MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206
SHA3-384 hash:	8464386cf5d3602fa675439f01bfe44f9eabe6137d7c924a2ddc5be49c2dfd9d83695032a339c875d838ba26ad086a2d
SHA1 hash:	8174e291207585af1039a380462081ef4aedb94b
MD5 hash:	bb00300b23a5ccc662ee263f9b30a96e
humanhash:	speaker-kitten-cup-london
File name:	youtubeultra.apk
Download:	download sample
Signature	ClayRAT Alert Create hunting rule
File size:	2'589'468 bytes
First seen:	2025-11-25 07:47:06 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:O9asRnzxdIB48VdfExSBmaJZGLiF+WHkSFsAVAswgAk3qE:wasx7Ia0dhEaJIuIWlsAVAZk3qE
TLSH	T123C5BD46FB0A99BEC4FB13320A3612611167CD268B83D6936D6C733C69B75C85F29EC4
TrID	46.2% (.VYM) VYM Mind Map (12500/1/3) 38.8% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 14.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	juroots
Tags:	apk ClayRat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

80

Origin country :

IL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.Mamont.105.20775.19923.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

android expand lolbin signed

Link:

https://www.filescan.io/uploads/69255f1fdeea95d50b2690b1/reports/123cbea8-8749-4193-a411-fced54ad66c9/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/bb00300b23a5ccc662ee263f9b30a96e/detail

Application Permissions

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

edit SMS or MMS (WRITE_SMS)

receive WAP (RECEIVE_WAP_PUSH)

read phone state and identity (READ_PHONE_STATE)

directly call phone numbers (CALL_PHONE)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read contact data (READ_CONTACTS)

take pictures and videos (CAMERA)

modify global system settings (WRITE_SETTINGS)

full Internet access (INTERNET)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

view network status (ACCESS_NETWORK_STATE)

prevent phone from sleeping (WAKE_LOCK)

show app notification (READ_APP_BADGE)

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2025-11-25T03:17:00Z UTC

Last seen:

2025-11-26T14:59:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206/

ReversingLabs TitaniumCloud Android.Trojan.AVerseFalc

Threat name:

Android.Trojan.AVerseFalc

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-25 07:49:01 UTC

File Type:

Binary (Archive)

Extracted files:

557

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ocaqbo57vnjn2qazxvk3k2shlipbbywcondyvpuoa7bwhu2cyida._file

Hatching Triage clayrat

Result

Malware family:

clayrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:clayrat android banker collection credential_access defense_evasion discovery evasion impact infostealer persistence rat trojan

Link:

https://tria.ge/reports/251125-jm7wraan3x/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Requests changing the default SMS application.

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

ClayRat

Clayrat family

Detects ClayRat payload

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/c106da33-d58f-4df2-b7be-8fbd06409c7d

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/708100bbbfab52dd4019bd55b56a475a1e10e2c273478abe8e07c363d342c206