MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Konfety

Vendor detections: 6

Intelligence 6 IOCs YARA 9 File information Comments

SHA256 hash:	53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee
SHA3-384 hash:	f68e0c51a238f0218590d1e8cc38b115d47ff44996b3e2d010fdc1e922a60acc158da04f4b0d6a6ff9e22327f84832a4
SHA1 hash:	cb028bcb366129ba2109c201e9fdf444281d2fa4
MD5 hash:	a676758a682c22cc5fdd0006cbd9fd5b
humanhash:	mexico-crazy-happy-leopard
File name:	Install.apk
Download:	download sample
Signature	Konfety Create hunting rule
File size:	10'386'330 bytes
First seen:	2026-03-24 18:45:48 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:eQieEVulRnftBN3x6NMQDUpCnoy85HKmUDY2Yzr2aDysxizWQmd+:AeEELfnQ+pCnM5HKmU0Dzr2f8izWz+
TLSH	T1BDA6D056E7160C32C99EA23A14FB4B40FB31258ABEC367860824D67D7D733D4E7A52C9
TrID	65.0% (.APK) Android Package (27000/1/5) 25.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk Konfety

Intelligence

File Origin

# of uploads :

# of downloads :

205

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 base64 crypto evasive fingerprint obfuscated signed soft-404

Link:

https://www.filescan.io/uploads/69c2dbf7256cd88a6aaed435/reports/b4d12f48-bc22-408c-aeab-e951aa254b96/overview

Result

Link:

https://incinerator.cloud/#/public/report/a676758a682c22cc5fdd0006cbd9fd5b/detail

Application Permissions

coarse (network-based) location (ACCESS_COARSE_LOCATION)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

record audio (RECORD_AUDIO)

read phone state and identity (READ_PHONE_STATE)

prevent phone from sleeping (WAKE_LOCK)

view network status (ACCESS_NETWORK_STATE)

full Internet access (INTERNET)

create Bluetooth connections (BLUETOOTH)

change your audio settings (MODIFY_AUDIO_SETTINGS)

C2DM permissions (RECEIVE)

Verdict:

Adware

File Type:

apk

Link:

https://opentip.kaspersky.com/53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee/results?tab=lookup

Score:

42%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kp7szhs2lrjmfqvqw5zyhvq52m6veloz6cdtrdjckg6zux5bhtxa._file

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/260324-xeqt6aav7x/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/53ff2c9e5a5c52c2c2b0b77383d61dd33d522dd9f087388d2251bd9a5fa13cee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Android_Accessibility_Service_Abuse Create hunting rule
Author:	Buga :3
Description:	Detects Android malware abusing Accessibility Service for auto-clicking, credential theft, overlay attacks, or device takeover
Reference:	https://developer.android.com/reference/android/accessibilityservice/AccessibilityService

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample