MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1099eede57e825fa5158b33f01559dc76e6d67e2fca37b97f76e7d3aa9a4208a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1099eede57e825fa5158b33f01559dc76e6d67e2fca37b97f76e7d3aa9a4208a
SHA3-384 hash:	74cd6c53c89eab4065015f7e8a218d7695cb2d6032227b9661c0089329da092a48734faaf038c447633bb61b1759697c
SHA1 hash:	5293328de36a6f6265ada1c74136a4cb223b7061
MD5 hash:	3d50e1175e21ae460e9d7a5af9997f02
humanhash:	tango-minnesota-double-lima
File name:	foto (1).apk
Download:	download sample
File size:	2'416'704 bytes
First seen:	2026-01-29 14:00:20 UTC
Last seen:	2026-02-02 15:49:54 UTC
File type:	apk
MIME type:	application/zip
ssdeep	49152:tSIH8nrC5t6y7I45ZzSJLB5elcTeAN/mPQgsrvvk+:o1o8y7nDS/5eaTzOPQgszk+
TLSH	T1D6B5EF01B7989F1EC877D2320C5A5631641AED23CB138347D9682B9D28BF6F44F167EA
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	CyberMalware
Tags:	apk dropper

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

173

Origin country :

TR

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Unix.Dropper.Fakeapp-10014994-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android bankbot expand invalid-signature lolbin signed

Link:

https://www.filescan.io/uploads/697b681f930564ff3c7c3ead/reports/884620f9-237f-4330-8455-327ee4db63e8/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/3d50e1175e21ae460e9d7a5af9997f02/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

display system-level alerts (SYSTEM_ALERT_WINDOW)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-01-29T14:02:00Z UTC

Last seen:

2026-01-29T23:59:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1099eede57e825fa5158b33f01559dc76e6d67e2fca37b97f76e7d3aa9a4208a/results?tab=lookup

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/1099eede57e825fa5158b33f01559dc76e6d67e2fca37b97f76e7d3aa9a4208a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1099eede57e825fa5158b33f01559dc76e6d67e2fca37b97f76e7d3aa9a4208a/

ReversingLabs TitaniumCloud Android.Trojan.Coper

Threat name:

Android.Trojan.Coper

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-29 14:01:00 UTC

File Type:

Binary (Archive)

Extracted files:

189

AV detection:

11 of 23 (47.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ccm65xsx5as7uukywm7qcvm5y5xg2z7c7srxxf7xnz6tvkneecfa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

android defense_evasion

Link:

https://tria.ge/reports/260129-rbf8naaw3c/

Behaviour

Checks the application is allowed to request package installs through the package installer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1099eede57e825fa5158b33f01559dc76e6d67e2fca37b97f76e7d3aa9a4208a