MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FantasyHub


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
SHA3-384 hash: 73f63cc3aa560a5c1fb665ddff61aa768bdf297fca6777cdd5a22544201ac696e574b717ee2e2eac6bd3ef91cf2f271a
SHA1 hash: f702f56ebcb68301508084a6045925b34c49c274
MD5 hash: 00d9cf98baa6178949969d3471691dd4
humanhash: mississippi-eighteen-thirteen-avocado
File name:TikTok18.apk
Download: download sample
Signature FantasyHub
Create hunting rule
File size:8'633'097 bytes
First seen:2026-02-06 08:53:04 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 196608:64jSh1dNhS9hLoukJaWL7+RkS4/UwzG2iNmKr:9M1dNhS9h8b777SiiEKr
TLSH T181963396F729A52ED97B41710A8A473223669E09CEE7D307A1543B2C783B3C98F44FC5
TrID 49.0% (.APK) Android Package (27000/1/5)
24.5% (.JAR) Java Archive (13500/1/2)
19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter jitesh
Tags:android apk BankBot dropper FantasyHub signed Tiktok

Code Signing Certificate

Organisation:main_app
Issuer:main_app
Algorithm:sha384WithRSAEncryption
Valid from:2026-02-05T19:54:22Z
Valid to:2080-11-08T19:54:22Z
Serial number: 5838c1cd47376508
Thumbprint Algorithm:SHA256
Thumbprint: 6c0f81738974ef4687f8b234870fb0c2cfe8cf00cb6a7f368a639d0457db1679
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
IN IN
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Trojan-Dropper.AndroidOS.Agent.15540.17463.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Android.BankBot.16104.26292.994.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
signed
Link:
https://www.filescan.io/uploads/6985abfd981ff1d38a4b0cbe/reports/a2f8e992-3213-4f3c-8a04-4ddceaf5404b/overview
Result
Link:
https://incinerator.cloud/#/public/report/00d9cf98baa6178949969d3471691dd4/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
Score:
68%
Verdict:
Susipicious
File Type:
APK
Link:
https://malprob.io/report/2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fjpybdzqkm2kbt7mdwvhfefm4zeqpgvzy3n62q7xp764znk4nyyq._file
Result
Malware family:
fantasyhub
Create hunting rule
Score:
  10/10
Tags:
family:fantasyhub
Link:
https://tria.ge/reports/260206-ktezzsfz2f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

FantasyHub

apk 2a5f808f305334a0cfec1daa7290ace649079ab9c6dbed43f77ffdccb55c6e31

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3772914/
  
Delivery method
Distributed via web download

Comments