MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b8e04cf2b647df686f9be2fc3186cdcc070dff5ba772fb9848c8cd0f2a5427d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Joker


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b8e04cf2b647df686f9be2fc3186cdcc070dff5ba772fb9848c8cd0f2a5427d
SHA3-384 hash: 2797fdbf5f25eac3d987bc696a83ae8afd2fa23edb9b4bad0e788ee0c6aed2b3274b14dff7bd26cc81320ec4b5d8a0cd
SHA1 hash: ac304635b9aef721a3035c70950ca67f1d6f13dd
MD5 hash: 5a379d50f81158b0e239d82c70223a5a
humanhash: ten-maryland-september-eighteen
File name:Phone Clean Pro_2.06.apk
Download: download sample
Signature Joker
Create hunting rule
File size:17'853'917 bytes
First seen:2026-05-04 14:53:50 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 393216:pPLgXV+AOhqcxmq/EZMIM/rLr9o6hwaxaneAu0AW8OsXq:NLUM06mq/xIM/rNo2AneT5D6
TLSH T15C07235BF32C942FC57754328EBA6322419B0147CA83AF57FA54911C1AABAC85F1EFC4
TrID 43.5% (.APK) Android Package (27000/1/5)
20.1% (.VYM) VYM Mind Map (12500/1/3)
16.9% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
12.9% (.XPI) Mozilla Firefox browser extension (8000/1/1)
6.4% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter Anonymous
Tags:apk joker malware

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
RU RU
Vendor Threat Intelligence
Gathering data
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adware base64 crypto evasive expand fingerprint lolbin
Link:
https://www.filescan.io/uploads/69f8b3262fcb905ec27dc4f0/reports/eb32bee9-3d6e-4816-8973-456d9f8229dd/overview
Result
Link:
https://incinerator.cloud/#/public/report/5a379d50f81158b0e239d82c70223a5a/detail
Application Permissions
read external storage contents (READ_EXTERNAL_STORAGE)
Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
display system-level alerts (SYSTEM_ALERT_WINDOW)
view Wi-Fi status (ACCESS_WIFI_STATE)
control vibrator (VIBRATE)
view network status (ACCESS_NETWORK_STATE)
change network connectivity (CHANGE_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
full Internet access (INTERNET)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
C2DM permissions (RECEIVE)
update component usage statistics (PACKAGE_USAGE_STATS)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/5b8e04cf2b647df686f9be2fc3186cdcc070dff5ba772fb9848c8cd0f2a5427d
Verdict:
Unknown
File Type:
apk
First seen:
2026-05-05T01:00:00Z UTC
Last seen:
2026-05-05T03:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5b8e04cf2b647df686f9be2fc3186cdcc070dff5ba772fb9848c8cd0f2a5427d/results?tab=lookup
Score:
46%
Verdict:
Susipicious
File Type:
APK
Link:
https://malprob.io/report/5b8e04cf2b647df686f9be2fc3186cdcc070dff5ba772fb9848c8cd0f2a5427d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b8e04cf2b647df686f9be2fc3186cdcc070dff5ba772fb9848c8cd0f2a5427d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lohajtzlmr67nbxzxyx4ggdm3tahbx7vxj3s7omersgnb4vfij6q._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
android
Link:
https://tria.ge/reports/260504-r95c5ses5w/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://play.google.com/store/apps/details?id=com.cleanfile.bigkits.vepro

Comments