MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f
SHA3-384 hash:	4b3d775ae7e3ed059d445c7df65eeb3c2e909bce7b90f24f822815d7cb57eb3ae43626c1a889e7354d29bb94385685f7
SHA1 hash:	6479eb53cff0cf75bbfd78f9295251c4db60dd5e
MD5 hash:	8f5d94acc22c5593ea2350f676e4846a
humanhash:	foxtrot-cola-pennsylvania-solar
File name:	sagawa(4).apk
Download:	download sample
File size:	3'016'266 bytes
First seen:	2026-04-17 20:02:57 UTC
Last seen:	Never
File type:	apk
MIME type:	application/zip
ssdeep	49152:7cjJbgYzJrksfW5gipFKVZR1WO/esOagDFehJ7AZ9mZEAXuhq+96U:7cjhgexLfW+i+VZRQO/esONiAZNAcT
TLSH	T113D5F145FB999E1EC8F353760C39563A547A9823C743C383D9792679288FAF00F862E5
TrID	60.6% (.APK) Android Package (27000/1/5) 30.3% (.JAR) Java Archive (13500/1/2) 8.9% (.ZIP) ZIP compressed archive (4000/1)
Magika	apk
Reporter	BastianHein
Tags:	apk signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

137

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Android.Banker.739.origin.13926.24303.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

android bankbot base64 evasive expand fingerprint lolbin persistence signed

Link:

https://www.filescan.io/uploads/69e2922c799d5bf325056f9a/reports/ee43827d-6478-448f-89de-bffd15e185fd/overview

Incinerator Dangerous

Result

Link:

https://incinerator.cloud/#/public/report/8f5d94acc22c5593ea2350f676e4846a/detail

Application Permissions

read/modify/delete external storage contents (WRITE_EXTERNAL_STORAGE)

read external storage contents (READ_EXTERNAL_STORAGE)

receive SMS (RECEIVE_SMS)

read SMS or MMS (READ_SMS)

send SMS messages (SEND_SMS)

read phone state and identity (READ_PHONE_STATE)

view Wi-Fi status (ACCESS_WIFI_STATE)

change network connectivity (CHANGE_NETWORK_STATE)

view network status (ACCESS_NETWORK_STATE)

change your audio settings (MODIFY_AUDIO_SETTINGS)

automatically start at boot (RECEIVE_BOOT_COMPLETED)

prevent phone from sleeping (WAKE_LOCK)

full Internet access (INTERNET)

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

apk

First seen:

2026-04-16T10:42:00Z UTC

Last seen:

2026-04-19T03:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

APK

Link:

https://malprob.io/report/adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f/

ReversingLabs TitaniumCloud Android.Trojan.Wroba

Threat name:

Android.Trojan.Wroba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-16 19:41:07 UTC

File Type:

Binary (Archive)

Extracted files:

122

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vxx4f5tgvkjwoy5rqmaeismv4hjkjqmvb3yak566pkedqg4clqpq._file

Hatching Triage

Gathering data

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/adefc2f666aa936763b18300444995e1d2a4c1950ef00577de7a88381b825c1f