SUSPICIOUS — 7e244e100771f63b7dcf3c0f678746c9b46b5be5093736558663a5528a2b49f1.bin

SUSPICIOUS — 7e244e100771f63b7dcf3c0f678746c9b46b5be5093736558663a5528a2b49f1.bin is a apk sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (65/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 7e244e100771f63b7dcf3c0f678746c9b46b5be5093736558663a5528a2b49f1
• SHA-1: 3727df280d7d3872d81d8d4d23aae011cd6cc576
• MD5: 70061c4d4002921b837433c5cdd03da4
• ssdeep: 24576:T61/F42Ge7mYZ8Vn0qaBx1wHYLfarQ9GT+p7j:T6NF2BPkv/GKdj
• TLSH: T1FB55E1ACFF43470BE59D346C48E0935F81F86E62916DC342239660DA7140AF7EBAE512
• Submitted as: 7e244e100771f63b7dcf3c0f678746c9b46b5be5093736558663a5528a2b49f1.bin
• File type: apk · Size: 1308763 bytes
• Verdict: suspicious (65/100)

Source: MalShare · first seen 2026-09-20T15:37:48.610Z · SHA-256 verified

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Kaspersky (KVRT): HEUR:Trojan-Downloader.AndroidOS.Creduz.a

Why this verdict

The suspicious score of 65/100 is the fusion of 4 weighted signals:

• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.AndroidOS.Creduz.a (rule HEUR:Trojan-Downloader.AndroidOS.Creduz.a) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• archive:unopenable — contents were NOT scanned: extraction failed: Command failed: 7zz x -y -bd -bso0 -bsp0 -pzippw -o/tmp/tl-collect-Uev049/out -- /tmp/tl-collect-Uev049/sample.archive ERROR: Wrong password : kotlin/...9.png ERROR: E_FAIL : Unspecified error - static signal, weight 0.00, confidence 0.00

Dynamic analysis

This apk is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded domains

• k.sh
• o.io
• n.ir

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report