MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8
SHA3-384 hash: ec1b99eb003f3d0837ad9ce49d17737e9174a181173a3c1af73008c059c8a4f971188d12d16adeb59ec9d61885294064
SHA1 hash: 5d3b255ed5ad81c4058ebfaad235fcb0ee53e827
MD5 hash: 5280d654cd519c4ec6dfedb037cd13df
humanhash: helium-tennis-social-november
File name:update.apk
Download: download sample
File size:15'300'630 bytes
First seen:2026-03-18 20:27:56 UTC
Last seen:Never
File type: apk
MIME type:application/zip
ssdeep 393216:WY2C4d+qUQ1Fv9wmQOmw3gM6c18J/kf8W:N2dGQLem5+MZGO
TLSH T14AF62297FB45582AF0F783B2413A5321D50B4C668743CACB7914713C28B7AE06F9AADD
TrID 33.3% (.APK) Android Package (27000/1/5)
16.6% (.JAR) Java Archive (13500/1/2)
16.6% (.ZAN) BlueEyes Animation (13500/1/4)
15.4% (.VYM) VYM Mind Map (12500/1/3)
12.9% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
Magika apk
Reporter johnk3r
Tags:apk banker BTMob

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
android bankbot expand lolbin signed
Link:
https://www.filescan.io/uploads/69bb0ae44ec2f522cc4e66fb/reports/d8a5ac92-d1b0-4ca8-bcc6-ce14f1ad4702/overview
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8
Verdict:
Malicious
File Type:
apk
Link:
https://opentip.kaspersky.com/ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8/results?tab=lookup
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8/
Threat name:
Android.Infostealer.Anubis
Create hunting rule
Status:
Malicious
First seen:
2026-03-18 20:28:25 UTC
File Type:
Binary (Archive)
Extracted files:
969
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qbtye7qnpgmwpjvwrwfmab2mbiwgokbttghli3tro6pp6b6kk4a._file
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

apk 0a108cca92abc4326b5897466ed7c8f7f8737d3aab14f59a8d1e5eb4a48167b9

apk ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8

(this sample)

  
Dropped by
SHA256 0a108cca92abc4326b5897466ed7c8f7f8737d3aab14f59a8d1e5eb4a48167b9
  
Dropped by
MD5 12d0533a59606c38e5efe376288c803a

Comments