MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee4169ae62236462925b7ef0934d2fd4e10d8d64f97ce4555d625aa390c73041. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ee4169ae62236462925b7ef0934d2fd4e10d8d64f97ce4555d625aa390c73041
SHA3-384 hash:	18241df8dde17557b3ffdee0dab424755f1d3dca3702221a53e4c910b3ca785bc937c5078da4ec525bd3bd63ad07622c
SHA1 hash:	5e353a4eaad8d448cd288b92e69f561af57a126a
MD5 hash:	9791ad718e91c69e6802f529bfd1b110
humanhash:	dakota-illinois-delaware-timing
File name:	mparivahan.apk
Download:	download sample
File size:	4'326'109 bytes
First seen:	2026-07-10 14:12:10 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:xnkJz8YZAq7bdol+UiUJs/+SI2MadhTHVgQwVElPx:iJz8VO89RjSDHMfElJ
TLSH	T12C1633163799E23DC876513A6C6FA2B27B61BC638D4282577441332F7EB32E04F11DA9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	jitesh
Tags:	android apk banker dropper Goi mparivahan RiskWare signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

243

Origin country :

IN

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.SpyMax.103.origin.634.27150.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

dropper

Link:

https://www.filescan.io/uploads/6a50fdcb719e23bd47e221e4/reports/5f98c915-fd6a-47cf-b0f0-aba66892bdbf/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-07-09T03:53:00Z UTC

Last seen:

2026-07-11T22:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ee4169ae62236462925b7ef0934d2fd4e10d8d64f97ce4555d625aa390c73041/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee4169ae62236462925b7ef0934d2fd4e10d8d64f97ce4555d625aa390c73041/

ReversingLabs TitaniumCloud Android.Trojan.AVerseFalc

Threat name:

Android.Trojan.AVerseFalc

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-09 09:12:23 UTC

File Type:

Binary (Archive)

Extracted files:

101

AV detection:

6 of 37 (16.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5zawtltcensgfes3p3yjgtjp2tqq3dle7f6oivk5mjnkheghgbaq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android banker discovery

Link:

https://tria.ge/reports/260710-rh3egaaz3l/

Behaviour

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ee4169ae62236462925b7ef0934d2fd4e10d8d64f97ce4555d625aa390c73041