MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67530f6cc30ac3dc55717a8ff276b588acbd8849fbd79e821bca9727c20c249a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	67530f6cc30ac3dc55717a8ff276b588acbd8849fbd79e821bca9727c20c249a
SHA3-384 hash:	f4c507ee40241e363b2242ee3fe7354a30c7bbc7263ba66d2b668a9589fb9a9363704cde4a02b8e4e771965cd5f1516a
SHA1 hash:	a57d8f915bed09fcf56b7f431117a4642b56fdb5
MD5 hash:	2191424ce72d4b1bbe55fa317b44eee2
humanhash:	maine-item-timing-bakerloo
File name:	app.apk
Download:	download sample
Signature	IRATA Alert Create hunting rule
File size:	2'038'633 bytes
First seen:	2024-07-29 18:42:47 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:MXF3Ow1l/vjd3bwCCEUwYIhyt/8hxKNR8xYAk/ISYVvj/45M47jjU:MXFewPvjdrw7EULIi/6K8uv6juM4Xw
TLSH	T1C1953342C62BE04BDC67A8774A050A92A1333E4DAC537F5397CB732D6A73795AF87204
TrID	65.0% (.APK) Android Package (32500/1/6) 27.0% (.JAR) Java Archive (13500/1/2) 8.0% (.ZIP) ZIP compressed archive (4000/1)
Reporter	NDA0E
Tags:	apk IRATA signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

269

Origin country :

NL

Vendor Threat Intelligence

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/66a7e2bf78d5c73fb1c8b767/reports/abff529d-dbf8-400f-a4ed-f222bfc32bf8/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/2191424ce72d4b1bbe55fa317b44eee2/detail

Application Permissions

read SMS or MMS (READ_SMS)

receive SMS (RECEIVE_SMS)

send SMS messages (SEND_SMS)

full Internet access (INTERNET)

control vibrator (VIBRATE)

prevent phone from sleeping (WAKE_LOCK)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/67530f6cc30ac3dc55717a8ff276b588acbd8849fbd79e821bca9727c20c249a

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/67530f6cc30ac3dc55717a8ff276b588acbd8849fbd79e821bca9727c20c249a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/67530f6cc30ac3dc55717a8ff276b588acbd8849fbd79e821bca9727c20c249a/

ReversingLabs TitaniumCloud Android.Trojan.Casdet

Threat name:

Android.Trojan.Casdet

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-07-29 18:43:13 UTC

File Type:

Binary (Archive)

Extracted files:

80

AV detection:

6 of 23 (26.09%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m5jq63gdblb5yvlrpkh7e5vvrcwl3ccj7plz5aq3zklspqqmesna._file

Hatching Triage irata

Result

Malware family:

irata

Alert

Create hunting rule

Score:

  10/10

Tags:

family:irata android collection credential_access discovery impact persistence

Link:

https://tria.ge/reports/240729-xcw86ayclg/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Acquires the wake lock

Queries the mobile country code (MCC)

Reads information about phone network operator.

Obtains sensitive information copied to the device clipboard

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/67530f6cc30ac3dc55717a8ff276b588acbd8849fbd79e821bca9727c20c249a