MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de
SHA3-384 hash:	cb45f120f7d1d40a8a617f15ae60af4a84d78ebda753f8ba1b56256f936db766ed48431c74d8d043d4bd60a36140439e
SHA1 hash:	5279fd993849c4fbbdaa77a8c47141435bc926b5
MD5 hash:	bb9a56271c22d2090914f6a5b2917a01
humanhash:	july-ten-coffee-wisconsin
File name:	client.apk
Download:	download sample
Signature	SpyNote Alert Create hunting rule
File size:	778'721 bytes
First seen:	2025-12-23 17:38:53 UTC
Last seen:	Never
File type:	apk
MIME type:	application/java-archive
ssdeep	12288:40YZa1a8LdefjbLLP7SU+5WmpYshXZPbGwidNpge:Ga1a6efTLTSU+5WmD9idNpZ
TLSH	T1A2F45C86FB5AF867C9F3C7364275C6AA96064C544B43E7431A85763C0DBBAC08B49FC8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Spynote

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

54

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Backdoor.791.origin.21864.12548.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android base64 evasive fingerprint persistence signed

Link:

https://www.filescan.io/uploads/694ad3c93f8fdbf8e9503e7b/reports/cf619fff-5fb5-4219-88d1-5fb9a903eba9/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/bb9a56271c22d2090914f6a5b2917a01/detail

Application Permissions

take pictures and videos (CAMERA)

read external storage contents (READ_EXTERNAL_STORAGE)

read Browser's history and bookmarks (READ_HISTORY_BOOKMARKS)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

list accounts (GET_ACCOUNTS)

write contact data (WRITE_CONTACTS)

read contact data (READ_CONTACTS)

record audio (RECORD_AUDIO)

read SMS or MMS (READ_SMS)

read phone state and identity (READ_PHONE_STATE)

directly call phone numbers (CALL_PHONE)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

fine (GPS) location (ACCESS_FINE_LOCATION)

receive SMS (RECEIVE_SMS)

retrieve running applications (GET_TASKS)

intercept outgoing calls (PROCESS_OUTGOING_CALLS)

modify global system settings (WRITE_SETTINGS)

control flashlight (FLASHLIGHT)

create Bluetooth connections (BLUETOOTH)

set wallpaper (SET_WALLPAPER)

set wallpaper size hints (SET_WALLPAPER_HINTS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

kill background processes (KILL_BACKGROUND_PROCESSES)

control vibrator (VIBRATE)

prevent phone from sleeping (WAKE_LOCK)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

full Internet access (INTERNET)

show app notification (READ_APP_BADGE)

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2025-12-14T20:05:00Z UTC

Last seen:

2025-12-16T05:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de/

ReversingLabs TitaniumCloud Android.Trojan.Tripoli

Threat name:

Android.Trojan.Tripoli

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-15 02:55:22 UTC

File Type:

Binary (Archive)

Extracted files:

431

AV detection:

21 of 36 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pjcjukjpesmhgtrcvj7uhbl73igtj6azcd73rkc42z46xhbwstpa._file

Hatching Triage spynote

Result

Malware family:

spynote

Alert

Create hunting rule

Score:

  10/10

Tags:

family:spynote android banker defense_evasion discovery persistence

Link:

https://tria.ge/reports/251223-v8fvyaykcw/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Malware Config

C2 Extraction:

91.207.174.14:8848

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/445237c6-0dca-4dde-80e5-16a6c8d23e0e

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.49

Link:

https://yomi.yoroi.company/submissions/7a449a292f2498734e22aa7f43857fda0d34f81910ffb8a85cd679eb9c3694de