MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487
SHA3-384 hash:	148221a44596428fc7006c29ba901eb11a53df9053a35a2d7a2c0668a5fe5026ae675d7c9b6a1d3ed46b3aa5f5d1556e
SHA1 hash:	1ad939e473d6db54e2ed86da5314fdc50cfc1f25
MD5 hash:	8bd4301c4afee0b56bb9b17d77b97c65
humanhash:	bluebird-kilo-paris-wyoming
File name:	f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487.bin
Download:	download sample
File size:	4'863'043 bytes
First seen:	2026-09-29 12:16:59 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:P4aJPSoNWbkPmHHgz/xSdUixk0sk/m6PD7AgeCUunAR8Wt33q/10h4:whGWbwotxKkzUuM8Wt33w0h4
TLSH	T1F53623AB4E415B4DFCF10CB55AAC8E624BD8015E0B32A929525A2087F8F3B5C3DD17ED
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	whack_sh
Tags:	apk signed zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

104

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Packed.Mamont.7.origin.24823.25295.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade signed

Link:

https://www.filescan.io/uploads/6abbadf815da624b77306b92/reports/5a1727eb-5a1e-4d60-9c29-318a7d2ed005/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/8bd4301c4afee0b56bb9b17d77b97c65/detail

Application Permissions

Allows an application to request installing packages. (REQUEST_INSTALL_PACKAGES)

full Internet access (INTERNET)

view network status (ACCESS_NETWORK_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

control vibrator (VIBRATE)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-09-29T04:51:00Z UTC

Last seen:

2026-09-29T15:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487/results?tab=lookup

Nucleon Malprob Susipicious

Score:

59%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6mlktvtqkb35jmhpc7vczg6buvannmc3fpitkhsl2672eahicsdq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

android banker collection credential_access defense_evasion discovery evasion impact persistence

Link:

https://tria.ge/reports/260929-pk8m6azcqd/

Behaviour

Checks CPU information

Checks memory information

Checks the application is allowed to request package installs through the package installer

Declares services with permission to bind to the system

Makes use of the framework's foreground persistence service

Requests dangerous framework permissions

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f316a9d6705077d4b0ef17ea2c9bc1a540d6b05b2bd1351e4bd7bfa200e81487