MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 92d605cf12194302820a7e71e368690217e5ffc2bacf808084616ece5b89bfc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 92d605cf12194302820a7e71e368690217e5ffc2bacf808084616ece5b89bfc2 |
|---|---|
| SHA3-384 hash: | 8afda36389875e95bc42424d9c1e57bf2ceba662fd9ea45251352311e7c320e38b819344b62f78ff68d17ba89bd484f6 |
| SHA1 hash: | 36763e99e82972699feb3042e1e56dd081861806 |
| MD5 hash: | 33e83defff884eefa65a9c2b6e4072e5 |
| humanhash: | shade-island-robert-vegan |
| File name: | 33e83defff884eefa65a9c2b6e4072e5.apk |
| Download: | download sample |
| File size: | 1'234'175 bytes |
| First seen: | 2026-08-21 07:18:27 UTC |
| Last seen: | Never |
| File type: | apk |
| MIME type: | application/zip |
| ssdeep | 24576:I308+UUsDyS9NMIMy+LIMgtm387Jymzgd1bRojm3:fdWzMIMyAgQ3Awdd1bqjm3 |
| TLSH | T1C445123EE71CD126E81BF339E135188F040C0485AA59FA6A1A65D55CCEFFCE4D688BB4 |
| TrID | 60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | apk |
| Reporter |  myonium1 |
| Tags: | Android malware apk signed |
Code Signing Certificate
| Organisation: | Android |
|---|---|
| Issuer: | Android |
| Algorithm: | sha1WithRSAEncryption |
| Valid from: | 2008-02-29T01:33:46Z |
| Valid to: | 2035-07-17T01:33:46Z |
| Serial number: | 936eacbe07f201df |
| Intelligence: | 1868 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
224
Origin country :
CHVendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
bankingtrojan base64 crypto evasive fingerprint invalid-signature persistence signed
Result
Application Permissions
read SMS or MMS (READ_SMS)
receive SMS (RECEIVE_SMS)
send SMS messages (SEND_SMS)
receive MMS (RECEIVE_MMS)
read phone state and identity (READ_PHONE_STATE)
read contact data (READ_CONTACTS)
directly call phone numbers (CALL_PHONE)
full Internet access (INTERNET)
control vibrator (VIBRATE)
prevent phone from sleeping (WAKE_LOCK)
view network status (ACCESS_NETWORK_STATE)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
send SMS-received broadcast (BROADCAST_SMS)
Score:
100%
Verdict:
Malware
File Type:
APK
Threat name:
Android.Infostealer.Banbra
Status:
Suspicious
First seen:
2026-08-21 07:19:23 UTC
File Type:
Binary (Archive)
Extracted files:
315
AV detection:
9 of 24 (37.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
6/10
Tags:
android
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.Here is the full reverse engineering report and configuration extraction for this sample: https://github.com/CtxtArc/malware-analysis/tree/main/92d605cf12194302820a7e71e368690217e5ffc2bacf808084616ece5b89bfc2 .
Key findings from the analysis:
Execution Chain: Android application bootstrap → social-engineered permission/role acquisition → persistent foreground service → Telegram polling C2.
Persistence: Uses multiple independent persistence and resurrection mechanisms, including BOOT_COMPLETED, MY_PACKAGE_REPLACED, exact AlarmManager timers, foreground services, WorkManager, WakeLock, screen/unlock receivers, and SMS-triggered service restarts.
SMS & Call Interception: Incoming SMS messages are captured and forwarded to the attacker's Telegram infrastructure. Incoming caller numbers are also recorded and reported to the C2.
Notification Theft & Suppression: A NotificationListenerService cancels notifications immediately after they are posted, while extracting their application name and text. This allows the malware to steal OTP/push-notification content while preventing the victim from seeing it.
Remote Control: The Telegram C2 supports remote SMS sending, USSD requests, installed-application enumeration, device online-status reporting, credential refresh, and remote self-destruct functionality.
Credential Protection: Telegram bot credentials are AES-CBC encrypted in SharedPreferences. The encryption key is reconstructed by the native libsec-lib.so library and was successfully recovered through native reverse engineering.
Targeting: The malware fingerprints installed applications, with particular interest in Russian banking, government, cryptocurrency, e-commerce, social-media, mail, taxi, and delivery applications.
Self-Destruct: The malware monitors for revocation of READ_SMS; when detected, it alerts the C2, sets a persistent self_destructed flag, terminates its execution paths, and prevents future service restarts.
Infrastructure / Attribution: The recovered configuration exposed an operational Telegram bot and attacker-controlled Telegram infrastructure associated with the sample.
IOCs & Artifacts: The analysis includes the package name, C2 infrastructure, native library, encrypted credential locations, SharedPreferences keys, notification channel, service/alarm identifiers, WorkManager tags, log tags, and relevant Android broadcast actions.
Unreversed Components: TelegramPollingService.c(), several coroutine state machines, AutoReportWorker, portions of MainActivity, and additional /radar_* command branches remain partially unresolved and are documented with recommended next steps for further Smali/dynamic analysis.