Malware Analysis Report

2024-10-19 13:02

Sample ID 230213-lxmdxabg8t
Target 461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74.apk
SHA256 461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74
Tags
hook banker evasion infostealer ransomware rat trojan stealth
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74

Threat Level: Known bad

The file 461667544a618419230b256af9d682bce6c3238977bcc48144015f47c9550b74.apk was found to be: Known bad.

Malicious Activity Summary

hook banker evasion infostealer ransomware rat trojan stealth

Hook

Makes use of the framework's Accessibility service.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Removes its main activity from the application launcher

Acquires the wake lock.

Loads dropped Dex/Jar

Requests dangerous framework permissions

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Removes a system notification.

Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-02-13 09:54

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-13 09:54

Reported

2023-02-13 09:55

Platform

android-x86-arm-20220823-en

Max time kernel

1241299s

Max time network

51s

Command Line

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r N/A N/A
N/A /data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r N/A N/A

Reads information about phone network operator.

Removes a system notification.

evasion
Description Indicator Process Target
Framework service call android.app.INotificationManager.cancelNotificationWithTag N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
NL 142.250.179.202:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.250.179.174:443 android.apis.google.com tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
NL 142.251.39.106:443 infinitedata-pa.googleapis.com tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
US 1.1.1.1:853 tcp

Files

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/gjurkbgk.djff

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/tmp-base.apk.fwrjerw8296927813991617262.t5r

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r.x86.flock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.vdex

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/oat/x86/base.apk.fwrjerw1.odex

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/multidex.version.xml

MD5 78ddb5a6ffd93b7ea4995fe24baecad4
SHA1 afeac544ab9afe20872ea4392cd760e23bad41c2
SHA256 6a242bc8da4d6673fc910f26cb54411497f2e1a958ce4704717bd3a5dc222ffb
SHA512 59d729658fff98095433777f5fb55ba9b09171be768b8ac01370dca2e2d6e9e01e6fcf0a7bdf744ad39add8b540f2dfa4564a502f9a812d70e26d4846b23600c

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r

MD5 e0b52be632be5eb5c1b16f48e7cfc448
SHA1 32abed0e3399d5010a41e022e9bcbe3ddd38456f
SHA256 b43f7231b2f4428f2b38168755f89a8de469925e861c23ab7803c3b23fbb9165
SHA512 72f84075971054f529c676e8685e2fd9cf911e394acf31843b787a77c0d865309489351f4996fc3d742f8c9326be6a62f44d36af164ee0085af10aba84fc9e87

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r

MD5 395c37307268e4ad7f9e8ed2ed97da59
SHA1 4ad59de30af9b9e4324f52b55fc404fdcadf5110
SHA256 5fae89e74d46304a76d31c9bd9cbf80366b1597b2c9723b6380f892e0a28a705
SHA512 f71dd0c32896d84d44452df6461eb4a6a179212cfd0bd18fe7ce5e75b5ee7c8c24800cb6b29ffc7c1eeff6564a7537b5fcb96d82fed788cb303b6f098f232afd

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-journal

MD5 fad1ce6f58bdbca46c1025f6e1b856c1
SHA1 182f88d8d5b176d72d54312ee70d7d93a9b85958
SHA256 74c9f86176e122402a189894c2fb26575afc323cf4aa47ab89d1abb52e7b6cea
SHA512 31eed2d433fc643e0992f61734389459d91f2fdbaf2ded1ffd6e4a972d42a5dec50410a2957fcad244f41881f0271dcb86a2c182c50f4a69151fffdd4da3366f

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-wal

MD5 5f56252016783035bfd69ff1cbafc653
SHA1 7e6b5e92cb1bcb735a40470063f0b33f5910b79d
SHA256 18de0fa4b1a871dfbf1f4a5847d276bc85a5c7aa33e1f8cc75f0494991eb3326
SHA512 5dfc4316661fe175f49e96651a3dbf5c3c2bfb696e918a59c05edfff4e3056ac9806eed983f0fc04f8b2e8d3b55ab0e7eb4fbcb53b42d4a1c94f2032d06420b1

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-shm

MD5 7dea362b3fac8e00956a4952a3d4f474
SHA1 05fe405753166f125559e7c9ac558654f107c7e9
SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA512 1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/settings.xml

MD5 37a5018377e89fb59b6151daf70723c6
SHA1 9974cd7cb2e9d609e0f32c73d0d026c3bb1dec4f
SHA256 6d18fe3bc31cf6039f7f6ab7ef92fc7f84f1a2266438b29883a45b79025e98b5
SHA512 86483729a5630927b79fdccc36ba036ba8d6095cae174232423ec30fc2c2f3f1748218b5c3c015ef99ba60833b629f933e15b991533cdfe945b2ca02754b086c

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/WebViewChromiumPrefs.xml

MD5 21223e9184445fe043476484cd8cb1f9
SHA1 2b4813f849121d60ba35eb0889080668bb62c778
SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512 be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Web Data

MD5 dc79f9ce5f3ab5270b33e61119dfc959
SHA1 1844bf222a5144b513dcf2fb50a18c011701c647
SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA512 18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/metrics_guid

MD5 60406446f0782c2ad52074adb6b96cf2
SHA1 24408384eb8ab67848a95adcaab2b8e3c4dd55cb
SHA256 a6470fc28238af9255b402668bf022cc6f04c9103e7b385d57f9a503d8674bb7
SHA512 1d86d79b52fa0c269a6ce6a1927e192ba7272c341f30903559f8b446f4ef0edfc92bcf612fe4b4c84b64243b0ff07a0d6983d66d8ae9fb456a7228dada23711b

