MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a
SHA3-384 hash:	1aef57ddc0108dbe92ac692b6197b9f8da8b0109f76d29a972a46e1b6c20fdcb85e10cb6a93164ac6ca00417b81876b7
SHA1 hash:	2edb06787250b07f40071d4186289f8f34900d10
MD5 hash:	ec4b07bebe975e10334b3fb330219810
humanhash:	comet-hydrogen-minnesota-november
File name:	Dmart (12).apk
Download:	download sample
File size:	2'392'999 bytes
First seen:	2026-05-06 09:45:00 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:gcY+Dd+SLheidpdkBZ7Kb8aklEfSMrefeCU4Jj:geDdRdGy8maMVCdj
TLSH	T189B5E0D27B86563EC83D45364CA613712B46AC25CDB6A707E814732C7CB72C84F9AED8
Magika	apk
Reporter	mohit
Tags:	android apk DMart malware

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

161

Origin country :

IN

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Siggen.Susp.49545.22960.4265.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android expand invalid-signature lolbin signed

Link:

https://www.filescan.io/uploads/69fb0da6df14f1cb2acb7620/reports/3da20bd3-0f66-42a7-a414-fda198274366/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/ec4b07bebe975e10334b3fb330219810/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

view network status (ACCESS_NETWORK_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

full Internet access (INTERNET)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2025-12-01T08:44:00Z UTC

Last seen:

2026-05-08T00:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fus4wtugftdmvqmztf4y6bccchwzsi452flxtptcog3ibqbipava._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android banker discovery impact

Link:

https://tria.ge/reports/260506-lrt7kaex6y/

Behaviour

Uses Crypto APIs (Might try to encrypt user data)

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2d25cb4e862cc6cac19999798f044211ed99239dd15779be6271b680c028782a