MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5
SHA3-384 hash:	a18d7b62133c1d05092fe37da3e419c869a75da16059a1ec97e8ba5b43ec343d239839564dcefb6f29853e9e7d638d52
SHA1 hash:	0a7503dbc5296d1cb559404bb857a98aea77aef7
MD5 hash:	6bbcd6701ac11e90a1bb20f31b1215c1
humanhash:	four-indigo-tennis-happy
File name:	9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5.apk
Download:	download sample
Signature	PixRevolution Alert Create hunting rule
File size:	12'503'895 bytes
First seen:	2026-05-29 15:58:03 UTC
Last seen:	2026-05-29 16:10:00 UTC
File type:	apk
MIME type:	application/zip
ssdeep	196608:JRveC75GmFAEeLuf8jYdkT825zgcnnY+rc1OYV8+ZpBCXJgDXnvyTs8cM:JRveQ5rFzeZ3YAztlr8NHtVnvyf
TLSH	T1C7C62345F7D89E2ECC7340364F6B673655496D63C74AC243C978325C28BBAE48E81BE8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	johnk3r
Tags:	apk banker PixRevolution signed

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

228

Origin country :

BR

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

base64 evasive expand lolbin obfuscated signed

Link:

https://www.filescan.io/uploads/6a19b7a512da0d249c5d92ca/reports/0bdeab65-89ea-4b9e-84b0-8dea71003667/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/6bbcd6701ac11e90a1bb20f31b1215c1/detail

Application Permissions

display system-level alerts (SYSTEM_ALERT_WINDOW)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

prevent phone from sleeping (WAKE_LOCK)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-01-24T06:06:00Z UTC

Last seen:

2026-05-30T14:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5/results?tab=lookup

Nucleon Malprob Susipicious

Score:

70%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5/

ReversingLabs TitaniumCloud Android.Trojan.Multiverze

Threat name:

Android.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-01 11:07:16 UTC

File Type:

Binary (Archive)

Extracted files:

463

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t7x5fsba7munkc6flqzsbfsggxzh6gtuvse57rno3c3nliezqd2q._file

Hatching Triage pixrevolution

Result

Malware family:

pixrevolution

Alert

Create hunting rule

Score:

  10/10

Tags:

family:pixrevolution android collection credential_access defense_evasion impact persistence trojan

Link:

https://tria.ge/reports/260529-teqmlsh14j/

Behaviour

Checks CPU information

Checks memory information

Acquires the wake lock

Looks up external IP address via web service

Makes use of the framework's foreground persistence service

Checks known Qemu files.

Checks known Qemu pipes.

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Checks if the Android device is rooted.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9fefd2c820fb28d50bc55c3320964635f27f1a74ac89dfc5aed8b6d5a09980f5