🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53b7128250ca70ca2ebadbc4a9cdb2aa4a3d0b4a2ac9e6b7c0a302706d59d95d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53b7128250ca70ca2ebadbc4a9cdb2aa4a3d0b4a2ac9e6b7c0a302706d59d95d
SHA3-384 hash: 88c6e5270dd6059b03c5c0a45d58520ce180d9ccc0b9ae969f44660fdf3bb51229eeddc4e11df0758eb67270e4c24d07
SHA1 hash: 8d93c6847113514384d90294050d50fe6928de42
MD5 hash: c9661c39a1cf205668cedc982ee746a0
humanhash: glucose-winter-mars-october
File name:SеxHub18+.apk
Download: download sample
File size:5'951'708 bytes
First seen:2026-08-19 12:39:11 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:NILd0kqH5D2qVLH9podMkXqmVoFq7em+eQBvDOZtVt8o6ieEEqvWQXNxk:QGkqH5D2qVLsMgKm+esritVt8o60rvPi
TLSH T111562282FF45C92EC4B744371A83073662669D1EC697D38798EC36286C376D84EE8ED4
TrID 49.0% (.APK) Android Package (27000/1/5)
24.5% (.JAR) Java Archive (13500/1/2)
19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter jitesh
Tags:android apk dropper malware RiskWare SmsSpy Tiktok trojan

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
IR IR
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Android.Banker.Mamont.287.origin.21833.8673.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
evasive obfuscated signed
Link:
https://www.filescan.io/uploads/6a85a3f8553aa87fab986e78/reports/3d3da7ed-1855-4a43-a04d-19b2aff013f6/overview
Result
Link:
https://incinerator.cloud/#/public/report/c9661c39a1cf205668cedc982ee746a0/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
set wallpaper (SET_WALLPAPER)
set wallpaper size hints (SET_WALLPAPER_HINTS)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
Score:
88%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/53b7128250ca70ca2ebadbc4a9cdb2aa4a3d0b4a2ac9e6b7c0a302706d59d95d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53b7128250ca70ca2ebadbc4a9cdb2aa4a3d0b4a2ac9e6b7c0a302706d59d95d/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-19 13:18:19 UTC
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ko3rfasqzjymulv23pckttnsvjfd2c2kfle6nn6aumbha3kz3foq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/260819-pvs1fswwbw/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/53b7128250ca70ca2ebadbc4a9cdb2aa4a3d0b4a2ac9e6b7c0a302706d59d95d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Packer_Android
Create hunting rule
Author:R3R0K
Description:Android.Packer_Android
Rule name:SUSP_XORed_Mozilla_Oct19
Create hunting rule
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

apk 53b7128250ca70ca2ebadbc4a9cdb2aa4a3d0b4a2ac9e6b7c0a302706d59d95d

(this sample)

  
Delivery method
Distributed via web download

Comments