MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668
SHA3-384 hash:	bf1311dff8e453442284b7837fe296ec9fdfbbc73575249ed641e0aed037b6aa5b454d3a293269c7c2e3f69dba2da2b3
SHA1 hash:	6c36c7ae724d70a213f2fb1c61049b7ce71414f1
MD5 hash:	f404e3c61291b76e8063c86d419f754e
humanhash:	salami-lemon-romeo-mockingbird
File name:	sagawa(3).apk
Download:	download sample
File size:	3'016'262 bytes
First seen:	2026-04-17 20:02:44 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:O9YiiOk+sQlv7mPnauVe5WfBNOXQcjJbgYzJrksfW5gipFKVq:OtA+Pv7mZk5WfBNzcjhgexLfW+i+Vq
TLSH	T1B4D5F045FB999E4EC8F393320C396635547AD827C703C283DD792679288BAF41F852E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

122

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.12243.31698.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69e2921fd920e1904400b2cd/reports/e46834ea-da41-45fc-a19f-4589abc0ef64/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/f404e3c61291b76e8063c86d419f754e/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-04-17T04:30:00Z UTC

Last seen:

2026-04-19T03:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668/

ReversingLabs TitaniumCloud Android.Trojan.Wroba

Threat name:

Android.Trojan.Wroba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-17 11:44:58 UTC

File Type:

Binary (Archive)

Extracted files:

122

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hhex7llfl36fvjf4g4bwsw4a5gahwfafb7u4q6c42bd5h4yfczua._file

Hatching Triage

Gathering data

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/39c97fad655efc5aa4bc3703695b80e9807b14050fe9c8785cd047d3f3051668