MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4
SHA3-384 hash:	31bd6659c31218b404c0ae9c82ff3b29f3d466ea1808946f02da78af94278bc948c04afe9e6624e30c2d304f26ce96ab
SHA1 hash:	a4c701f9a4cb0926b5461965f426887ac09450c6
MD5 hash:	6afd1e9c4c4e7a4a71c0202c21e2a6d1
humanhash:	don-alabama-five-juliet
File name:	Chrome.apk
Download:	download sample
Signature	BankBot Alert Create hunting rule
File size:	2'441'463 bytes
First seen:	2026-03-24 14:05:56 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:HkcaH2THvo91hLMCjXfZHBUJacfZe9lLh+hQi98cy5O:ExlfICTlIa8M9lt+aK65O
TLSH	T156B5F045BBA89F0EC877D1360C4A5232641AED23CB53C387D9746B5928AF6F44F113EA
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	CyberMAN_noBODY
Tags:	apk BankBot banker dropper signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

334

Origin country :

TR

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Unix.Dropper.Fakeapp-10014994-0

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand lolbin obfuscated signed soft-404

Link:

https://www.filescan.io/uploads/69c29a5a256cd88a6aae41ce/reports/367b6812-e846-4f03-93af-454ba27a174b/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/6afd1e9c4c4e7a4a71c0202c21e2a6d1/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

display system-level alerts (SYSTEM_ALERT_WINDOW)

full Internet access (INTERNET)

prevent phone from sleeping (WAKE_LOCK)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4/results?tab=lookup

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4/

ReversingLabs TitaniumCloud Android.Infostealer.Anubis

Threat name:

Android.Infostealer.Anubis

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-24 14:06:23 UTC

File Type:

Binary (Archive)

Extracted files:

193

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qftn7ot72c2k2rgixsi4yduy7idlrejoh7fcbe4qb22yxj45elka._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

android defense_evasion

Link:

https://tria.ge/reports/260324-rej4qahz3y/

Behaviour

Checks the application is allowed to request package installs through the package installer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8166dfba7fd0b4ad44c8bc91cc0e98fa06b8912e3fca2093900eb58ba79d22d4