MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf70fa02c3a8ee82ee2dfc5ee77407aeb41cad33d77b6d61b0a9fa12fd3743bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf70fa02c3a8ee82ee2dfc5ee77407aeb41cad33d77b6d61b0a9fa12fd3743bb
SHA3-384 hash: b65e8c7da83616c44698f16f14e3e45725727cb94f2fc6306c56b5460955a37d0032f7815dc461042f91c4c458bbc45d
SHA1 hash: c2fa18ce1ccd04da5ad59bb539a2a5a455188655
MD5 hash: 0ae64137e845f059ddcc69421f6cd8ab
humanhash: december-hawaii-music-seventeen
File name:Refah.apk
Download: download sample
File size:3'230'069 bytes
First seen:2026-08-15 05:31:02 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 98304:LnMDBmZMXoqtI4lw52f0f2Dz3SsOEKy6XPZ0vf+DF:LMDBmZ4BK4lk2fG2HtjKy6R0vfI
TLSH T1C3E52356B715643BD87F82319AC71B6527298E00CAE63A0F3540722E6D7778E9F68FC0
TrID 65.0% (.APK) Android Package (27000/1/5)
25.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter Anonymous
Tags:apk SHAPARAK

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
GB GB
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Android.Siggen.Susp2.5348.24167.25222.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bankingtrojan dropper signed
Link:
https://www.filescan.io/uploads/6a7ff9b97eabfef7f6ee131d/reports/551e6788-116b-45b1-afb7-92d9b41c1055/overview
Result
Link:
https://incinerator.cloud/#/public/report/0ae64137e845f059ddcc69421f6cd8ab/detail
Application Permissions
read phone state and identity (READ_PHONE_STATE)
receive SMS (RECEIVE_SMS)
send SMS messages (SEND_SMS)
read SMS or MMS (READ_SMS)
read contact data (READ_CONTACTS)
write contact data (WRITE_CONTACTS)
directly call phone numbers (CALL_PHONE)
read external storage contents (READ_EXTERNAL_STORAGE)
take pictures and videos (CAMERA)
fine (GPS) location (ACCESS_FINE_LOCATION)
coarse (network-based) location (ACCESS_COARSE_LOCATION)
act as an account authenticator (AUTHENTICATE_ACCOUNTS)
full Internet access (INTERNET)
prevent phone from sleeping (WAKE_LOCK)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
view network status (ACCESS_NETWORK_STATE)
change your audio settings (MODIFY_AUDIO_SETTINGS)
control vibrator (VIBRATE)
write sync settings (WRITE_SYNC_SETTINGS)
read sync settings (READ_SYNC_SETTINGS)
C2DM permissions (RECEIVE)
Verdict:
Malicious
File Type:
apk
First seen:
2026-08-13T14:59:00Z UTC
Last seen:
2026-08-16T23:17:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/bf70fa02c3a8ee82ee2dfc5ee77407aeb41cad33d77b6d61b0a9fa12fd3743bb/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/bf70fa02c3a8ee82ee2dfc5ee77407aeb41cad33d77b6d61b0a9fa12fd3743bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf70fa02c3a8ee82ee2dfc5ee77407aeb41cad33d77b6d61b0a9fa12fd3743bb/
Threat name:
Android.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-14 03:31:18 UTC
File Type:
Binary (Archive)
Extracted files:
302
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5ypuawdvdxif3rn7rpoo5ahv22bzljt255w2ynqvh5bf7jxio5q._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/260815-f71rdszzft/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf70fa02c3a8ee82ee2dfc5ee77407aeb41cad33d77b6d61b0a9fa12fd3743bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments