🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60648a8e5ee28177de38e6ea40c17481b95a63e6aa4ca466754bc7e7f08bd2ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60648a8e5ee28177de38e6ea40c17481b95a63e6aa4ca466754bc7e7f08bd2ab
SHA3-384 hash: ac832fe01b51e32d9d199a10e56b758f80c0929682a69e0aa2a436ddfa7a3b2e62e9189f3786c96474929eee5449598f
SHA1 hash: 73185dbc7a11e1fad2f3fa3ee541189f447f0fbf
MD5 hash: 6089aa79f412a1d59fc58f864702ee08
humanhash: florida-north-fanta-burger
File name:Divar.apk
Download: download sample
File size:5'371'514 bytes
First seen:2026-08-19 06:21:28 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:xph5qcziZmjw3P76Y1JgLdsutyFdx/N2kbRBbwqoQICrpmbaG+v9t8x:xL5qsiZmjw3DcLKukXKarH+aQ
TLSH T1C7462382F666A98BC4F6C336247617355037AE22C317B397691477B828FF9E80F162D4
Magika apk
Reporter Anonymous
Tags:apk SHAPARAK

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
GB GB
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.FileRepMalware.53193256.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper signed stealer
Link:
https://www.filescan.io/uploads/6a854b738a34a883bc6fb024/reports/149c1b87-ff0b-4fdb-8143-aec4d7bfda46/overview
Result
Link:
https://incinerator.cloud/#/public/report/6089aa79f412a1d59fc58f864702ee08/detail
Application Permissions
read external storage contents (READ_EXTERNAL_STORAGE)
read SMS or MMS (READ_SMS)
receive SMS (RECEIVE_SMS)
send SMS messages (SEND_SMS)
read contact data (READ_CONTACTS)
list accounts (GET_ACCOUNTS)
directly call phone numbers (CALL_PHONE)
read phone state and identity (READ_PHONE_STATE)
full Internet access (INTERNET)
prevent phone from sleeping (WAKE_LOCK)
control vibrator (VIBRATE)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
view network status (ACCESS_NETWORK_STATE)
allow use of fingerprint (USE_FINGERPRINT)
C2DM permissions (RECEIVE)
Allows cloud to device messaging (C2D_MESSAGE)
Score:
100%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/60648a8e5ee28177de38e6ea40c17481b95a63e6aa4ca466754bc7e7f08bd2ab
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60648a8e5ee28177de38e6ea40c17481b95a63e6aa4ca466754bc7e7f08bd2ab/
Threat name:
Android.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-08-18 15:05:30 UTC
File Type:
Binary (Archive)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbsivds64kaxpxry43vebqluqg4vuy7gvjgkiztvjpd6p4el2kvq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/260819-g4p16aydlb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/60648a8e5ee28177de38e6ea40c17481b95a63e6aa4ca466754bc7e7f08bd2ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments