MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37aea8c8ed8ea55d23da37d997e82e6cc34bf80bce891378be7543adf6678ea1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	37aea8c8ed8ea55d23da37d997e82e6cc34bf80bce891378be7543adf6678ea1
SHA3-384 hash:	dd53537b1ad61e4c4485836c8d31761434be2798beda30ea4e01a17686826059496fe1893c512783ee7cbb6cd36f4a23
SHA1 hash:	1b365a88eaccd28fa3fbac8db471bab39a98868a
MD5 hash:	30bc7a40d4de34277275963feb2d4311
humanhash:	illinois-colorado-grey-nine
File name:	SecureGuard.apk
Download:	download sample
File size:	2'282'059 bytes
First seen:	2026-03-12 08:09:34 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:n5n4lXbabTJnPO3ENVXdBUJ7RoiFg2wLgvObQA5Nzw:nV4lrcTJnPmsHeJ9c2wJbXLzw
TLSH	T112B50241F3E9AC2FCDB785324BBA4B7A42428D46C647C71349A8B22C5DBB9C45E85FC4
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	jitesh
Tags:	android apk signed SpyAgent

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

226

Origin country :

IN

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Siggen.Susp.55865.4037.3564.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android crypto evasive fingerprint infostealer persistence signed

Link:

https://www.filescan.io/uploads/69b274f62000fc76c3d5aa07/reports/b3688b73-bfe7-449e-934b-36553b7bfb31/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/30bc7a40d4de34277275963feb2d4311/detail

Application Permissions

display system-level alerts (SYSTEM_ALERT_WINDOW)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

receive SMS (RECEIVE_SMS)

directly call phone numbers (CALL_PHONE)

read phone state and identity (READ_PHONE_STATE)

take pictures and videos (CAMERA)

record audio (RECORD_AUDIO)

read contact data (READ_CONTACTS)

fine (GPS) location (ACCESS_FINE_LOCATION)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

access location in background (ACCESS_BACKGROUND_LOCATION)

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

prevent phone from sleeping (WAKE_LOCK)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

control vibrator (VIBRATE)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/37aea8c8ed8ea55d23da37d997e82e6cc34bf80bce891378be7543adf6678ea1/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/37aea8c8ed8ea55d23da37d997e82e6cc34bf80bce891378be7543adf6678ea1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/37aea8c8ed8ea55d23da37d997e82e6cc34bf80bce891378be7543adf6678ea1/

ReversingLabs TitaniumCloud Android.Trojan.AVerseFalc

Threat name:

Android.Trojan.AVerseFalc

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-12 08:10:33 UTC

File Type:

Binary (Archive)

Extracted files:

450

AV detection:

12 of 38 (31.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g6xkrshnr2sv2i62g7mzp2bontbux6alz2erg6f6ovb235thr2qq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android collection credential_access defense_evasion discovery persistence

Link:

https://tria.ge/reports/260312-j2xz4aas7x/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests enabling of the accessibility settings.

Makes use of the framework's Accessibility service

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/37aea8c8ed8ea55d23da37d997e82e6cc34bf80bce891378be7543adf6678ea1