MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765
SHA3-384 hash: 3e5ff6b02bd25065e225f20ce0dc9e19b79f035f91a0f87f7811f6808a3f3eadffdf3c12bb6d07fb80d279543be23cac
SHA1 hash: 63f386a1d91177d53f7e4021f33c6996f48885f4
MD5 hash: 968c0c75049e3236e1af1ba8589ffdc8
humanhash: hamper-mirror-speaker-finch
File name:secure.apk
Download: download sample
File size:17'066'750 bytes
First seen:2025-11-20 15:25:18 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 393216:Wv4NZ8t49HRjkshzvQzPVBlG4Af+XDf2ZLEbmckn:WvOO49VhzvO3lG4Ay6FEqc0
TLSH T1E807332EBAFDC6A1ECBB7375D636DCE583A85A4DD433047FF2511313ADBA9018522422
Magika unknown
Reporter juroots
Tags:apk

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
IL IL
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
invalid-signature signed
Link:
https://www.filescan.io/uploads/691f333f780544b9224b9964/reports/108c40d4-e615-4cc7-b568-6d2c8e7c0bbd/overview
Result
Link:
https://incinerator.cloud/#/public/report/968c0c75049e3236e1af1ba8589ffdc8/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
C2DM permissions (RECEIVE)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765
Verdict:
Malicious
File Type:
apk
First seen:
2025-11-19T23:07:00Z UTC
Last seen:
2025-11-21T03:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765/results?tab=lookup
Score:
91%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h2xpztxo5aymzpklzyiuo7glkvk3aoseakystuhqmgfusn7du5sq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/251120-swjpyswqax/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3dcd0797-06f3-4eea-9234-17821216f7d0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:elf_arm_mips_ko_so
Create hunting rule
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

apk 3eaefcceeee830ccbd4bce11477ccb5555b03a4402b129d0f0618b4937e3a765

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3713001/
  
Delivery method
Distributed via web download

Comments