MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a
SHA3-384 hash:	32bf837ef0e495d32ea2d230dc442c64cc75e7277a4e0195ec3b1c20f9ed295e36f678f16731fcc70b25253a65dea50b
SHA1 hash:	91eb2a58b830b91f9c50a20a22bf05053eee3dba
MD5 hash:	6140d1eb546f0672c97443e69d2b20f7
humanhash:	berlin-sink-crazy-seventeen
File name:	VinReestr._1790236766796.apk
Download:	download sample
File size:	10'620'906 bytes
First seen:	2026-09-24 14:04:04 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	196608:DrQx4HVqA9c7/ksnroMdQhzLErLRg2GTHCZMNxvLULdX1lusXc:ox4HVqX79cMdQhzgi2GMMNxvLguF
TLSH	T1AFB61216460C5911C83F4A3618EE4B92E3746A424F42DE3B21BDBD6B7F731D1CB817AA
TrID	49.0% (.APK) Android Package (27000/1/5) 24.5% (.JAR) Java Archive (13500/1/2) 19.0% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	Parper
Tags:	apk

Parper

src https://VINREESTR.RU

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

base64 signed

Link:

https://www.filescan.io/uploads/6ab52de6a9d0e88f0f75c814/reports/d3bb96ee-08cf-4eb1-807a-0b5476eeab57/overview

Verdict:

Malicious

File Type:

apk

First seen:

2026-09-24T08:14:00Z UTC

Last seen:

2026-09-24T09:08:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Dropper.AndroidOS.Creduz.t

Link:

https://opentip.kaspersky.com/ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a/

Threat name:

Android.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-24 14:05:53 UTC

File Type:

Binary (Archive)

Extracted files:

2377

AV detection:

4 of 23 (17.39%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5v4awgx6mdonfqzjvlhkztfqthb3pgnwy2unbsbvu73hx2jlorva._file

Result

Malware family:

n/a

Score:

7/10

Tags:

android banker collection credential_access defense_evasion discovery impact persistence

Link:

https://tria.ge/reports/260924-rdfpxaeh36/

Behaviour

Checks CPU information

Checks memory information

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks the presence of a debugger

Queries the mobile country code (MCC)

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ed780b1afe60dcd2c329aaceacccb099c3b799b6c6a8d0c835a7f67be92b746a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample