MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba
SHA3-384 hash:	06a61cab43a9b7cf54ea3a48a6f79c691016c7bb8f9b77a205ae04b9af541375f2e56fb6806eace1f4d0d89da18432d4
SHA1 hash:	f1a8d2d55aeed8a3cbb1cf8bdd078e7fdc0f343d
MD5 hash:	affd708b133f0e189ae911172b127c36
humanhash:	fillet-cold-finch-nebraska
File name:	sagawa.apk
Download:	download sample
Signature	MoqHao Alert Create hunting rule
File size:	3'003'919 bytes
First seen:	2026-03-24 18:19:08 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:SWhfGorQy2IIRwtEgsFZ9hLjJ4Rgha/Gjp/pOP9gPoUJ3QxjrffKHt:SSuAsfRiEgK/LjedOl/pOPWNpMjrnw
TLSH	T14CD50144FB999F5EC8F353360D396636147AD827C703C283D9382679284BAF40F866E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk MoqHao signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

220

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.31164.27595.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Android.Banker.739.origin.4422.23492.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69c2d5aa0ab403384b578d29/reports/254a7cf9-dc99-4f00-a6ac-bbf78eb3d40e/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/affd708b133f0e189ae911172b127c36/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

Link:

https://opentip.kaspersky.com/2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba/results?tab=lookup

Nucleon Malprob Susipicious

Score:

63%

Verdict:

Susipicious

File Type:

APK

Link:

https://malprob.io/report/2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba/

ReversingLabs TitaniumCloud Android.Trojan.Ravartar

Threat name:

Android.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-24 06:52:59 UTC

File Type:

Binary (Archive)

Extracted files:

121

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f5mvwmdhk3zzwdkslmm5l5ob2uff4z3b5icjuy5dsdwd4zyjuk5a._file

Hatching Triage xloader_apk

Result

Malware family:

xloader_apk

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xloader_apk android banker collection defense_evasion discovery evasion impact infostealer persistence trojan

Link:

https://tria.ge/reports/260324-wyck7shs5w/

Behaviour

Checks CPU information

Uses Crypto APIs (Might try to encrypt user data)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries account information for other applications stored on the device

Queries the phone number (MSISDN for GSM devices)

Reads the content of the MMS message.

Checks if the Android device is rooted.

XLoader, MoqHao

Xloader_apk family

Malware Config

C2 Extraction:

http://198.144.149.133:38899

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/2f595b306756f39b0d525b19d5f5c1d50a5e6761ea049a63a390ec3e6709a2ba