MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Konfety


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01
SHA3-384 hash: 900d78c6e26d236eea1f8b2cdc469fa67e17ab7b1c896cfce16df150de759d2c10b81c3202427fb97cadbea01f4e9968
SHA1 hash: 77835e4a185cdef921f0dd6746b8b179b8dee7d2
MD5 hash: cb951b4667ba57b55c38cbec22ba55da
humanhash: utah-hotel-kentucky-pluto
File name:Install.apk
Download: download sample
Signature Konfety
Create hunting rule
File size:3'164'937 bytes
First seen:2026-05-13 03:06:06 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:I1sMy5FdVTiPLJV02DxgvrqkVnNKiCmdY:I1sMy5FdliPLr0mgvrnVNKwY
TLSH T123E51216F7D4662FD4BE92316D980222A331DEA1BB826B873608337D5CF71980F653D6
TrID 65.0% (.APK) Android Package (27000/1/5)
25.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter aachum
Tags:apk Konfety


Avatar
iamaachum
https://openlyintimatetuna.pet/click => https://gladlyproperpug.shop/4c404a0e1d0e2b46159/

Konfety C2: http://push.razkondronging.com/register?uid=

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Android.HiddenAds.4236.1267.17014.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adware android evasive fingerprint signed virus
Link:
https://www.filescan.io/uploads/6a03eaad792fe2d217b1708e/reports/bdc55600-80bf-40e6-b04b-bf85032bb215/overview
Result
Link:
https://incinerator.cloud/#/public/report/cb951b4667ba57b55c38cbec22ba55da/detail
Application Permissions
read external storage contents (READ_EXTERNAL_STORAGE)
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
coarse (network-based) location (ACCESS_COARSE_LOCATION)
record audio (RECORD_AUDIO)
read phone state and identity (READ_PHONE_STATE)
prevent phone from sleeping (WAKE_LOCK)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
create Bluetooth connections (BLUETOOTH)
change your audio settings (MODIFY_AUDIO_SETTINGS)
C2DM permissions (RECEIVE)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01
Verdict:
Adware
File Type:
apk
First seen:
2026-05-13T01:21:00Z UTC
Last seen:
2026-05-14T21:54:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01/results?tab=lookup
Score:
71%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-13 03:06:26 UTC
File Type:
Binary (Archive)
Extracted files:
279
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gubpuvyk3je6v3vki6c3wgex5wi57lnko3c6qytmlohjitmpl4aq._file
Result
Malware family:
konfety
Create hunting rule
Score:
  10/10
Tags:
family:konfety android collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan
Link:
https://tria.ge/reports/260513-dlxfqscs3z/
Behaviour
Checks memory information
Registers a broadcast receiver at runtime (usually for listening for system events)
Makes use of the framework's foreground persistence service
Queries information about active data network
Queries the mobile country code (MCC)
Reads information about phone network operator.
Loads dropped Dex/Jar
Obtains sensitive information copied to the device clipboard
Family: Konfety
Malware Config
C2 Extraction:
http://push.razkondronging.com/register?uid=
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Konfety

apk 3502fa570ada49eaeeaa4785bb1897ed91dfadaa76c5e8626c5b8e944d8f5f01

(this sample)

  
Link
https://tria.ge/260513-dh8placs2x/behavioral2
  
Delivery method
Distributed via web download

Comments