MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3
SHA3-384 hash:	149c50b6d3a25a09fc5cfdfe23db96c0a1f306ad221cd45ef0fd7350db6c3dce7abefba218427d379442ce9b177cc555
SHA1 hash:	c86c59c72030e3d4b4274bc498c5bef485a7a3d3
MD5 hash:	893d84bd5acbe4357c7d4da2810ab453
humanhash:	london-sodium-artist-orange
File name:	sagawa.apk
Download:	download sample
Signature	MoqHao Alert Create hunting rule
File size:	3'016'263 bytes
First seen:	2026-04-15 21:59:44 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:NcjJbgYzJrksfW5gipFKVRTTS0iSkXjFUkSwR0Q1+aBbNGAurPChbpCinv6QQ0Zi:NcjhgexLfW+i+VRnhsakiUBb8Au2hbcD
TLSH	T19AD5F055FB989F4EC8F393760C3A5636547AD827C7038383C8792679284BAF40F856E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk MoqHao signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

198

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.29552.10359.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69e00aa7d920e19044fd79c6/reports/ce0a3b04-049f-4603-957b-e3160235741e/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/893d84bd5acbe4357c7d4da2810ab453/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-04-15T16:40:00Z UTC

Last seen:

2026-04-16T10:49:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3/

ReversingLabs TitaniumCloud Android.Trojan.Multiverze

Threat name:

Android.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-15 22:01:26 UTC

File Type:

Binary (Archive)

Extracted files:

122

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eoho5ji3fvj76cftckp6nvv6owqtyeqjbzaghikfl6wwcqcu2szq._file

Hatching Triage xloader_apk

Result

Malware family:

xloader_apk

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xloader_apk android banker collection defense_evasion discovery evasion impact infostealer persistence trojan

Link:

https://tria.ge/reports/260415-1xbdzaay5r/

Behaviour

Checks CPU information

Uses Crypto APIs (Might try to encrypt user data)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries account information for other applications stored on the device

Queries the phone number (MSISDN for GSM devices)

Reads the content of the MMS message.

Checks if the Android device is rooted.

Family: XLoader, MoqHao

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/238eeea51b2d53ff08b3129fe6d6be75a13c12090e4063a1455fad614054d4b3