🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb
SHA3-384 hash: 03abc635db8cb546075539585246ba732968eb2be1bc03487e591fbc50973416980258659c76f5f3b1a270d344499918
SHA1 hash: b15b1f3f2227eba4b69c85bdb638df34b9d30b6a
MD5 hash: e3795f41f35c621ee1f94a91e8d40653
humanhash: south-leopard-paris-juliet
File name:e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb.apk
Download: download sample
File size:9'922'273 bytes
First seen:2026-01-31 08:02:19 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 196608:YjNg7h2oVDHtiyOp5cdkDnQ4uRR5h3CSAKG31nQ8m6Br:YKooJHtB60kuRRW/KG31A6Br
TLSH T1A1A62245EFA9CE1EC47340370D9A5735665A9D2FC7828283D9EC3A18387B6E40ED4BE4
TrID 40.0% (.APK) Android Package (27000/1/5)
20.0% (.JAR) Java Archive (13500/1/2)
18.5% (.VYM) VYM Mind Map (12500/1/3)
15.5% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
5.9% (.ZIP) ZIP compressed archive (4000/1)
Magika apk
Reporter JAMESWT_WT
Tags:apk hitpak-org

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Android.Spy.1511.origin.31015.13068.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
android base64 evasive expand fingerprint generisk infostealer lolbin persistence signed smsspy spyagent
Link:
https://www.filescan.io/uploads/697db720981ff1d38a42aa37/reports/26c2bba0-262b-4c9d-af21-88be8baad14b/overview
Result
Link:
https://incinerator.cloud/#/public/report/e3795f41f35c621ee1f94a91e8d40653/detail
Application Permissions
read contact data (READ_CONTACTS)
read external storage contents (READ_EXTERNAL_STORAGE)
Allows an application a broad access to external storage in scoped storage (MANAGE_EXTERNAL_STORAGE)
full Internet access (INTERNET)
automatically start at boot (RECEIVE_BOOT_COMPLETED)
Verdict:
Malicious
File Type:
apk
First seen:
2025-10-14T13:32:00Z UTC
Last seen:
2026-01-31T07:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb/results?tab=lookup
Score:
93%
Verdict:
Malware
File Type:
APK
Link:
https://malprob.io/report/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb/
Threat name:
Android.Spyware.GhostChat
Create hunting rule
Status:
Malicious
First seen:
2025-09-11 22:07:02 UTC
File Type:
Binary (Archive)
Extracted files:
481
AV detection:
9 of 36 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4svjrqn652ibq4p5rj4lg6zb56eg4ud6mx6gjgpd343wsca42hfq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
android collection defense_evasion persistence
Link:
https://tria.ge/reports/260131-jxb7tsdt6g/
Behaviour
Makes use of the framework's foreground persistence service
Reads the contacts stored on the device.
Reads the content of photos stored on the user's device.
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments