MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SpyLoan


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19
SHA3-384 hash: 5ae42b946f3b6494eb4d83bf7c2746cc24df1ecd5304b3612fd9393755864566ae3b4499f9fe2fef535a5a0ff361bbf1
SHA1 hash: 49542884183512681bef079d5c14f5a330600e17
MD5 hash: c8a51b8a7083850cee63e28add7688be
humanhash: eighteen-delta-alanine-neptune
File name:np001_1.2.4_17706218.apk
Download: download sample
Signature SpyLoan
Create hunting rule
File size:27'436'503 bytes
First seen:2025-11-22 11:16:01 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 786432:5EPyyxy3WUzRKfhyvY9TxnHjz7vAMBOIZBlvxgb:mNY2yA9TxnDwMB5ZPv2b
TLSH T162573397F729883FD5B616B38D6A013237729E0186826B173A48772C2D7365E4F89FC4
TrID 39.9% (.APK) Android Package (27000/1/5)
19.9% (.JAR) Java Archive (13500/1/2)
15.5% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
9.6% (.GL) GRASP animation (6508/7/3)
8.8% (.KMZ) Google Earth saved working session (6000/1/1)
Magika apk
Reporter juroots
Tags:apk signed SpyLoan

Code Signing Certificate

Organisation:Your Name
Issuer:Your Name
Algorithm:sha256WithRSAEncryption
Valid from:2025-10-21T03:59:08Z
Valid to:2050-10-15T03:59:08Z
Serial number: c0cfdbf46538cf8e
Thumbprint Algorithm:SHA256
Thumbprint: b98fbcc7ccb1e92811e07f0961aeaae7e34e8dfbbe605eb5ffe6cb64010d6d85
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
RO RO
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 crypto evasive fingerprint signed
Link:
https://www.filescan.io/uploads/69219c90eecb08e4aa44a770/reports/d56e3f34-b6cd-441b-b178-d28cc0da635c/overview
Result
Link:
https://incinerator.cloud/#/public/report/c8a51b8a7083850cee63e28add7688be/detail
Application Permissions
read external storage contents (READ_EXTERNAL_STORAGE)
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
read phone state and identity (READ_PHONE_STATE)
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
take pictures and videos (CAMERA)
mount and unmount file systems (MOUNT_UNMOUNT_FILESYSTEMS)
display system-level alerts (SYSTEM_ALERT_WINDOW)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
view Wi-Fi status (ACCESS_WIFI_STATE)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19
Verdict:
Unknown
File Type:
apk
First seen:
2025-11-22T13:17:00Z UTC
Last seen:
2025-11-22T21:55:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19/results?tab=lookup
Score:
26%
Verdict:
Benign
File Type:
APK
Link:
https://malprob.io/report/7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19
Gathering data
Threat name:
Android.PUA.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-22 11:19:28 UTC
File Type:
Binary (Archive)
Extracted files:
2247
AV detection:
5 of 24 (20.83%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pjotdvcpq5svh2fxtqlsp2aqhfxfnojyrazgmz6qpqhvsc3kdimq._file
Result
Malware family:
spyloan
Create hunting rule
Score:
  10/10
Tags:
family:spyloan android discovery impact infostealer spyware trojan
Link:
https://tria.ge/reports/251122-ngrpss1mhn/
Behaviour
Checks memory information
Uses Crypto APIs (Might try to encrypt user data)
Queries information about active data network
Reads information about phone network operator.
SpyLoan
Spyloan family
Malware Config
C2 Extraction:
https://GNc.j3b4m3g8.work
https://dverv43.q4w9l6g3w.work/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/96ef09df-03da-4948-9aec-35a1bc371945
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SpyLoan

apk 7a5d31d44f876553e8b79c1727e810396e56b93888326667d07c0f590b6a1a19

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3714102/
  
Delivery method
Distributed via web download

Comments