MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8
SHA3-384 hash:	e5d9879d8a2d0c6c98f4660120e67d5cb5a753678339d02d00ea92f64708d79ffc6f4e18dc5a07962ab30fa1466e9cea
SHA1 hash:	59cbd0257c0b64bef7dcb88ccfe9eee3374034c3
MD5 hash:	49beccefe7c38cf4dfd451e2b1bf3226
humanhash:	emma-william-mobile-william
File name:	bog.apk
Download:	download sample
File size:	5'485'034 bytes
First seen:	2025-11-19 07:15:46 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:xR84Afd2ofrOhZn/IwepSRw3K+mkajr6IKYEBH0Mbul3jRU6JNjIIrBS9ro44:xG4l2EGK7raX+MA/jZr494
TLSH	T16646E099B359A72EC87754334AF6523252874C478E829B43785C721C3BB76F80F5ABC8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	juroots
Tags:	apk

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

45

Origin country :

IL

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

evasive expand lolbin persistence signed

Link:

https://www.filescan.io/uploads/691d6f23e0230b8eeacc203a/reports/cbded4e0-68a1-4ab7-84b1-cadf1b4cb490/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/49beccefe7c38cf4dfd451e2b1bf3226/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

list accounts (GET_ACCOUNTS)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

control vibrator (VIBRATE)

prevent phone from sleeping (WAKE_LOCK)

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

apk

First seen:

2025-06-01T03:23:00Z UTC

Last seen:

2025-11-19T09:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8/results?tab=lookup

Nucleon Malprob Susipicious

Score:

36%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zpjb7piauyuawdouo77yovpvqpysdsclc4fvrgdieo2ukm2ptkua._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android collection credential_access discovery impact persistence

Link:

https://tria.ge/reports/251119-h4wz5shj8y/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Queries information about active data network

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/317a891b-3adc-44c3-a2cf-ebf4a1d31d49

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.