MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 480616f69e7ca6d70edb6eb7639121b4548d5b9856c23e117be5344d39c8a7dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	480616f69e7ca6d70edb6eb7639121b4548d5b9856c23e117be5344d39c8a7dd
SHA3-384 hash:	bccc7515318c51c6394862e25727f9e74a7abd469e635e6acc6c36971e41b8d78429f77053e6f3766da9a3e5dff6d08a
SHA1 hash:	ab01c5aaee9c3a50d69f8e17b206c09b1f0bd09b
MD5 hash:	e1863850d14c7fe5110c66146d941568
humanhash:	eleven-johnny-october-juliet
File name:	NordVPN_Бесплатный.vpn (3).apk
Download:	download sample
File size:	9'427'162 bytes
First seen:	2026-09-24 14:33:19 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	196608:oFBWwm+m3FLWr9RbJJJ31S8vm7vSsA4EFFpm5:oFBW/BabJJJFlvm96pQ
TLSH	T11A9612719E883C21C1F18A3580A30A63E3FD53466371EA6F0FB155643DA3AD2AF52D76
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	Parper
Tags:	apk

Parper

src https://t.me/NordBOVPN/74

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adware fingerprint signed

Link:

https://www.filescan.io/uploads/6ab534e61ea547f5ed33dc9d/reports/931e446d-4c30-4c13-879f-5b2db20945ac/overview

Verdict:

Malicious

File Type:

apk

First seen:

2026-09-24T11:46:00Z UTC

Last seen:

2026-09-25T18:19:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Dropper.AndroidOS.Creduz.t

Link:

https://opentip.kaspersky.com/480616f69e7ca6d70edb6eb7639121b4548d5b9856c23e117be5344d39c8a7dd/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/480616f69e7ca6d70edb6eb7639121b4548d5b9856c23e117be5344d39c8a7dd/

Threat name:

Android.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-24 14:36:40 UTC

File Type:

Binary (Archive)

Extracted files:

1883

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jadbn5u6pstnodw3n23whejbwrki2w4yk3bd4el34u2e2ooiu7oq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

android banker collection credential_access defense_evasion discovery impact persistence

Link:

https://tria.ge/reports/260924-rxh95sfc35/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks the presence of a debugger

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/480616f69e7ca6d70edb6eb7639121b4548d5b9856c23e117be5344d39c8a7dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample