File search engine

124.218.219.90 · OK影视Pro-手机版-绿化.apk

Taiwan · Asia Pacific On-line Service Inc.

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: dc2cea50548968784260e0a6374a25125e12ab11
SHA256: 4384e1f0b77923471af12d70243205edede23690e735e20acf714de0529a7d92
application/octet-stream
75.83MB
1970-01-01 00:00:00 +0000 UTC

qq.370495.com · btv内置源6.1.9.apk

/btv/

Singapore · ACE

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 760c1e6c717e39aa065c07f77f22366360f31fb4
SHA256: 5e7ed1cea3a2fcbc955f83c176b25970d06560575b050099402bab47b5ebb639
application/octet-stream
39.05MB
2026-03-19 18:43:40 +0000 UTC

168168.best · ysc6.2.0.apk

/

· Cloudflare, Inc.

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: b69f3d2fb65901eb370fbbf742c8caed96c177e1
SHA256: fd1b68f2eb7c9b02b2fb08069e6ad6476450a70514f970e496e499c73f7632db
application/octet-stream
37.29MB
2026-04-19 14:26:30 +0000 UTC

168168.best · ysc6.2.0.apk

/

· Cloudflare, Inc.

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: b69f3d2fb65901eb370fbbf742c8caed96c177e1
SHA256: fd1b68f2eb7c9b02b2fb08069e6ad6476450a70514f970e496e499c73f7632db
application/octet-stream
37.29MB
2026-04-19 14:26:30 +0000 UTC

qq.370495.com · btv内置源6.1.9.apk

/btv/

Singapore · ACE

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 760c1e6c717e39aa065c07f77f22366360f31fb4
SHA256: 5e7ed1cea3a2fcbc955f83c176b25970d06560575b050099402bab47b5ebb639
application/octet-stream
39.05MB
2026-03-19 18:43:40 +0000 UTC

124.218.219.90 · OK影视Pro-手机版-绿化.apk

/SD/★APK/Media/

Taiwan · Asia Pacific On-line Service Inc.

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: ad44f97194ce2e2196d4af9edbf20ff4a0d3bc39
SHA256: 8b85e79beb243362e71c085864a92b65dbd4e8c3bb9603e8e4ce03840bd23bea
application/octet-stream
75.83MB
1970-01-01 00:00:00 +0000 UTC

mail.reveantivirus.com · Malware Samples.zip

/reveantivirus.com/linux/Builds/Abhishek_Samples/

United States · IO INC

Yara INDICATOR_EXE_Packed_Dotfuscator From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_UPolyX From AlienVault by ditekSHen

Yara SUSP_XORed_MSDOS_Stub_Message From Florian Roth by Florian Roth

Yara INDICATOR_EXE_Packed_ConfuserEx From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Fody From AlienVault by ditekSHen

Yara Base64_encoded_Executable From Florian Roth by Florian Roth (Nextron Systems)

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Yara Disable_Defender From AbuseCH by iam-py-test

Yara INDICATOR_EXE_Packed_RLPack From AlienVault by ditekSHen

Yara Win32_Ransomware_WannaCry From ReversingLabs by ReversingLabs

Yara INDICATOR_EXE_Packed_SmartAssembly From AlienVault by ditekSHen

Yara Nanocore_RAT_Gen_2 From Florian Roth by Florian Roth (Nextron Systems)

Yara IronTiger_Gh0stRAT_variant From Florian Roth by Cyber Safety Solutions, Trend Micro

Yara INDICATOR_EXE_DotNET_Encrypted From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_VMProtect From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_AgileDotNet From AlienVault by ditekSHen

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Yara IMPLANT_4_v7 From Florian Roth by US CERT

Yara INDICATOR_EXE_Packed_MPress From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Goliath From AlienVault by ditekSHen

Yara Typical_Malware_String_Transforms From Florian Roth by Florian Roth (Nextron Systems)

