MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f
SHA3-384 hash:	7fda154c29b8ebf8eed303407b19e9a8f5a884074661d27e32f2f9226606e273e5bfd5f79b2800f372e8d6871be61db6
SHA1 hash:	5c9a836f888265f9b048b13d33b87aafd9266f72
MD5 hash:	9e9e998cbc39334bb8681e91ebc180c9
humanhash:	batman-iowa-happy-helium
File name:	PaniniCollectors.apk
Download:	download sample
Signature	PixRevolution Alert Create hunting rule
File size:	8'885'510 bytes
First seen:	2026-02-17 21:41:52 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	196608:ocvhbp1qgj9mL7XrqEww/iihowYPeozPlAV4ypYFZk1O+L13la:bNfRj0HbqEww/FhvYPO+yGktR3o
TLSH	T1E7962246BBE89E1FCC3380364F5A523252499E2BC753C343D964361C387B6E54E897EA
TrID	44.2% (.APK) Android Package (27000/1/5) 22.1% (.JAR) Java Archive (13500/1/2) 17.2% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 9.8% (.WMZ) Windows Media Player skin (6000/1/1) 6.5% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	johnk3r
Tags:	109-110-184-242 200-9-154-125 apk aplicativos-br-com banker dropper PixRevolution

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

211

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

base64 evasive expand lolbin obfuscated signed

Link:

https://www.filescan.io/uploads/6994e0b9930564ff3ca7253b/reports/fb5decb4-fc8c-4033-aa89-2f26259e2252/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/9e9e998cbc39334bb8681e91ebc180c9/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f/results?tab=lookup

Nucleon Malprob Malware

Score:

82%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f/

ReversingLabs TitaniumCloud Android.Trojan.Generic

Threat name:

Android.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-17 22:06:49 UTC

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lkgu5k6qbgtv5tae6pygjcotspyif6ldwqdnbu7ivs7kk2bidrpq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

android collection credential_access defense_evasion impact persistence

Link:

https://tria.ge/reports/260217-1kf4paes2h/

Behaviour

Checks CPU information

Checks memory information

Checks the application is allowed to request package installs through the package installer

Looks up external IP address via web service

Requests allowing to install additional applications from unknown sources.

Checks known Qemu files.

Checks known Qemu pipes.

Obtains sensitive information copied to the device clipboard

Checks if the Android device is rooted.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5a8d4eabd009a75ecc04f3f06489d393f082f963b406d0d3e8acbea568281c5f