MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95daed761fda53bc7acdce7b880c1cb661bf75988084914e0958d33314768fa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	95daed761fda53bc7acdce7b880c1cb661bf75988084914e0958d33314768fa1
SHA3-384 hash:	81da27a21fdc26f1f34df30a8b921cc982a7e867f1882cb33b359fbc42d3527fe46dae4c177a63b244c497dea087db40
SHA1 hash:	7bca3dcf78d1fac90dc140d12a80fa95a9a60d1b
MD5 hash:	24142fc156fb6816a3d7a0f7c6e3a3cf
humanhash:	zebra-connecticut-uranus-yellow
File name:	ed.apk
Download:	download sample
Signature	IRATA Alert Create hunting rule
File size:	2'912'426 bytes
First seen:	2023-09-04 09:34:10 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:UKFucmXlLr9Iml8aY7PTNDLARYX8hojPml+5RA:bucAlLJ92aY7PTNXARAvjPmlZ
TLSH	T11ED52353F7B6DA2BC831C03A6588973122574D08D643EBC7695833FA74BB9E80F862D5
TrID	63.7% (.APK) Android Package (32500/1/6) 26.4% (.JAR) Java Archive (13500/1/2) 7.8% (.ZIP) ZIP compressed archive (4000/1) 1.9% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	onecert_ir
Tags:	android apk IRATA signed

onecert_ir

IRATA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

156

Origin country :

NL

Vendor Threat Intelligence

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/64f5a4c84578d9c35e013470/reports/a7416d04-254b-42c2-9fc1-ec45b0a2fe82/overview

Incinerator Legit

Result

Link:

https://incinerator.cloud/#/public/report/24142fc156fb6816a3d7a0f7c6e3a3cf/detail

Application Permissions

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/95daed761fda53bc7acdce7b880c1cb661bf75988084914e0958d33314768fa1

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.spyw.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1302789

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Removes its application launcher (likely to stay hidden)

Uploads sensitive phone information to the internet (privacy leak)

Uses the command line tool ping to scan for other devices in the same network

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95daed761fda53bc7acdce7b880c1cb661bf75988084914e0958d33314768fa1/

ReversingLabs TitaniumCloud Android.Spyware.Generic

Threat name:

Android.Spyware.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-09-04 09:35:07 UTC

File Type:

Binary (Archive)

Extracted files:

135

AV detection:

7 of 24 (29.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sxno25q73jj3y6wnzz5yqda4wzq365myqccjctqjldjtgfdwr6qq._file

Hatching Triage irata

Result

Malware family:

irata

Alert

Create hunting rule

Score:

  10/10

Tags:

family:irata android

Link:

https://tria.ge/reports/230904-lkcc6sfb31/

Behaviour

Reads information about phone network operator.

Acquires the wake lock.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/95daed761fda53bc7acdce7b880c1cb661bf75988084914e0958d33314768fa1