MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254
SHA3-384 hash:	32ae415f96d6661a77c57eb018175d0fbed4a27214ad99a1777c95e590319e522ca2986cbfe433a0c117ebe1ec278e73
SHA1 hash:	420ce94450a9c601d74e8f582b73e2a3d746b99c
MD5 hash:	bd4f6c073cc198101cd7f534a51a76ca
humanhash:	stairway-ceiling-diet-robin
File name:	sagawa(1).apk
Download:	download sample
Signature	Wroba Alert Create hunting rule
File size:	3'016'264 bytes
First seen:	2026-04-17 20:02:17 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:vCMv4opCB98uQWetkuwykJgZCYyzBVvkjnY596acjJbgYzJrksfW5gipFKV3:vcokIWc0haZsH8DAlcjhgexLfW+i+V3
TLSH	T17FD5F145FB999E1EC8F363760C3966365479D827C703C283DD792679288BAF00F852E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Wroba

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

169

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.7521.30090.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69e292105ea31bc68a3558e1/reports/242756c2-73fb-4785-983b-41c72aa5c825/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/bd4f6c073cc198101cd7f534a51a76ca/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-04-16T16:37:00Z UTC

Last seen:

2026-04-19T03:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254/

ReversingLabs TitaniumCloud Android.Trojan.Wroba

Threat name:

Android.Trojan.Wroba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-17 03:13:36 UTC

File Type:

Binary (Archive)

Extracted files:

122

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dwn5wnjdjma5egp5fdchur53vjwjam7cwhzvwb7rbtyj5lwqajka._file

Hatching Triage

Gathering data

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/1d9bdb35234b01d219fd28c47a47bbaa6c9033e2b1f35b07f10cf09eaed00254