MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ab4bc237f26eae67f6a2d4e0c5955890b0cca0c941a31c3696a6211eae72d039. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | ab4bc237f26eae67f6a2d4e0c5955890b0cca0c941a31c3696a6211eae72d039 |
|---|---|
| SHA3-384 hash: | d782a3e076f8e75c65931db434ec85e4fe7808b2d9e00dc5b59639a5ef1b4ed9767755299e064c62f013c90c34d7d0f6 |
| SHA1 hash: | 0677edb59f89372bacfc6619467c0c592b56c81e |
| MD5 hash: | 684bccf58e8859f27a64a65d02cdc0e4 |
| humanhash: | equal-wisconsin-texas-edward |
| File name: | ab4bc237f26eae67.bin |
| Download: | download sample |
| File size: | 4'742'626 bytes |
| First seen: | 2026-10-03 20:23:16 UTC |
| Last seen: | Never |
| File type: | apk |
| MIME type: | application/vnd.android.package-archive |
| ssdeep | 98304:Y5kUwmYXASfCAg9Kvo7StOKEWg0KGgc/Y4tCaXTc4Mkl3p:Y5nwnfC/4t0JtGO44aDRp |
| TLSH | T19226230D68EF6110DB7164779AAA20054EDE4F88977BC075C3DD29DAA7BF0882F3D1A4 |
| TrID | 60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | apk |
| Reporter |  whack_sh |
| Tags: | apk signed zip |
Code Signing Certificate
| Organisation: | |
|---|---|
| Issuer: | |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2017-12-02T08:49:52Z |
| Valid to: | 2042-11-26T08:49:52Z |
| Serial number: | 675b171b |
| Intelligence: | 3 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | eea324cf335f92ef4d5d9812f6104ca9972f1a60c985ed579d09b24d149b347c |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
100
Origin country :
USVendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
masquerade signed
Result
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
view Wi-Fi status (ACCESS_WIFI_STATE)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
prevent phone from sleeping (WAKE_LOCK)
control vibrator (VIBRATE)
measure application storage space (GET_PACKAGE_SIZE)
read sync statistics (READ_SYNC_STATS)
allow Wi-Fi Multicast reception (CHANGE_WIFI_MULTICAST_STATE)
expand/collapse status bar (EXPAND_STATUS_BAR)
write sync settings (WRITE_SYNC_SETTINGS)
read sync settings (READ_SYNC_SETTINGS)
set wallpaper (SET_WALLPAPER)
send sticky broadcast (BROADCAST_STICKY)
reorder applications running (REORDER_TASKS)
change your audio settings (MODIFY_AUDIO_SETTINGS)
control flashlight (FLASHLIGHT)
kill background processes (RESTART_PACKAGES)
set wallpaper size hints (SET_WALLPAPER_HINTS)
control Near-Field Communication (NFC)
change Wi-Fi status (CHANGE_WIFI_STATE)
allow use of fingerprint (USE_FINGERPRINT)
change your UI settings (CHANGE_CONFIGURATION)
Verdict:
Malicious
File Type:
apk
First seen:
2026-09-04T14:03:00Z UTC
Last seen:
2026-10-04T18:31:00Z UTC
Hits:
~10
Score:
56%
Verdict:
Susipicious
File Type:
APK
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
7/10
Tags:
android banker collection credential_access defense_evasion discovery evasion impact persistence
Behaviour
Checks CPU information
Checks memory information
Checks the application is allowed to request package installs through the package installer
Declares services with permission to bind to the system
Makes use of the framework's foreground persistence service
Requests dangerous framework permissions
Loads dropped Dex/Jar
Obtains sensitive information copied to the device clipboard
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | elf_arm_mips_ko_so |
|---|
| Rule name: | Jeevan_Malware_Rewards |
|---|---|
| Author: | ShriTiger |
| Description: | Detects JeevanReward variants using Technical, Anti-Analysis, and Indian SE keywords |
| Rule name: | MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3 |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects RemcosRAT (inconnu, etat binaire) |
| Rule name: | unixredflags3 |
|---|---|
| Author: | Tim Brown @timb_machine |
| Description: | Hunts for UNIX red flags |
| Rule name: | Warp |
|---|---|
| Author: | Seth Hardy |
| Description: | Warp |
| Rule name: | WarpStrings |
|---|---|
| Author: | Seth Hardy |
| Description: | Warp Identifying Strings |
| Rule name: | ZeroDay_Native_AntiAnalysis |
|---|---|
| Author: | CyberStrike |
| Description: | ZeroDay dropper native library - anti-emulator and anti-frida checks |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
apk ab4bc237f26eae67f6a2d4e0c5955890b0cca0c941a31c3696a6211eae72d039
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.