Yara INDICATOR_EXE_Packed_aPLib From AlienVault by ditekSHen

Yara Win32_Ransomware_CryptoJoker From ReversingLabs by ReversingLabs

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

SHA1: 25723bcf7b71640744b171137b9c0e0f4e6928cc
SHA256: 8f43cb46c9f22dce26ec5483c8060252b409faf31bef1f813d90c33515d0191e
application/zip
1.29GB
2018-06-21 08:03:32 +0000 UTC

qq.370495.com · btv内置源6.1.9.apk

/btv/

Singapore · ACE

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 760c1e6c717e39aa065c07f77f22366360f31fb4
SHA256: 5e7ed1cea3a2fcbc955f83c176b25970d06560575b050099402bab47b5ebb639
application/octet-stream
39.05MB
2026-03-19 18:43:40 +0000 UTC

124.218.219.90 · OK影视Pro-手机版-绿化.apk

/SD/★APK/Media/

Taiwan · Asia Pacific On-line Service Inc.

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: f71f3f6968e2ba920eca7da27e17f32ab4538214
SHA256: 8e97afe819f532d1fb627376ad394e76a0040b010d007f552592c070931f3bb6
application/octet-stream
75.83MB
1970-01-01 00:00:00 +0000 UTC

monster.xe-xe.org · philz_touch_6.26.7-aries-signed.zip

/files/

Ukraine · Telecommunication company FEONET+ LLC

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 8558c7d618080c87126adc877f4c6b8f32b6a2c2
SHA256: 55f8fab632ebeead67c464cf1db2c39690006afe99c71e335f31ee8dce63a75c
application/octet-stream
2.45MB
1970-01-01 00:00:00 +0000 UTC

51.81.35.225 · xbvstr.sig.gz

/aviraupdate/x_vdf/

United States · OVH SAS

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 9140f6c2a43007a0c2119651cd131642877fe672
SHA256: 28518ea1b7c912745eb071a57fa07c3eb75ca82c8bf9ac7059ecd56cf0a533b2
application/x-gzip
557.25KB
2026-06-23 06:43:09 +0000 UTC

51.81.35.225 · xbvpe.sig.gz

/aviraupdate/x_vdf/

United States · OVH SAS

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 2d1410a97cfa2f649add031dde6af9c37adc966e
SHA256: f5864443898cb1eb85cbe623838c3d1815e704a25ec71d06ecd49137025d1b09
application/x-gzip
1.80MB
2026-06-23 06:43:09 +0000 UTC

1.192.253.37 · ENAPPOLD_2.1.32.18001(20230908141340).apk

/

China · Chinanet

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

SHA1: 928ae822e793b4febfbb28ec3db9df618f030499
SHA256: c56dbf7984de749345b176ed421159ce78db6c61b43759e43d3ba8be817f3e28
application/octet-stream
133.51MB
2026-05-01 04:59:59 +0000 UTC

72.21.26.166 · Malware Samples.zip

/reveantivirus.com/linux/Builds/Abhishek_Samples/

United States · IO INC

Yara INDICATOR_EXE_Packed_Dotfuscator From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_UPolyX From AlienVault by ditekSHen

Yara SUSP_XORed_MSDOS_Stub_Message From Florian Roth by Florian Roth

Yara INDICATOR_EXE_Packed_ConfuserEx From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Fody From AlienVault by ditekSHen

Yara Base64_encoded_Executable From Florian Roth by Florian Roth (Nextron Systems)

Yara detect_Redline_Stealer From AbuseCH by Varp0s

Yara Disable_Defender From AbuseCH by iam-py-test

Yara INDICATOR_EXE_Packed_RLPack From AlienVault by ditekSHen

Yara Win32_Ransomware_WannaCry From ReversingLabs by ReversingLabs

Yara INDICATOR_EXE_Packed_SmartAssembly From AlienVault by ditekSHen

Yara Nanocore_RAT_Gen_2 From Florian Roth by Florian Roth (Nextron Systems)

