MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf
SHA3-384 hash:	218b955f73f0faff5013867e820cdde593b9b7f2f1d8d14edba45b2871d7b3c5bb7e1e8f8a42c879fe521c3c8f1351ac
SHA1 hash:	2e41caaa2d0e05f1031789fa3ae2e463a04b2889
MD5 hash:	5c4813cd5b61af04b5833997ad9350a4
humanhash:	victor-eleven-east-green
File name:	sagawa(3).apk
Download:	download sample
Signature	MoqHao Alert Create hunting rule
File size:	2'995'727 bytes
First seen:	2026-04-10 16:19:11 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:zkrm/jqGFBwKve9RiBf4MgqHwUXIZbhsqZyg9C6BbO+buLDSI5sF9CcYD:zkrm75TgAAMgqHw48ONg9NbOW7DYD
TLSH	T171D50155FB999F1EC8F353360D396636547AE823C713C383D9692678288BAF00F452E9
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk MoqHao signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

183

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.20588.27186.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69d9230d5ea31bc68a1e667f/reports/b533d37a-9b56-4ef9-8604-16572cee85ad/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/5c4813cd5b61af04b5833997ad9350a4/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-03-31T16:36:00Z UTC

Last seen:

2026-04-10T23:54:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf/

ReversingLabs TitaniumCloud Android.Infostealer.Anubis

Threat name:

Android.Infostealer.Anubis

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-01 01:10:38 UTC

File Type:

Binary (Archive)

Extracted files:

121

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tl7vqo4bfi4xsokp7tjd6ylnkyna5wsaalzofjfuf2s3upx5x6xq._file

Hatching Triage xloader_apk

Result

Malware family:

xloader_apk

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xloader_apk android banker collection defense_evasion discovery evasion impact infostealer persistence trojan

Link:

https://tria.ge/reports/260410-tsp81abx9y/

Behaviour

Checks CPU information

Uses Crypto APIs (Might try to encrypt user data)

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries account information for other applications stored on the device

Queries the phone number (MSISDN for GSM devices)

Reads the content of the MMS message.

Checks if the Android device is rooted.

XLoader, MoqHao

Xloader_apk family

Malware Config

C2 Extraction:

http://198.144.149.133:38899

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/9aff583b812a3979394ffcd23f616d561a0eda4002f2e2a4b42ea5ba3efdbfaf