MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d
SHA3-384 hash:	a8e1fd27d1962a1f59fbd0089de3d503faaadc7fca6b26425bea2ec76d2bd289e8cab35148bafa620b5f991f323ca6cb
SHA1 hash:	1ada79c4a5a1321dafd08870339b3b8ac23238fd
MD5 hash:	eb06bb252af36b568dbfb93d3936d118
humanhash:	seventeen-eight-nebraska-magazine
File name:	d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d.apk
Download:	download sample
File size:	20'515'363 bytes
First seen:	2026-10-19 23:39:44 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	393216:remirJZAd4/YsKh0hNFIz4fmyC0X6vM4dwtpwN/VPzFAI5X6h:rxUZAe/YsvRdCZ04dwLm/BFA0g
TLSH	T17A271241FB45A86AF4B7933BAAF74231D2116C48AB43C7C7659873391EF7AD01F81688
TrID	48.6% (.APK) Android Package (27000/1/5) 25.2% (.ZIP) Opera Widget (14000/1/2) 18.9% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	Darkfibr

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Link:

https://incinerator.cloud/#/public/report/eb06bb252af36b568dbfb93d3936d118/detail

Application Permissions

read external storage contents (READ_EXTERNAL_STORAGE)

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

Verdict:

Malicious

File Type:

apk

First seen:

2026-08-24T03:15:00Z UTC

Last seen:

2026-10-15T06:26:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d/results?tab=lookup

Score:

65%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d

Gathering data

Threat name:

Android.Trojan.Generic

Status:

Suspicious

First seen:

2026-08-24 08:05:33 UTC

File Type:

Binary (Archive)

Extracted files:

1431

AV detection:

13 of 36 (36.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2upsxv77wsocetmov3bmrsq4rk47zyx5l7oo5ia6wvbjnqxupngq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

android collection credential_access discovery impact persistence

Link:

https://tria.ge/reports/261019-3n972sswc1/

Behaviour

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Looks up external IP address via web service

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Android_Accessibility_Service_Abuse Create hunting rule
Author:	Buga :3
Description:	Detects Android malware abusing Accessibility Service for auto-clicking, credential theft, overlay attacks, or device takeover
Reference:	https://developer.android.com/reference/android/accessibilityservice/AccessibilityService

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	JAR_Network_Indicators_Detection Create hunting rule
Author:	TheKn0ck0ut
Description:	Detects JAR file info by hash

Rule name:	JP_Lure_Content_Hunt Create hunting rule
Author:	sumeshi
Description:	Hunts for files containing Japanese kana text or common Japanese lure terminology

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	test_rule_vldslv Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample