MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcb2e3ce358bc9dc01bd20215f2db4d830bb9b53ab5dd85b24b18bd79553aca6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	bcb2e3ce358bc9dc01bd20215f2db4d830bb9b53ab5dd85b24b18bd79553aca6
SHA3-384 hash:	f99f1ac8699cb07e647b055e1738a3504e18812be2936a8b672038ddff764ffcb658a8b04470e9f953394132258d233d
SHA1 hash:	af87827ead8559c7acfdef1d4e2c15470f518c60
MD5 hash:	d5e8e95039ac95f1d1eb92abccc4c695
humanhash:	mexico-oklahoma-early-angel
File name:	bcb2e3ce358bc9dc01bd20215f2db4d830bb9b53ab5dd85b24b18bd79553aca6.bin
Download:	download sample
File size:	3'177'063 bytes
First seen:	2026-09-30 12:31:46 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:ZVfQdV9gzN9W0DrhDaJOtr0bvNst7OXlCeqpCZQgLCrbUGQRcb:ZZcahDrhoOyCa7QgLCrbUGQ2
TLSH	T173E5BED6FBD8992FC8774032C9AA52F1125B4D128E839F476948371C78B76D80F99BC8
TrID	65.0% (.APK) Android Package (27000/1/5) 25.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	whack_sh
Tags:	apk zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 crypto evasive expand fingerprint lolbin masquerade persistence signed

Link:

https://www.filescan.io/uploads/6abd091104ec88ff65edc0a0/reports/7dabe97c-7f14-4a93-bcef-66ebb56fa874/overview

Result

Link:

https://incinerator.cloud/#/public/report/d5e8e95039ac95f1d1eb92abccc4c695/detail

Application Permissions

modify global system settings (WRITE_SETTINGS)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

prevent phone from sleeping (WAKE_LOCK)

control vibrator (VIBRATE)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

show app notification (READ_APP_BADGE)

Allows cloud to device messaging (C2D_MESSAGE)

C2DM permissions (RECEIVE)

Score:

44%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/bcb2e3ce358bc9dc01bd20215f2db4d830bb9b53ab5dd85b24b18bd79553aca6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bcb2e3ce358bc9dc01bd20215f2db4d830bb9b53ab5dd85b24b18bd79553aca6/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xszohtrvrpe5yan5eaqv6lnu3aylxg2tvno5qwzewgf5pfktvsta._file

Result

Malware family:

n/a

Score:

8/10

Tags:

android collection credential_access defense_evasion discovery evasion execution impact persistence

Link:

https://tria.ge/reports/260930-qbngaszfph/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Uses Crypto APIs (Might try to encrypt user data)

Listens for changes in the sensor environment (might be used to detect emulation)

Probable phishing domain

Acquires the wake lock

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Checks if the Android device is rooted.

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ANDROID_Sample_Unique_5be608a5 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	5be608a563a02c94dbf3b1812b3aa0685a6f8228b5dc74c773cc3c912adef7ba.apk

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

apk bcb2e3ce358bc9dc01bd20215f2db4d830bb9b53ab5dd85b24b18bd79553aca6

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample