MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf869324cbadaa2bc186f2d1d1bda3718329c1000e60e22a29a3a1f207c465ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cf869324cbadaa2bc186f2d1d1bda3718329c1000e60e22a29a3a1f207c465ae
SHA3-384 hash:	f25bc7b6327afc951ff04c38e08c5c7d9b6bfde04d550f6ed7483d7c18ce842d5fdcd137cf8675e91838843ac8b50bbb
SHA1 hash:	f296c5b197d2725b5d006f35484aa3a2a2767551
MD5 hash:	faa7e4d034c37796ab9175dfb8f942ef
humanhash:	bluebird-ten-sodium-speaker
File name:	cf869324cbadaa2bc186f2d1d1bda3718329c1000e60e22a29a3a1f207c465ae.bin
Download:	download sample
File size:	1'165'966 bytes
First seen:	2026-09-25 06:30:13 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	24576:oqJ+yxHvTvHvTTXHvT95ZyI6Z9IWez0pmsGEH7nABCQyz99:LJ+yxHvDHvXXHvnZyIwUwpJGo7ApU9
TLSH	T154452367EB90A824CC6EC17642B74B877634C3209962979F562AD1F83CC96F387837C5
TrID	87.0% (.APK) Android Package (27000/1/5) 12.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	whack_sh
Tags:	apk zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

37

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.Mamont.318.origin.23779.13027.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Android.Banker.Mamont.318.origin.17580.10801.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade signed

Link:

https://www.filescan.io/uploads/6ab6256dbefc01ce94e64bc3/reports/517b6436-dcd4-4b55-8ea4-2fbb3c36679b/overview

Nucleon Malprob Malware

Score:

92%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/cf869324cbadaa2bc186f2d1d1bda3718329c1000e60e22a29a3a1f207c465ae

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf869324cbadaa2bc186f2d1d1bda3718329c1000e60e22a29a3a1f207c465ae/

ReversingLabs TitaniumCloud Android.Trojan.Locker

Threat name:

Android.Trojan.Locker

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-25 06:58:34 UTC

File Type:

Binary (Archive)

Extracted files:

61

AV detection:

9 of 35 (25.71%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z6djgjglvwvcxqmg6li5dpndogbstqiabzqoekrjuoq7eb6emwxa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android defense_evasion evasion execution persistence

Link:

https://tria.ge/reports/260925-jhqfxabh96/

Behaviour

Schedules tasks to execute at a specified time

Acquires the wake lock

Makes use of the framework's foreground persistence service

Loads dropped Dex/Jar

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cf869324cbadaa2bc186f2d1d1bda3718329c1000e60e22a29a3a1f207c465ae