SUSPICIOUS — 897a5c4077216fd9bb766b6a0b8fbd1c8af9c6a7550fabc74643363bdb477ef1.xapk

SUSPICIOUS — 897a5c4077216fd9bb766b6a0b8fbd1c8af9c6a7550fabc74643363bdb477ef1.xapk is a zip sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (55/100), attributed to the AntiVM family. 3 of 54 detection engines flagged it.

Identification

• SHA-256: 897a5c4077216fd9bb766b6a0b8fbd1c8af9c6a7550fabc74643363bdb477ef1
• SHA-1: e6babbaad27a7f6bdc904bb2dcc85998503c32f9
• MD5: d69b7cb1d24db0b23de76539a2265037
• ssdeep: 786432:ELLfRBOXuLNA/Dub2IS5tTVoMwX89zXGsSxc/QQyp+1RrLda6dyQ1OyaubhD7F:ErrOXuLNAuCL7w8xyp2Lda651OYbP
• TLSH: T1377C12C807B47945FBE85124B8E4A92D16C3088F51791ECD62E70AB1B1D7BB301B2B67
• Submitted as: 897a5c4077216fd9bb766b6a0b8fbd1c8af9c6a7550fabc74643363bdb477ef1.xapk
• File type: zip · Size: 54759938 bytes
• Verdict: suspicious (55/100) · Family: AntiVM

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: Yara-Rules community: YR_AntiVM_Sandbox
• Microsoft Defender: flagged

Why this verdict

The suspicious score of 55/100 is the fusion of 4 weighted signals:

• YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://android.googlesource.com/toolchain/llvm-project, https://www.tensorflow.org/lite/guide/ops_select, https://www.tensorflow.org/lite/guide/ops_custom - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: com.filestorage.aicleanstorage.apk, config.arm64_v8a.apk - static signal, weight 0.25, confidence 0.50

Archive contents (13 executables)

This zip carries 13 extracted members, each analyzed as its own sample:

• libandroidx.graphics.path.so - 41e9a793c43a0f4fddb19e33f346bace464f30f888ba7b9eaf96294ea115bfb6
• libapminsighta.so - b1a70dabf68e95e1910bb080dbe1c78ae628a0bf7332f7ba41db23d9bbe282c0
• libapminsightb.so - c36885b7189dc5173627ff9afb5a49cb94420b9b98341536b4476b792babab61
• libbuffer.so - 276d6d917d701fef1e8d6835f0c3dbbee61d720f83a76d3e8a04ed27361bb434
• libdatastore_shared_counter.so - d3e48717c9aa147e0ab21063ba0e8e0211cabf8bf40b222640829519edbf58e1
• libfile_lock.so - c8e74595a00f61e498ad989af3c79f9653cf6ed9e8a6ca66d4d8e178015f8712
• libmediapipe_tasks_vision_jni.so - 6e81226752fbfd0da0cae41c3e8743bee25be979bb8f03003c4fe1ca70a54bb5
• libnativelib.so - 96936c954032023c3fb67406fc7bcc8e68fbfe37275050ccf48e05b4d747c379
• libnms.so - 751b15b4b4f9b4cef30abe28e9294866e395b4ab0cc3cf22f399de90bb9062ed
• libpglarmor.so - 8652e573d85d1d8527f361389143cb9eec1588289c18bf1931ad8068f93b8829
• libsigner.so - 78b810ea00e54ef853f1798c3b72db2093e3f9376a2634e9c3c188ab6781ff8c
• libtobEmbedPagEncrypt.so - 1eeed4ed643db10168930b09aa5a66d1e31727a80c847982281e4266536c499b
• libtt_ugen_layout.so - da9e3b3077f79d90a64d6c88e857722f7dc31aa81c131593c790be473fb21e48

Embedded URLs

• https://android.googlesource.com/toolchain/llvm-project
• https://www.tensorflow.org/lite/guide/ops_select
• https://github.com/opencv/opencv/issues/16739
• https://www.tensorflow.org/lite/guide/ops_custom

Embedded domains

• vn.au
• gm.sh
• pq.ml
• 7.mx
• l.io
• bz.su
• h.ua
• sp.sh
• 3s.de
• c.me
• 6.to
• m0.pw
• 7.me
• b.eu
• 5.ua
• f.ws
• 7.se
• d.eu
• clean-android-568.firebasestorage.app
• runtime.cc
• packet.cc
• helpers.cc
• type.googleapis.com
• div.cc
• utils.cc

Embedded IP addresses

• 0.6.11.30

File paths

• R:\F~
• Q:\`r
• i:\.r
• B:\cAHa
• z:\&0U
• e:\D
• g:\Kr
• G:\g7
• h:\H&
• g:\pGj5
• I:\luo2
• Y:\tVP
• d:\Rz

More AntiVM samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report