UlVkWE3sclQ:ShPN0r8TfNfMs+Q |
| TLSH | T1FFF733A3E768F82FE777D43786BA027385950D809665CB272505F21C8BF3A849E49FC1 |
| TrID | 24.8% (.APK) Android Package (27000/1/5) 19.8% (.OXT) OpenOffice Extension (21500/1/3) 12.4% (.JAR) Java Archive (13500/1/2) 11.5% (.VYM) VYM Mind Map (12500/1/3) 10.1% (.CATROBAT) Pocket Code/Catroid Catrobat Project (11000/1/2) |
| Magika | apk |
| Reporter |  Hosien_G |
| Tags: | apk iran signed supply chain |
Code Signing Certificate
| Organisation: | Reza Mohammadi |
|---|---|
| Issuer: | Reza Mohammadi |
| Algorithm: | sha1WithRSAEncryption |
| Valid from: | 2012-07-10T14:48:50Z |
| Valid to: | 2037-07-04T14:48:50Z |
| Serial number: | 4ffc40d2 |
| Intelligence: | 6 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | a954e0419e34ff0779ef5186f06a985b42fd3db07bb03764aa7ff4bf21931baf |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
144
Origin country :
ESVendor Threat Intelligence
Gathering data
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 evasive persistence signed
Result
Application Permissions
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
read external storage contents (READ_EXTERNAL_STORAGE)
fine (GPS) location (ACCESS_FINE_LOCATION)
coarse (network-based) location (ACCESS_COARSE_LOCATION)
record audio (RECORD_AUDIO)
take pictures and videos (CAMERA)
modify global system settings (WRITE_SETTINGS)
full Internet access (INTERNET)
view Wi-Fi status (ACCESS_WIFI_STATE)
change Wi-Fi status (CHANGE_WIFI_STATE)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
change your audio settings (MODIFY_AUDIO_SETTINGS)
control vibrator (VIBRATE)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
allow use of fingerprint (USE_FINGERPRINT)
create Bluetooth connections (BLUETOOTH)
show app notification (READ_APP_BADGE)
C2DM permissions (RECEIVE)
Allows cloud to device messaging (C2D_MESSAGE)
Verdict:
Clean
File Type:
apk
First seen:
2026-07-31T06:17:00Z UTC
Last seen:
2026-10-04T23:46:00Z UTC
Hits:
~10
Score:
1%
Verdict:
Benign
File Type:
APK
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
android collection defense_evasion discovery evasion execution persistence
Behaviour
Schedules tasks to execute at a specified time
Acquires the wake lock
Queries information about active data network
Queries the mobile country code (MCC)
Reads information about phone network operator.
Requests cell location
Loads dropped Dex/Jar
Checks if the Android device is rooted.
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ANDROID_Sample_Unique_5be608a5 |
|---|---|
| Author: | Marjoriefort |
| Description: | Specimen unique (soumission Bazaar) - strings distinctifs propres au sample |
| Reference: | 5be608a563a02c94dbf3b1812b3aa0685a6f8228b5dc74c773cc3c912adef7ba.apk |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
| Rule name: | upxHook |
|---|---|
| Author: | @r3dbU7z |
| Description: | Detect artifacts from 'upxHook' - modification of UPX packer |
| Reference: | https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.