MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2de70ca737c1f4602517c555ddd54165432cf231ffc0e21fb2e23b9dd14e7fb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2de70ca737c1f4602517c555ddd54165432cf231ffc0e21fb2e23b9dd14e7fb4
SHA3-384 hash:	ed9269762c4184b37525852557faf95741c40a94d756e4e2eca9367cc86a4b932b0a187818d2e6a3f6294e949fc3a1bc
SHA1 hash:	5eb26f69caa5fc281eaba466ead6a968545eab4f
MD5 hash:	06b80586f3db28fd0886c68d327e6d6d
humanhash:	alaska-missouri-jupiter-ohio
File name:	MOD APK (Pro Unlocked) latest version.apk
Download:	download sample
Signature	Triada Alert Create hunting rule
File size:	75'607'885 bytes
First seen:	2025-02-28 22:38:25 UTC
Last seen:	2025-05-19 20:32:48 UTC
File type:	apk
MIME type:	application/zip
ssdeep	1572864:J/2LZ1VbXhETM0kZlShysJPC2DLPwpJ08w:JaZLbRuk0TjH
TLSH	T141F70193E32C9E9AD0F3D332A676C15268264CAC4707D3771D18B97D1BB39C3A60A9C5
TrID	30.8% (.APK) Android Package (27000/1/5) 24.5% (.OXT) OpenOffice Extension (21500/1/3) 15.4% (.JAR) Java Archive (13500/1/2) 12.5% (.CATROBAT) Pocket Code/Catroid Catrobat Project (11000/1/2) 12.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
Magika	apk
Reporter	aachum
Tags:	apk signed Tirada Triada

iamaachum

https://tria.ge/250228-2f1g7s1qv8/static1 => https://apkcomod.com/?title=Anydesk_Mod_APK => https://www.1024tera.com/spanish/sharing/link?surl=oAhxG8bYaUhtR_N8MK8Arw

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

156

Origin country :

ES

Vendor Threat Intelligence

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

fingerprint persistence signed

Link:

https://www.filescan.io/uploads/67c23b153c5f644bd93d3ffb/reports/eea46600-ecbf-4a64-81a2-248c3223dbea/overview

Nucleon Malprob Malware

Score:

86%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/2de70ca737c1f4602517c555ddd54165432cf231ffc0e21fb2e23b9dd14e7fb4

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fxtqzjzxyh2gajixyvk53vkbmvbsz4rr77aoeh5s4i5z3ukop62a._file

Hatching Triage triada

Result

Malware family:

triada

Alert

Create hunting rule

Score:

  10/10

Tags:

family:triada android discovery execution impact persistence upx

Link:

https://tria.ge/reports/250228-2k2aas1rw6/

Behaviour

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

UPX packed file

Acquires the wake lock

Queries information about active data network

Reads information about phone network operator.

Patched UPX-packed file

Threat.Zone Informative

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b266bf5d-11ac-4e95-895c-2b6ab6f22ccf

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2025-02-28 22:39:33 UTC

Wrongly pasted tria.ge link in the description when it should be https://github.com/kjueo/derosk/blob/main/Anydesk%20Mod%20APK%20Download%20Latest%20Version%20-%20(p1f3r).md