Checking an APK Yourself: Package Name, SHA-256 and Permissions

Gaming APKs get copied and reshared constantly, and a repackaged file can hide code you would never knowingly install. Three checks tell you whether the file on your phone is the one the operator's lobby hands out: the package name, the SHA-256 hash and the permission list. None of them needs technical skill.

Where the real file comes from

The lobby's own Download App button is the source. Behind the scenes, the lobby reads its download address from a setting and, on 12 November 2026, that address served a file named BG678.apk. The invite link on our homepage opens the same lobby, so it hands out the same file. There is one build, not a separate one per link.

The operator can change the address whenever it likes. So a file with a different size or hash is not automatically fake, but it should still carry the same package name.

Check 1: the package name

Every Android app has a package name that works as a unique ID. Two different apps cannot share one on the same phone. The genuine app uses:

com.lottery.sbg678green

You can see it in Settings, then Apps, then the app's page, sometimes under App details or Advanced. Free APK info apps also show it before you install. If the package name is anything else, the file was not built by the operator, however familiar its green icon looks.

Check 2: the SHA-256 hash

A hash is a fingerprint of the file. Change a single byte and the fingerprint changes completely. This is what we recorded:

Detail	Value
File	BG678.apk
Package	com.lottery.sbg678green
Version	1.8.0 (version code 2)
Size	39,20,450 bytes (3.7 MB)
SHA-256	f4719f2dcd79f032a5d7ca6925f348db9f8479c4c175075a4fe441fa95f8f073
File date	13 August 2026
Android	7.0 and up, targets 16

To check, use a hash calculator app on your phone, or on a computer run certutil -hashfile BG678.apk SHA256 on Windows or shasum -a 256 BG678.apk on a Mac. If the result matches the line above, you have exactly the file we checked. If it differs, compare the package name and permissions before deciding anything, because the operator may simply have published a newer build.

Check 3: the permissions

The real app asks for:

• Internet, network state and Wi-Fi state, to load the lobby.
• Notifications and push messages.
• Keeping the phone awake during a game.
• Photos and storage, so you can upload a payment screenshot.
• The advertising ID and install referrer, which link an install to the invite that led to it.

It asks for no contacts, SMS, camera, location or microphone. A copy that requests any of those has been changed by someone, and the extra access is usually the point of the change. Delete it.

Signs a file is fake before you even check

• It came from a chat group, a file-sharing link or a stranger, not the lobby.
• It is far larger than 3.7 MB and promises "mod", "hack" or "predictor" features.
• The installer asks for accessibility or device admin access.
• The website offering it asks for your password or bank details before the download.

Where to go next

Our real app vs fake APK page covers the wider risks, and the install guide walks through installing the genuine file. If you think you installed a fake, uninstall it, change your password from a clean device, and read the account security guide.