MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a659f0eea60ca2388eda4ea3989c15f8e5d29c54b51fc74efb599474ba943ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3a659f0eea60ca2388eda4ea3989c15f8e5d29c54b51fc74efb599474ba943ea
SHA3-384 hash:	5f880d5be0455a85819b4120a335b4a0854252ab5aa72c80dd13415ebf1c7724c228d55f5f58fc6e9b31f659a47e18da
SHA1 hash:	6dc57accc96a310082909aad9fbf0ce0f809dbcc
MD5 hash:	00b3b8c8e58d1b0c1195de6bb96fbc80
humanhash:	pasta-angel-pasta-south
File name:	laizi_wzzdh.apk
Download:	download sample
File size:	8'148'746 bytes
First seen:	2026-01-16 12:31:55 UTC
Last seen:	Never
File type:	apk
MIME type:	application/java-archive
ssdeep	196608:LVSIZH3YaIIQ84S1WBC5mtQxkKU0xaYZ/mmU72q9RwR:LVSIZH8t84nM5lV4mJ+RU
TLSH	T1848612D2E3F8A81AF5B3C735A632825179797DC46940EA5D6248B06C0FB3F818894F77
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	juroots
Tags:	apk signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

150

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.Android.SmsReg-2.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.RiskTool.AndroidOS.apoh.11471.30103.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 crypto evasive fingerprint signed

Link:

https://www.filescan.io/uploads/696a2fd8fdafd7624aaf0600/reports/f6739e83-b0c0-41e3-b791-4f76d8d3d934/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/00b3b8c8e58d1b0c1195de6bb96fbc80/detail

Application Permissions

read phone state and identity (READ_PHONE_STATE)

mount and unmount file systems (MOUNT_UNMOUNT_FILESYSTEMS)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

send SMS messages (SEND_SMS)

edit SMS or MMS (WRITE_SMS)

read SMS or MMS (READ_SMS)

retrieve running applications (GET_TASKS)

receive SMS (RECEIVE_SMS)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

take pictures and videos (CAMERA)

display system-level alerts (SYSTEM_ALERT_WINDOW)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

control vibrator (VIBRATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

reorder applications running (REORDER_TASKS)

control flashlight (FLASHLIGHT)

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

apk

First seen:

2026-01-16T10:27:00Z UTC

Last seen:

2026-01-16T10:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3a659f0eea60ca2388eda4ea3989c15f8e5d29c54b51fc74efb599474ba943ea/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/3a659f0eea60ca2388eda4ea3989c15f8e5d29c54b51fc74efb599474ba943ea

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a659f0eea60ca2388eda4ea3989c15f8e5d29c54b51fc74efb599474ba943ea/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hjsz6dxkmdfchchnutvdtcobl6hf2kofjni7y5hpwwmuos5jipva._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android discovery

Link:

https://tria.ge/reports/260116-pqvngsgx5d/

Behaviour

Checks CPU information

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries information about active data network

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Queries information about running processes on the device

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/bcf4dd91-a344-49ec-962e-8c8888825c3a

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.73

Link:

https://yomi.yoroi.company/submissions/3a659f0eea60ca2388eda4ea3989c15f8e5d29c54b51fc74efb599474ba943ea