MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3
SHA3-384 hash:	1ebce10843d0cf2bd9301a49a7f787bf14fde149debab667f43caa1e2e751b38e9c3aabd6194b293f0b082743a4bf820
SHA1 hash:	a24e6d8ea5593775230dc4c11ab6a69a1c4ebb6a
MD5 hash:	bf16e2bfc1ec84b59406a3fa03fc8a98
humanhash:	maryland-violet-red-uncle
File name:	sagawa(2).apk
Download:	download sample
File size:	3'016'259 bytes
First seen:	2026-04-17 20:02:30 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:lcjJbgYzJrksfW5gipFKVKU8d2GtULzFVhpVYTcOWMoUoGtTK596D:lcjhgexLfW+i+VHS9qvFrpVYTcOWHttu
TLSH	T19FD5F044FB999E5EC8F793760C396635547AD827C703C383C8792679648BAF40F822E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.17227.31258.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69e2920e5ea31bc68a3558de/reports/117ce5be-022a-4715-a81b-70cac8df603a/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/bf16e2bfc1ec84b59406a3fa03fc8a98/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-04-16T16:37:00Z UTC

Last seen:

2026-04-19T03:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3/

ReversingLabs TitaniumCloud Android.Trojan.Wroba

Threat name:

Android.Trojan.Wroba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-17 03:14:04 UTC

File Type:

Binary (Archive)

Extracted files:

122

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c6ti4mxf3a4yze3zbk7jwel4i4svpnkmzxh4z7o5wo37pa6kggzq._file

Hatching Triage

Gathering data

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/17a68e32e5d8398c93790abe9b117c472557b54ccdcfccfdddb3b7f783ca31b3