MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 100d18a17a30117da14edb6922c8f5affc19f8da5029457049d725b01def10a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 100d18a17a30117da14edb6922c8f5affc19f8da5029457049d725b01def10a6
SHA3-384 hash: d1f48656b48239143d754313e55a84a8b521634d31a2d4a739b2dec047ac953c8d825092b8e1fbbce1167b92cb84e37f
SHA1 hash: a5d34c4c5905b8d3c48f4b5e6914062251f0e3b8
MD5 hash: 76484c7bd83dfe166c6ecc5a780f9d38
humanhash: mango-victor-minnesota-freddie
File name:SanaV2 (1).apk
Download: download sample
File size:3'266'933 bytes
First seen:2026-08-15 05:31:06 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:LnMzemZMXoqtI4lw52ShrK5PFelmcYFZiDRNQBO0vf+DB:LMzemZ4BK4lk2ySlcYG1kO0vfw
TLSH T13FE52362B349143FD97B46319AC627A52B6A8E0086E77B0F3840723D5E3739E5F58EC4
TrID 65.0% (.APK) Android Package (27000/1/5)
25.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter Anonymous
Tags:apk SHAPARAK

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
GB GB
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Android.Siggen.Susp2.5348.25202.10389.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bankingtrojan dropper signed
Link:
https://www.filescan.io/uploads/6a7ff9b36451d1d61f2e50c0/reports/699194c3-bea2-474c-bef5-3d84f0984759/overview
Result
Link:
https://incinerator.cloud/#/public/report/76484c7bd83dfe166c6ecc5a780f9d38/detail
Application Permissions
read phone state and identity (READ_PHONE_STATE)
receive SMS (RECEIVE_SMS)
send SMS messages (SEND_SMS)
read SMS or MMS (READ_SMS)
read contact data (READ_CONTACTS)
write contact data (WRITE_CONTACTS)
directly call phone numbers (CALL_PHONE)
read external storage contents (READ_EXTERNAL_STORAGE)
take pictures and videos (CAMERA)
fine (GPS) location (ACCESS_FINE_LOCATION)
coarse (network-based) location (ACCESS_COARSE_LOCATION)
act as an account authenticator (AUTHENTICATE_ACCOUNTS)
full Internet access (INTERNET)
prevent phone from sleeping (WAKE_LOCK)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
view network status (ACCESS_NETWORK_STATE)
change your audio settings (MODIFY_AUDIO_SETTINGS)
control vibrator (VIBRATE)
write sync settings (WRITE_SYNC_SETTINGS)
read sync settings (READ_SYNC_SETTINGS)
C2DM permissions (RECEIVE)
Verdict:
Malicious
File Type:
apk
First seen:
2026-08-15T03:34:00Z UTC
Last seen:
2026-08-15T14:08:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/100d18a17a30117da14edb6922c8f5affc19f8da5029457049d725b01def10a6/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/100d18a17a30117da14edb6922c8f5affc19f8da5029457049d725b01def10a6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/100d18a17a30117da14edb6922c8f5affc19f8da5029457049d725b01def10a6/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-15 05:32:38 UTC
File Type:
Binary (Archive)
Extracted files:
302
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cagrril2gaix3iko3nusfshvv76bt6g2kauuk4cj24s3ahppccta._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/260815-f7126azzfv/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/100d18a17a30117da14edb6922c8f5affc19f8da5029457049d725b01def10a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments