MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Joker


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d
SHA3-384 hash: 498cd4d61cfc1f7e2bc41a86998c3f97e77af37b6fcd347708a422455a6ebcdda2b94ea9b5defe460a5920c63b73a873
SHA1 hash: 0b78ba3c809f8d9fc8410a72b94eb25bada4d9c7
MD5 hash: 16f2759a7703c54ac5d51ab31334293d
humanhash: football-kentucky-skylark-south
File name:Magical+Camera_1.0.1.xapk
Download: download sample
Signature Joker
Create hunting rule
File size:14'080'387 bytes
First seen:2025-12-24 14:00:04 UTC
Last seen:Never
File type: xapk
MIME type:application/zip
ssdeep 393216:y6ss0u9becYHiluMJylj/72+sPJBMAdATiJnQ:y5svK0l5Jaa+stYCQ
TLSH T129E601AAFF0CF92BC47A5072CA56A133B16B9E215E0296F37808731874B35E84F55BC5
TrID 35.2% (.SPE) SPSS Extension (30000/1/7)
31.7% (.APK) Android Package (27000/1/5)
15.8% (.JAR) Java Archive (13500/1/2)
12.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
4.7% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter Anonymous
Tags:joker malware xapk

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
JP JP
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694bf21901c7b4a8fe554ac6
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint obfuscated signed
Link:
https://www.filescan.io/uploads/694bf20be126b9ff438ff988/reports/f0f1e596-fa0c-4c6c-88dd-336f5cb0fffa/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d/results?tab=lookup
Score:
72%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nq24e45r2mxo7dbwvnmnfayhn5tapkyqgpzvlbpdr4cjf7jfubgq._file
Result
Malware family:
antidot
Create hunting rule
Score:
  10/10
Tags:
family:antidot android
Link:
https://tria.ge/reports/251224-rbhfqaex7a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/6c35c273b1d32eef8c36ab58d283076f6607ab1033f35585e38f0492fd25a04d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:SUSP_ZIP_Smuggling_Jun01
Create hunting rule
Author:delivr.to
Description:ZIP archives with data smuggled between last file record and the central directory.
Reference:https://github.com/Octoberfest7/zip_smuggling/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://play.google.com/store/apps/details?id=com.iodine.formed.camera

Comments