Yara IronTiger_Gh0stRAT_variant From Florian Roth by Cyber Safety Solutions, Trend Micro

Yara INDICATOR_EXE_DotNET_Encrypted From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_VMProtect From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_AgileDotNet From AlienVault by ditekSHen

Yara SUSP_NET_NAME_ConfuserEx From Florian Roth by Arnim Rupp

Yara IMPLANT_4_v7 From Florian Roth by US CERT

Yara INDICATOR_EXE_Packed_MPress From AlienVault by ditekSHen

Yara INDICATOR_EXE_Packed_Goliath From AlienVault by ditekSHen

Yara Typical_Malware_String_Transforms From Florian Roth by Florian Roth (Nextron Systems)

Yara INDICATOR_EXE_Packed_aPLib From AlienVault by ditekSHen

Yara Win32_Ransomware_CryptoJoker From ReversingLabs by ReversingLabs

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

SHA1: 5028ffe8ba02330d503e300d54fed8342700e655
SHA256: 7e985b35510807e3b77148f0a4d5287c795c138e9229a6bbc2d1a7dec957a4e3
application/zip
1.29GB
2018-06-21 08:03:32 +0000 UTC

monster.xe-xe.org · philz_touch_6.26.7-aries-signed.zip

/files/

Ukraine · Telecommunication company FEONET+ LLC

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 8558c7d618080c87126adc877f4c6b8f32b6a2c2
SHA256: 55f8fab632ebeead67c464cf1db2c39690006afe99c71e335f31ee8dce63a75c
application/octet-stream
2.45MB
1970-01-01 00:00:00 +0000 UTC

176.114.33.36 · philz_touch_6.26.7-aries-signed.zip

/files/

Ukraine · Telecommunication company FEONET+ LLC

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 8558c7d618080c87126adc877f4c6b8f32b6a2c2
SHA256: 55f8fab632ebeead67c464cf1db2c39690006afe99c71e335f31ee8dce63a75c
application/octet-stream
2.45MB
1970-01-01 00:00:00 +0000 UTC

171.225.4.201 · BkavEnterpriseSetup.exe

/BAO MAT/BKAV/BKAV Enterprise AI Enpoit/

Vietnam · Viettel Group

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

SHA1: 6587cba02458f2cf9c976a2d4ffd3fa061873113
SHA256: 00acd5e03dbc64a22c2d6f99a50e43d14780bd15468e9059ec04c4d7086c853d
application/x-msdownload
327.20MB
2026-03-27 15:02:42 +0000 UTC

176.114.33.36 · philz_touch_6.26.7-aries-signed.zip

/files/

Ukraine · Telecommunication company FEONET+ LLC

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 8558c7d618080c87126adc877f4c6b8f32b6a2c2
SHA256: 55f8fab632ebeead67c464cf1db2c39690006afe99c71e335f31ee8dce63a75c
application/octet-stream
2.45MB
1970-01-01 00:00:00 +0000 UTC

124.218.219.90 · OK影视Pro-手机版-绿化.apk

/SD/★APK/Media/

Taiwan · Asia Pacific On-line Service Inc.

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: dc3aee7590797e2c93a9d5f67255e5eb872012ca
SHA256: 79c09ed86616b0c86e2a72271fffb9200e3f933ac266ac0e950510824506a9df
application/octet-stream
75.83MB
1970-01-01 00:00:00 +0000 UTC

51.195.47.11 · xbvstr.sig.gz

/aviraupdate/x_vdf/

Germany · OVH SAS

Yara SUSP_XORed_Mozilla From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 9140f6c2a43007a0c2119651cd131642877fe672
SHA256: 28518ea1b7c912745eb071a57fa07c3eb75ca82c8bf9ac7059ecd56cf0a533b2
application/x-gzip
557.25KB
2026-06-23 07:55:51 +0000 UTC