MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c
SHA3-384 hash:	0892d207bc5f40fa9398502b65958be6d38c6a95ef411a7a67209546b8583bc966d381d859d6b7fb440c7f7c522ccf5e
SHA1 hash:	6bbaf2fb4401396650c87003c4e67ebf018043a6
MD5 hash:	9a070af9d54ba7f1e8a3618746889906
humanhash:	green-idaho-shade-hydrogen
File name:	ai.apk
Download:	download sample
File size:	5'054'231 bytes
First seen:	2025-11-27 09:07:38 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:sUyiIEAEZpdaNwgW6gCH8An6vZ4F9lB4hSu+4ES+ikI4oM4PPzwJhSe:sUyAAKpd0X6B4TE94344Se
TLSH	T1B1361257EB49E656E0F7C63A8376076396250C988343E3931A49B22C1DF7FC09686FC9
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	juroots
Tags:	apk

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

36

Origin country :

IL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.FileRepMalware.52461827.UNOFFICIAL

Alert

Create hunting rule

InQuest SUSPICIOUS

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

apk

Link:

https://opentip.kaspersky.com/6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nmmfksutzyzvjmpmquzeq6nzansf44hcfbs6lrbsf5vecjx46b6a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

android collection credential_access defense_evasion discovery evasion impact

Link:

https://tria.ge/reports/251127-k4b13stpbt/

Behaviour

Checks CPU information

Checks memory information

Uses Crypto APIs (Might try to encrypt user data)

Queries information about active data network

Checks Android system properties for emulator presence.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Checks if the Android device is rooted.

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/632dcd52-ec59-4724-88d5-45978451a408

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c