MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34
SHA3-384 hash: ac8ace7b0b6ff03528060fdeaf2b255fd5a09544a827a55cc6cbda15bda1e2a8223443c48f932487d7863fd39cc38b75
SHA1 hash: 886e568e4189d2f4ad912db54af82b1b6870f3a7
MD5 hash: 791ead6b2a562f777d70e594bbd86b52
humanhash: berlin-pennsylvania-blue-batman
File name:be.apk
Download: download sample
File size:10'682'971 bytes
First seen:2026-04-17 14:22:55 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:OZ3eNoU10SmZqVtTcpkK4EYr5eFmG1BSjbo3ANyLbD8ciFvPEo//3drmy0Tts6ya:JaUXmKwOaFmqBoPeobdrqTK9a
TLSH T173B6D042EB958926C4BB63336AB3436176397E4A574387031858FD387C736E8BB427C9
TrID 65.0% (.APK) Android Package (27000/1/5)
25.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter 0x746f6d6669
Tags:apk

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint invalid-signature signed
Link:
https://www.filescan.io/uploads/69e242675ea31bc68a345ef1/reports/50f0c690-807a-4966-9fe4-8e803b02f7b3/overview
Result
Link:
https://incinerator.cloud/#/public/report/791ead6b2a562f777d70e594bbd86b52/detail
Application Permissions
send SMS messages (SEND_SMS)
display system-level alerts (SYSTEM_ALERT_WINDOW)
modify global system settings (WRITE_SETTINGS)
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)
read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)
edit SMS or MMS (WRITE_SMS)
read contact data (READ_CONTACTS)
read phone state and identity (READ_PHONE_STATE)
read external storage contents (READ_EXTERNAL_STORAGE)
receive SMS (RECEIVE_SMS)
receive MMS (RECEIVE_MMS)
read SMS or MMS (READ_SMS)
control vibrator (VIBRATE)
allow use of fingerprint (USE_FINGERPRINT)
prevent phone from sleeping (WAKE_LOCK)
full Internet access (INTERNET)
view network status (ACCESS_NETWORK_STATE)
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34
Verdict:
Malicious
File Type:
apk
First seen:
2026-04-16T15:29:00Z UTC
Last seen:
2026-04-19T03:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-17 11:07:06 UTC
File Type:
Binary (Archive)
Extracted files:
769
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x2cxhfy3qx62qgrpvqt23n5dvgzm67q5tppxcm3bu4stetjxru2a._file
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments