🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 727a5c98dfb4546dbfa18b910ebea584fd4a22eb2c82e9bc9f351163a549f8da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 727a5c98dfb4546dbfa18b910ebea584fd4a22eb2c82e9bc9f351163a549f8da
SHA3-384 hash: 6a59cec0752c8a661ce5a37dfac387acf7e2c0c0dfb93f632814ae43721eac7a45cc558cc4ca6e26de693f8f23afbae7
SHA1 hash: 9da10b53d7b433b239d40912fc07f018c5e97530
MD5 hash: 358ef2769a2438b05d9c1f31c6cbde1f
humanhash: north-muppet-maryland-black
File name:Mou_Shtrafy.apk
Download: download sample
File size:7'745'666 bytes
First seen:2026-11-14 10:31:05 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 196608:ch6hDRkXqmvqhW9Sc02ITjebNBcME8VarYRo/dBZ:USDqX/qs9ZbhbfcMR0zBZ
TLSH T1547612261B096A02C43E5A7709E60BD373796F4A0742C71B16B9B1787FF36E18F41BA1
TrID 49.0% (.APK) Android Package (27000/1/5)
24.5% (.JAR) Java Archive (13500/1/2)
19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter Parper
Tags:apk

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sandbox detection
Threat detection based on machine learning
Suspiciously corrupted
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
base64 signed
Link:
https://www.filescan.io/uploads/6af838f2916e23dfc29d3ed7/reports/ade4dcf7-d838-4f15-9a5e-8f0f521f4565/overview
Result
Link:
https://incinerator.cloud/#/public/report/358ef2769a2438b05d9c1f31c6cbde1f/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
full Internet access (INTERNET)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
prevent phone from sleeping (WAKE_LOCK)
measure application storage space (GET_PACKAGE_SIZE)
reorder applications running (REORDER_TASKS)
write sync settings (WRITE_SYNC_SETTINGS)
expand/collapse status bar (EXPAND_STATUS_BAR)
control Near-Field Communication (NFC)
control vibrator (VIBRATE)
set wallpaper size hints (SET_WALLPAPER_HINTS)
kill background processes (RESTART_PACKAGES)
read sync statistics (READ_SYNC_STATS)
set wallpaper (SET_WALLPAPER)
change your audio settings (MODIFY_AUDIO_SETTINGS)
control flashlight (FLASHLIGHT)
read sync settings (READ_SYNC_SETTINGS)
send sticky broadcast (BROADCAST_STICKY)
allow Wi-Fi Multicast reception (CHANGE_WIFI_MULTICAST_STATE)
Verdict:
Malicious
File Type:
apk
Detections:
HEUR:Trojan-Dropper.AndroidOS.Creduz.t
Link:
https://opentip.kaspersky.com/727a5c98dfb4546dbfa18b910ebea584fd4a22eb2c82e9bc9f351163a549f8da/results?tab=lookup
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/727a5c98dfb4546dbfa18b910ebea584fd4a22eb2c82e9bc9f351163a549f8da/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-11-14 10:32:16 UTC
File Type:
Binary (Archive)
Extracted files:
2161
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oj5fzgg7wrkg3p5broiq5pvfqt6uuixlfsbotpe7guiwhjkj7dna._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
android banker collection credential_access defense_evasion discovery impact persistence
Link:
https://tria.ge/reports/261114-mkfw2afx5s/
Behaviour
Checks CPU information
Checks memory information
Registers a broadcast receiver at runtime (usually for listening for system events)
Checks the presence of a debugger
Queries the mobile country code (MCC)
Obtains sensitive information copied to the device clipboard
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
SUSP_APK_No_Launcher_Activity_Apr_08
Link:
https://app.threat.zone/submission/b09cbc73-ef76-4f25-a348-52b97c87dafb
Malware Family:
badpack
Create hunting rule
Malicious:
True
Tags:
apk android
Link:
https://intel.virussign.com/intelligence/file/727a5c98dfb4546dbfa18b910ebea584fd4a22eb2c82e9bc9f351163a549f8da
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments