MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf1083a8cfec823693c2c2adbab06a49dc8587074169106c35d8ec8da18d29cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bf1083a8cfec823693c2c2adbab06a49dc8587074169106c35d8ec8da18d29cc
SHA3-384 hash:	229a6857d3e28c61e74a70f3fa6d596988ceb87c5c403b2b23d1a7b8ad38b92e6f7a26128631d3606f5f28775a756e69
SHA1 hash:	4f162b546582598eb540b0f162b9abd6ed1f3991
MD5 hash:	6a0244b8f3fdec1ae1ce01ec6ce6f8a4
humanhash:	beer-blossom-mississippi-finch
File name:	Button VPN.apk.dll
Download:	download sample
File size:	451'424 bytes
First seen:	2026-10-19 06:44:09 UTC
Last seen:	2026-10-19 06:49:17 UTC
File type:	apk
MIME type:	application/zip
ssdeep	12288:qVU3H+x4v8ZyRq59v+8LQRo8wNvg9k62hFZktn6XUCc0UNN0:yEvg55So0B2hFZkskzL0
TLSH	T153A423792EE6EC65F61360392229230FC90ED2AD3D61EA18C4A787F15EC6A543D8731D
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	Parper
Tags:	apk signed

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

165

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

base64 crypto evasive masquerade signed

Link:

https://www.filescan.io/uploads/6ad5bc4216453a97fa2da3fe/reports/54e8f907-0e61-4f88-8abb-23a7811029fb/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/6a0244b8f3fdec1ae1ce01ec6ce6f8a4/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-10-18T19:39:00Z UTC

Last seen:

2026-10-21T02:12:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bf1083a8cfec823693c2c2adbab06a49dc8587074169106c35d8ec8da18d29cc/results?tab=lookup

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/bf1083a8cfec823693c2c2adbab06a49dc8587074169106c35d8ec8da18d29cc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf1083a8cfec823693c2c2adbab06a49dc8587074169106c35d8ec8da18d29cc/

ReversingLabs TitaniumCloud Android.Trojan.Generic

Threat name:

Android.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-19 00:04:13 UTC

File Type:

Binary (Archive)

Extracted files:

13

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x4iihkgp5sbdne6cykw3vmdkjhoilbyhifura3bv3dwi3imnfhga._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android collection credential_access discovery evasion impact persistence

Link:

https://tria.ge/reports/261019-hjvata1xc1/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Uses Crypto APIs (Might try to encrypt user data)

Queries the mobile country code (MCC)

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bf1083a8cfec823693c2c2adbab06a49dc8587074169106c35d8ec8da18d29cc