MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704
SHA3-384 hash:	053e19c7c0bc9af6907224d922b4a47d0024341c0a7546c03286730db0a92c17357c0bfc3368e09afb027fd9bc407711
SHA1 hash:	26b13151a6097a32af22da9fe2ac30b39cfb1353
MD5 hash:	42e842d51844b7b9f8e095201c14534f
humanhash:	finch-nevada-hamper-alanine
File name:	sagawa.apk
Download:	download sample
Signature	Wroba Alert Create hunting rule
File size:	3'016'260 bytes
First seen:	2026-04-17 20:02:03 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:hBlSbQn3j1ZEemqlutKNXef2GKX0+wLpCw9lcjJbgYzJrksfW5gipFKV5p:hBwQJZbmGNOOkf/vcjhgexLfW+i+VT
TLSH	T17AD50145FB989F5EC8F393760C396635547AD827C703C283C9792679248BAF40F862E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed Wroba

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

147

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.30941.32570.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69e29212d920e1904400b2bd/reports/3c166bf9-2787-490e-b8f7-24495a480f82/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/42e842d51844b7b9f8e095201c14534f/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-04-16T16:34:00Z UTC

Last seen:

2026-04-19T03:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704/

ReversingLabs TitaniumCloud Android.Trojan.Wroba

Threat name:

Android.Trojan.Wroba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-17 03:11:22 UTC

File Type:

Binary (Archive)

Extracted files:

122

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fn7aitw23nutfqsr6ilj3ifho67vkosutitdyxekbt45rcgo44ca._file

Hatching Triage

Gathering data

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/2b7e044edadb6932c251f2169da0a777bf553a549a263c5c8a0cf9d888cee704