MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faa92121e822c424923702e3d5848ec2f3b16898b149a179520aee3bd4dceaee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	faa92121e822c424923702e3d5848ec2f3b16898b149a179520aee3bd4dceaee
SHA3-384 hash:	70b6cca1f803cdc11b12f3c1a3cf9653e399fd2d15e4d99ad9e8a234a696c088051ba0b4fcc73fd5ec6e68cc1958ae99
SHA1 hash:	6065eee3cb22afe73a98516dbd31ef86a13f45f1
MD5 hash:	2291f0cd9c3d834d108b220160dc73aa
humanhash:	lima-happy-montana-maine
File name:	upload_2e570611584e2f0a471d45a30e277818.apk
Download:	download sample
File size:	5'661'679 bytes
First seen:	2026-01-05 10:14:30 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	98304:pM4cx+vd2ofrQwWXa0zdZc76Hnp5B2dcqhecrDDCiDZHIAyePQt5v7D:pM5JZnB2NheiDZJyePQrvn
TLSH	T19A46F056E30468ABC4F7533346F512B191870D2A8B43C6831C68F23C69BBAF55F5ABC9
TrID	35.7% (.APK) Android Package (27000/1/5) 17.8% (.JAR) Java Archive (13500/1/2) 16.5% (.VYM) VYM Mind Map (12500/1/3) 13.9% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 10.5% (.XPI) Mozilla Firefox browser extension (8000/1/1)
Magika	apk
Reporter	juroots
Tags:	apk signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

150

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

android base64 crypto evasive expand fakeapp fingerprint generisk infostealer lolbin signed spyagent

Link:

https://www.filescan.io/uploads/695b8f568d1aa9829e2ab25f/reports/dc06abb0-ec98-4250-8e3f-5e00932bb980/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/2291f0cd9c3d834d108b220160dc73aa/detail

Application Permissions

read external storage contents (READ_EXTERNAL_STORAGE)

read contact data (READ_CONTACTS)

read phone state and identity (READ_PHONE_STATE)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2025-12-11T04:38:00Z UTC

Last seen:

2026-01-05T12:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/faa92121e822c424923702e3d5848ec2f3b16898b149a179520aee3bd4dceaee/results?tab=lookup

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/faa92121e822c424923702e3d5848ec2f3b16898b149a179520aee3bd4dceaee

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/faa92121e822c424923702e3d5848ec2f3b16898b149a179520aee3bd4dceaee/

ReversingLabs TitaniumCloud Android.Trojan.Generic

Threat name:

Android.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-11 11:59:19 UTC

File Type:

Binary (Archive)

Extracted files:

809

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7kuscipielccjerxalr5lbeoylz3c2eywfe2c6ksblxdxvg45lxa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

android

Link:

https://tria.ge/reports/260105-manh5ack5z/

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0f59bcc7-ce78-4c99-af14-46a14737f631

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/faa92121e822c424923702e3d5848ec2f3b16898b149a179520aee3bd4dceaee