🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b
SHA3-384 hash: 99bc5c69e74bb124470b5ebf98529aaff24d33aff474ea730cb34f94a8dcf509579f24564954e4feefcaddd75ebba419
SHA1 hash: 70454473e8f00a6de3c781de50cc4d274a0491f3
MD5 hash: 6d99fbbee6ecd439872385dc2e33000e
humanhash: aspen-comet-river-network
File name:mbupload-xelnqjkn.bin
Download: download sample
File size:11'185'175 bytes
First seen:2026-10-21 12:50:19 UTC
Last seen:Never
File type: apk
MIME type:application/vnd.android.package-archive
ssdeep 196608:XDc863Z14nNIrljZHNxG4Ntz1QXXt4in0pkuUfAmfdC7hyshe9Lawc8YcRE2:zcVpanNoljZK4hmd4/pkuGlckss9fcdS
TLSH T1CFB633A2BB49443EC47791320D6B527132235D428EA3674B7818776D39B37C84FDABE8
TrID 49.0% (.APK) Android Package (27000/1/5)
24.5% (.JAR) Java Archive (13500/1/2)
19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter wristhulk
Tags:apk github signed

Code Signing Certificate

Organisation:QA Team
Issuer:QA Team
Algorithm:sha256WithRSAEncryption
Valid from:2023-03-07T10:06:56Z
Valid to:2050-07-23T10:06:56Z
Serial number: 354afd4b
Intelligence: 10 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 1431eedaa27b30fd846283f083e52a5fa40c0261e1a039a337a37174d699e750
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
wristhulk
Distributed from GitHub: https://raw.githubusercontent.com/bro69rare-lang/Newws/refs/heads/main/mParivahan.apk . Lab-triaged statically in an isolated VM: fake mParivahan (Indian transport ministry) Android app, packed with random-named encrypted assets. URL submitted to URLhaus.

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
US US
Vendor Threat Intelligence
No detections
Gathering data
Result
Link:
https://incinerator.cloud/#/public/report/6d99fbbee6ecd439872385dc2e33000e/detail
Application Permissions
Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)
full Internet access (INTERNET)
Verdict:
Malicious
File Type:
apk
First seen:
2026-10-18T13:42:00Z UTC
Last seen:
2026-10-23T06:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b/results?tab=lookup
Score:
93%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zi4u4fqdza5vpnavhhgispodbdr5thtvilbv3ngcytwon4dicynq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
android
Link:
https://tria.ge/reports/261021-p242ascw7t/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
SMSspy
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ANDROID_Sample_Unique_5be608a5
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:5be608a563a02c94dbf3b1812b3aa0685a6f8228b5dc74c773cc3c912adef7ba.apk
Rule name:JP_Lure_Content_Hunt
Create hunting rule
Author:sumeshi
Description:Hunts for files containing Japanese kana text or common Japanese lure terminology
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

apk ca394e1603c83b57b41539cc893dc308e3d99e7542c35db4c2c4ece6f068161b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3953514/

Comments