🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NGate


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26
SHA3-384 hash: 76c7460efb8c817fc9b8d8f81daa861db541efab64530ab4e9ae6a58216d7300b1fb4d2cfad5c61a9dd1bc1b89be9e1e
SHA1 hash: 0347b72049efa083d1d4e975e54351d79a7ec125
MD5 hash: ff66b7477103ea6996277207b7e95f3e
humanhash: cup-autumn-alabama-colorado
File name:b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26.apk
Download: download sample
Signature NGate
Create hunting rule
File size:13'837'819 bytes
First seen:2026-11-02 22:20:32 UTC
Last seen:Never
File type: apk
MIME type:application/vnd.android.package-archive
ssdeep 393216:vR8dbdE1X6hz590lg8SGv05P1W0YJV2Ve:vR9X6hzX0lbRc5NM
TLSH T181D622C6F7E8982FC8B70476C9BA167256634D128B939F836944371C297B6E40F4DBC8
TrID 40.0% (.APK) Android Package (27000/1/5)
20.0% (.JAR) Java Archive (13500/1/2)
18.5% (.VYM) VYM Mind Map (12500/1/3)
15.5% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
5.9% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter johnk3r
Tags:apk banker GhostNFC ghostnfc-site NGate signed

Code Signing Certificate

Organisation:Android Debug
Issuer:Android Debug
Algorithm:sha256WithRSAEncryption
Valid from:2026-06-14T08:23:45Z
Valid to:2056-06-06T08:23:45Z
Serial number: 01
Intelligence: 508 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 61a1ea360dc4b93909a86b8f916d11781737b0ddeb41db9a2e03ca1e7229e537
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
BR BR
Vendor Threat Intelligence
No detections
Result
Link:
https://incinerator.cloud/#/public/report/ff66b7477103ea6996277207b7e95f3e/detail
Application Permissions
control Near-Field Communication (NFC)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
prevent phone from sleeping (WAKE_LOCK)
control vibrator (VIBRATE)
Verdict:
Unknown
File Type:
apk
Link:
https://opentip.kaspersky.com/b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26/results?tab=lookup
Score:
96%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wf6qgc7oouufsfmbqhkymzcfnhsa37qtwd6uodysjau3l67n3qta._file
Result
Malware family:
ngate
Create hunting rule
Score:
  10/10
Tags:
family:ngate android infostealer spyware trojan
Link:
https://tria.ge/reports/261102-19pr5azw6p/
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
SUSP_APK_No_Launcher_Activity_Apr_08
Link:
https://app.threat.zone/submission/2746a2fc-8ab8-43f4-adca-aa8e7e13d3df
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b17d030bee752859158181d586644569e40dfe13b0fd470f124829b5fbeddc26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ANDROID_Sample_Unique_5be608a5
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:5be608a563a02c94dbf3b1812b3aa0685a6f8228b5dc74c773cc3c912adef7ba.apk
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_Unknown_ForgeAuto_fb8491f3_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat extrait)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments