MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6
SHA3-384 hash:	69fe451ec74f69b0547488ae17b19a603cfe22a88ef9fe7827b07ed47a4a090bab54de2b136e6c5ff24fd96bcc41ace7
SHA1 hash:	ef0a818e4a43fbe061993bee655640bd230fc5d2
MD5 hash:	e044aa1347523b51bd989a427851f68f
humanhash:	nitrogen-lima-timing-winter
File name:	app(4).apk
Download:	download sample
File size:	6'352'249 bytes
First seen:	2026-07-03 03:08:21 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:BahN44Rt0vyaN470sxdBYhMvkzd/HmuODiMpjIoWeB1hdao9u9+6TYkXGaytbhoq:Bab6DyFdBKMEGLDDhD5uo9QEkXYNJ3
TLSH	T19D56E14BA745569AC4FA83B90C3732251D477D214BA38287DB2C3E3C687B5F48E979C8
Magika	apk
Reporter	BastianHein
Tags:	apk mparivahan

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

210

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan-Spy.AndroidOS.SMSSpy.26006.18873.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.FileRepMalware.43789846.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

bankingtrojan dropper expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/6a4727bf549f858a89ec50b1/reports/d43219e1-7eb4-4a9f-986e-f7f525a344ef/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-07-03T00:44:00Z UTC

Last seen:

2026-07-04T21:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6/results?tab=lookup

Nucleon Malprob Malware

Score:

74%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-03 03:10:59 UTC

File Type:

Binary (Archive)

Extracted files:

1139

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=23i7fxlnwmlxzs66b7qxc4gmj6uba6grvguqb4pv3vz53ts7a3ta._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

android

Link:

https://tria.ge/reports/260703-dnbbaafw9p/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6