MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9f0f8875297bccfa81dcae3fdec8cc67f6872e0e58d295cf2dcf89985e7a22b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c9f0f8875297bccfa81dcae3fdec8cc67f6872e0e58d295cf2dcf89985e7a22b
SHA3-384 hash:	a74f54c0cebe83941c4c861d6ced69f728830ac7fe39caa35d2db5786fed90aaa080a0d7c640c49c78475b5f29115b5e
SHA1 hash:	b328cf8ebdc1ead78eb1ad25d3ff5f6f676099f9
MD5 hash:	ccf1d5505879acc776a19bd3fcbc46c2
humanhash:	virginia-sink-neptune-one
File name:	nested_app.apk
Download:	download sample
File size:	8'558'466 bytes
First seen:	2026-06-27 19:43:16 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	196608:rcrkfljMbVwiuKVO9Ht6foGMsGge4lVvoJQVujS:wkfSGiE9t6fgsH1lVvoJc
TLSH	T1748601C6F7D8A92FC4775032C5BA52F6914B4C228E879F536914760C28BB6D84F4AFC8
TrID	50.0% (.APK) Android Package (27000/1/5) 23.1% (.VYM) VYM Mind Map (12500/1/3) 19.4% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.4% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk SaferRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Link:

https://incinerator.cloud/#/public/report/ccf1d5505879acc776a19bd3fcbc46c2/detail

Application Permissions

access location in background (ACCESS_BACKGROUND_LOCATION)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

receive MMS (RECEIVE_MMS)

directly call phone numbers (CALL_PHONE)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read contact data (READ_CONTACTS)

write contact data (WRITE_CONTACTS)

read external storage contents (READ_EXTERNAL_STORAGE)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)

act as an account authenticator (AUTHENTICATE_ACCOUNTS)

list accounts (GET_ACCOUNTS)

take pictures and videos (CAMERA)

record audio (RECORD_AUDIO)

fine (GPS) location (ACCESS_FINE_LOCATION)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

reorder applications running (REORDER_TASKS)

full Internet access (INTERNET)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

view network status (ACCESS_NETWORK_STATE)

prevent phone from sleeping (WAKE_LOCK)

read sync settings (READ_SYNC_SETTINGS)

write sync settings (WRITE_SYNC_SETTINGS)

send SMS-received broadcast (BROADCAST_SMS)

send WAP-PUSH-received broadcast (BROADCAST_WAP_PUSH)

interact with device admin (BIND_DEVICE_ADMIN)

Verdict:

Malicious

File Type:

apk

First seen:

2026-06-26T23:46:00Z UTC

Last seen:

2026-06-27T06:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c9f0f8875297bccfa81dcae3fdec8cc67f6872e0e58d295cf2dcf89985e7a22b/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/c9f0f8875297bccfa81dcae3fdec8cc67f6872e0e58d295cf2dcf89985e7a22b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c9f0f8875297bccfa81dcae3fdec8cc67f6872e0e58d295cf2dcf89985e7a22b/

Threat name:

Android.Trojan.AVerseFalc

Status:

Malicious

First seen:

2026-06-27 03:55:30 UTC

File Type:

Binary (Archive)

Extracted files:

919

AV detection:

11 of 36 (30.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zhyprb2ss66m7ka5zlr733emyz7wq4xa4wgssxhs3t4jtbphuivq._file

Result

Malware family:

saferrat

Score:

10/10

Tags:

family:saferrat android banker collection defense_evasion infostealer persistence trojan

Link:

https://tria.ge/reports/260627-yff7sadv4q/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Queries account information for other applications stored on the device

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.