🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44b5086d35b879afb9278392c230cdd0d16ac9b830cd44e75ece6ccf0fd4952c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44b5086d35b879afb9278392c230cdd0d16ac9b830cd44e75ece6ccf0fd4952c
SHA3-384 hash: 806150ffdcc75ee4b61ef0231dd47513ccdab209ded4b45ae691ccd5475e618742b519f59c137ae6cacc1f09d9e1ffbe
SHA1 hash: c452a3b8606fb7eb345b208713220e08e6cdf60f
MD5 hash: 2e4e7b02fa56610bce2968c20d55814f
humanhash: south-hydrogen-mountain-fruit
File name:MParivan.apk
Download: download sample
File size:12'472'801 bytes
First seen:2026-06-17 13:03:17 UTC
Last seen:2026-06-17 18:24:15 UTC
File type: apk
MIME type:application/zip
ssdeep 196608:pvPG6yW82uAYI+l95892853JDSPn5+4ob0zBRGjU4cEnQiJBEeGxkGgu/7hQC2N/:pnGsuAYN9K928K5Bobi5EfOxkGzD1Y/
TLSH T1B3C63309F43E4826EC9574787E0507AB393428649320D21B1532573EFFB76CAE67AAA4
Magika apk
Reporter jitesh
Tags:android apk BankBot banker Goi mparivahan

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
IN IN
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
signed
Link:
https://www.filescan.io/uploads/6a329b72a419cb85d28c3514/reports/ee5022a0-1b05-48f2-ab11-402095e091af/overview
Result
Link:
https://incinerator.cloud/#/public/report/2e4e7b02fa56610bce2968c20d55814f/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
C2DM permissions (RECEIVE)
Verdict:
Malicious
File Type:
apk
First seen:
2026-06-01T15:58:00Z UTC
Last seen:
2026-06-17T23:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/44b5086d35b879afb9278392c230cdd0d16ac9b830cd44e75ece6ccf0fd4952c/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/44b5086d35b879afb9278392c230cdd0d16ac9b830cd44e75ece6ccf0fd4952c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44b5086d35b879afb9278392c230cdd0d16ac9b830cd44e75ece6ccf0fd4952c/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=is2qq3jvxb427ojhqojmemgn2diwvsnygdgujz26zzwm6d6usuwa._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/260617-qblbyafz8n/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:elf_arm_mips_ko_so
Create hunting rule
Rule name:SUSP_ZIP_Smuggling_Jun01
Create hunting rule
Author:delivr.to
Description:ZIP archives with data smuggled between last file record and the central directory.
Reference:https://github.com/Octoberfest7/zip_smuggling/
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

apk 44b5086d35b879afb9278392c230cdd0d16ac9b830cd44e75ece6ccf0fd4952c

(this sample)

  
Delivery method
Distributed via web download

Comments