MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3
SHA3-384 hash:	10dd1696b880dffd1ddb1f8677ba8c1dbba8b0b0f06c97ea1e6625b9262857e4cce88391d1ab8bb2e4698134f72f5f7c
SHA1 hash:	24778225a61b0aaa7e6014fa0845cefcc1a5cde3
MD5 hash:	9c8734df360601f0e5e7b900e2a3e9d7
humanhash:	carpet-kilo-autumn-washington
File name:	11.apk
Download:	download sample
Signature	Datzbro Alert Create hunting rule
File size:	5'425'695 bytes
First seen:	2026-01-13 15:32:12 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:Nmg7ryMIsDsqWChuzgx07/qORN6NLzbCslSQwClkZ3th3XxIJoTYr3uR:k2W1sDsHC+gI/qeN6NWOF+ZdhRr
TLSH	T18F46E0C6FBC8A95AC4F72736C93586A641475C268B83DFC36D14763C18BB6D00E5ABC8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BlinkzSec
Tags:	apk Datzbro signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

70

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/9c8734df360601f0e5e7b900e2a3e9d7/detail

Application Permissions

edit SMS or MMS (WRITE_SMS)

receive SMS (RECEIVE_SMS)

write contact data (WRITE_CONTACTS)

send SMS messages (SEND_SMS)

read SMS or MMS (READ_SMS)

read contact data (READ_CONTACTS)

list accounts (GET_ACCOUNTS)

take pictures and videos (CAMERA)

record audio (RECORD_AUDIO)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

fine (GPS) location (ACCESS_FINE_LOCATION)

directly call phone numbers (CALL_PHONE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)

view network status (ACCESS_NETWORK_STATE)

set wallpaper (SET_WALLPAPER)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

update component usage statistics (PACKAGE_USAGE_STATS)

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-01-12T00:13:00Z UTC

Last seen:

2026-01-14T12:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3/

ReversingLabs TitaniumCloud Android.Infostealer.Anubis

Threat name:

Android.Infostealer.Anubis

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-13 15:03:18 UTC

File Type:

Binary (Archive)

Extracted files:

830

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=muygnd6ljaxdhxa22rlt7sqmzu66kdzcitscm7oxvqxyyzcp2hjq._file

Hatching Triage datzbro

Result

Malware family:

datzbro

Alert

Create hunting rule

Score:

  10/10

Tags:

family:datzbro android banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence rat trojan

Link:

https://tria.ge/reports/260113-syxdtsbt8h/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Queries information about active data network

Queries the mobile country code (MCC)

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Datzbro

Datzbro family

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b4ccd86b-bafc-4cd3-a67b-0ed540d9c869

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6530668fcb482e33dc1ad4573fca0ccd3de50f2244e4267dd7ac2f8c644fd1d3