MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae
SHA3-384 hash:	ada3b0726b6c1972f822aa04234be54bd9148f7c4fb35a62637ec74624a23bf3b7f5c2ce4909d0055dd697d96760352d
SHA1 hash:	56789c19aad5966cfe5f8ae64ec65f6516eb3755
MD5 hash:	7b09dcf1f0a6b8d13c479a7f2105f9f0
humanhash:	paris-undress-dakota-december
File name:	Standoff2.apk
Download:	download sample
Signature	SpyNote Alert Create hunting rule
File size:	778'701 bytes
First seen:	2025-12-23 17:39:41 UTC
Last seen:	Never
File type:	apk
MIME type:	application/java-archive
ssdeep	12288:ZPkOKa1a8LzeXx7etU70OU5WmpYshXZPbGwidNpg/:Z8ta1ameXgte0OU5WmD9idNpU
TLSH	T14DF45B86FB4AF867C9F3C7368275C66A96464C544B43D7471A85723C0DBBAC08B89FC8
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Spynote

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Backdoor.791.origin.21864.12548.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android base64 evasive fingerprint persistence signed

Link:

https://www.filescan.io/uploads/694ad408e126b9ff438eb543/reports/421feb2c-66b2-4142-a32f-4d4ee9d5f39b/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/7b09dcf1f0a6b8d13c479a7f2105f9f0/detail

Application Permissions

take pictures and videos (CAMERA)

read external storage contents (READ_EXTERNAL_STORAGE)

read Browser's history and bookmarks (READ_HISTORY_BOOKMARKS)

display system-level alerts (SYSTEM_ALERT_WINDOW)

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

list accounts (GET_ACCOUNTS)

write contact data (WRITE_CONTACTS)

read contact data (READ_CONTACTS)

record audio (RECORD_AUDIO)

read SMS or MMS (READ_SMS)

read phone state and identity (READ_PHONE_STATE)

directly call phone numbers (CALL_PHONE)

coarse (network-based) location (ACCESS_COARSE_LOCATION)

fine (GPS) location (ACCESS_FINE_LOCATION)

receive SMS (RECEIVE_SMS)

retrieve running applications (GET_TASKS)

intercept outgoing calls (PROCESS_OUTGOING_CALLS)

modify global system settings (WRITE_SETTINGS)

control flashlight (FLASHLIGHT)

create Bluetooth connections (BLUETOOTH)

set wallpaper (SET_WALLPAPER)

set wallpaper size hints (SET_WALLPAPER_HINTS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

kill background processes (KILL_BACKGROUND_PROCESSES)

control vibrator (VIBRATE)

prevent phone from sleeping (WAKE_LOCK)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change Wi-Fi status (CHANGE_WIFI_STATE)

full Internet access (INTERNET)

show app notification (READ_APP_BADGE)

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2025-12-14T20:46:00Z UTC

Last seen:

2025-12-15T05:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae/

ReversingLabs TitaniumCloud Android.Trojan.Tripoli

Threat name:

Android.Trojan.Tripoli

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-15 01:39:13 UTC

File Type:

Binary (Archive)

Extracted files:

431

AV detection:

21 of 36 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ipyoivlhu2vpz5q3wqpvsrzyul3x4fp3bf7jo64sjuhzg6vrkxa._file

Hatching Triage spynote

Result

Malware family:

spynote

Alert

Create hunting rule

Score:

  10/10

Tags:

family:spynote android banker defense_evasion discovery impact persistence privilege_escalation

Link:

https://tria.ge/reports/251223-v83dyaykes/

Behaviour

Registers a broadcast receiver at runtime (usually for listening for system events)

Makes use of the framework's foreground persistence service

Requests enabling of the accessibility settings.

Tries to add a device administrator.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Malware Config

C2 Extraction:

tcp.cloudpub.ru:48683

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/37f21c88-e593-43f5-9df7-989f03c23f6c

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.49

Link:

https://yomi.yoroi.company/submissions/e21f8722ab3d3557e7b0dda0faca39c517bbf0afd84bf4bbdc92687c9bd58aae