MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e39fb18e8acb2e4fc4bcd7db2efc320f5ec84100e8ba870fd24dd13a6584277. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PixRevolution

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	8e39fb18e8acb2e4fc4bcd7db2efc320f5ec84100e8ba870fd24dd13a6584277
SHA3-384 hash:	3dd4ae3318f3640c07cf24f4f9f476201f1bdc34dd450bb8916abc4ca5264b8a2fbcf13acd8a9b54afd6e36b9c4beb30
SHA1 hash:	e31cdb45807b9a31a5d4ff48d79ade5b1c903f61
MD5 hash:	997bc622fcd485158673b680e7ad9d30
humanhash:	fish-river-spaghetti-tennis
File name:	8e39fb18e8acb2e4fc4bcd7db2efc320f5ec84100e8ba870fd24dd13a6584277.apk
Download:	download sample
Signature	PixRevolution Create hunting rule
File size:	15'976'693 bytes
First seen:	2026-05-30 16:37:57 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	393216:8+e3AnLK/P7LavGbOhUydNfRj0HbqEww/FlvYPO+yl:3K3SGiN7Zj0Hb3D/r0O+s
TLSH	T13BF63305BB989E1EC07781364D4A6232624E9D57C762C387E924324D3CB3AF84FD97E9
TrID	48.2% (.JAR) Java Archive (13500/1/2) 37.5% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 14.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	johnk3r
Tags:	200-9-154-125 apk banker PixRevolution signed

Code Signing Certificate

Organisation:	Android
Issuer:	Android
Algorithm:	sha1WithRSAEncryption
Valid from:	2008-02-29T01:33:46Z
Valid to:	2035-07-17T01:33:46Z
Serial number:	936eacbe07f201df
Intelligence:	1802 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

156

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expand invalid-signature lolbin signed

Link:

https://www.filescan.io/uploads/6a1b127d099ef368af0fea6c/reports/c59cbf3f-76da-4d7d-a892-c76b2a81b922/overview

Result

Link:

https://incinerator.cloud/#/public/report/997bc622fcd485158673b680e7ad9d30/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

Verdict:

Malicious

File Type:

apk

First seen:

2026-05-30T03:18:00Z UTC

Last seen:

2026-05-31T23:44:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8e39fb18e8acb2e4fc4bcd7db2efc320f5ec84100e8ba870fd24dd13a6584277/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8e39fb18e8acb2e4fc4bcd7db2efc320f5ec84100e8ba870fd24dd13a6584277/

Threat name:

Android.Trojan.Generic

Status:

Suspicious

First seen:

2026-05-30 02:12:34 UTC

File Type:

Binary (Archive)

Extracted files:

917

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ry47wghivszoj7clzv63f36ded26zbaqb2f2q4h5etorhjsyij3q._file

Result

Malware family:

pixrevolution

Score:

10/10

Tags:

family:pixrevolution android collection credential_access defense_evasion impact persistence trojan

Link:

https://tria.ge/reports/260530-t5hppah15z/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8e39fb18e8acb2e4fc4bcd7db2efc320f5ec84100e8ba870fd24dd13a6584277

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.