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Web Data-journal

MD5 449694e8e6e3fefca0c8df30b323b7be
SHA1 47dcc2cce856f64cb81745ff1a1ff52a41cbfc0b
SHA256 668f3eb2e9e9d8efa1d4c06f7a017dd96e95f744c4ed4e02227b85cd1f290a85
SHA512 9e6acbe977c92623da5b10855e79cf39445d97b041e15ed2b0182e2b80c5a7417f9273d92211e4b91e25ff8a91744cf7f005f21241b07ce2d8e8b4383dc1e0c9

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index

MD5 93027d42b314432c4216e6cfca48b384
SHA1 43448dd8102979c3926828182579691945eedd4e
SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512 a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index-dir/temp-index

MD5 ad8f6e17b2303cfd390985c11bc9c1b5
SHA1 db568ec172b7c4ad375dc71a93b1392bf834e098
SHA256 eee09479020822190252f5da3e54dde16d6685314517d84e33561ee473e9f71d
SHA512 26df1e750e2fc338bb554e5e4549851f59a890151e4671e1492aae4d694ffbe449eaf0ba79f5d41d7c8cd6f11474593944be9f87e596f29ec21b466cf3f6a2ca

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index-dir/temp-index

MD5 123c80c2c781a01c7436d348aefcbfe0
SHA1 6f7eb76f66f88f788357fc7892cbd1c2720bf2ec
SHA256 486d3588b783469a9e62ec2ea98b7834c731e93efe58af48b3532025c8f9d96b
SHA512 184113c120cd979ab6812f71974e5d06142db4787fab72e7102efef818a3b467ae1d2a9d16112b1c7f15008f7d899e9b6dc0b16421fbeffd7448d4e4eba76f57

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-13 09:54

Reported

2023-02-13 09:57

Platform

android-x64-20220823-en

Max time kernel

1245007s

Max time network

156s

Command Line

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Signatures

Hook

rat trojan infostealer hook

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r N/A N/A

Reads information about phone network operator.

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
RU 45.93.201.92:3434 45.93.201.92 tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
NL 142.251.36.40:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp

Files

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/gjurkbgk.djff

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/tmp-base.apk.fwrjerw313452631923146844.t5r

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r

MD5 e0b52be632be5eb5c1b16f48e7cfc448
SHA1 32abed0e3399d5010a41e022e9bcbe3ddd38456f
SHA256 b43f7231b2f4428f2b38168755f89a8de469925e861c23ab7803c3b23fbb9165
SHA512 72f84075971054f529c676e8685e2fd9cf911e394acf31843b787a77c0d865309489351f4996fc3d742f8c9326be6a62f44d36af164ee0085af10aba84fc9e87

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/multidex.version.xml

MD5 76e37070db51783172f0e8fa37e5bdc9
SHA1 e48c224d882b581e1395cf941a451e42eef15dcc
SHA256 01ce15d0c82514f50f39517e4e8ad9b21b0e533b80cdd64a0c6af2946d92ecb7
SHA512 7bde3cfe245c8cd8d3edd32bcf50fcc507b37c235e3163a0a0a4d0ee1073f0486a66a6e09963ec594e45235d88ad2a83a80f85521533de188d98ee3d7b6f9800

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb

MD5 b6ca8b30661a7844ed292db75a29a953
SHA1 8e0d397ab1f2ced1f143829084c3f53333743bdd
SHA256 63a219c7092be26641907c5f955aa977e7675e3922a8e4ee2af25bfed8c7bbfb
SHA512 d21ce3adf13d61369708ea000438f626973f20b08ca05a744c1cccb2d5e7c264a8af9c3ebd18a7a6a464d38e1c64146f8e881d29d71a0484dd94212315f6dceb

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-journal

MD5 07dbb14d5e560382f9cd30be3cd5b70b
SHA1 cf51a2c8841c4e436316f236fe25afd9dfaf95c3
SHA256 227eae59058e870f185da14d9a78aacca3d8171296238a733382002af64ac0e7
SHA512 4efcad9b2b8371ef520b9cd73f80fcbf3b4363c438c219b2318d02bb8fe18b9eed167d30c2e419cc2b9b7172b3bca9f97cabea9591b772e45cb3529fc9b85368

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-wal

MD5 9fdacfc9f1a051233754d31447439e22
SHA1 ff06cd7f28ccf0fc885db03fad555aaee73472ef
SHA256 b3e003382f6fa6090ed7b51201a8c82ba4d00efe195882d591c34e43ba419cd4
SHA512 5630f9c6c9e19d6fc17425329bc991d8c7ecc46e625f6ddda8de35dd631512af814e4c0a76b9736a1b4ac05f6ce9b19b60951dee292e2c1dfabf891ae11c372f

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-shm

MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/settings.xml

MD5 37a5018377e89fb59b6151daf70723c6
SHA1 9974cd7cb2e9d609e0f32c73d0d026c3bb1dec4f
SHA256 6d18fe3bc31cf6039f7f6ab7ef92fc7f84f1a2266438b29883a45b79025e98b5
SHA512 86483729a5630927b79fdccc36ba036ba8d6095cae174232423ec30fc2c2f3f1748218b5c3c015ef99ba60833b629f933e15b991533cdfe945b2ca02754b086c

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/WebViewChromiumPrefs.xml

MD5 6ef709b8536878951e87c29a1518fc2b
SHA1 24376c70b00152501b3d98df61fa7db435339172
SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
SHA512 96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/metrics_guid

MD5 8c7e82c587e0da22bdc88aa7e6f8e88b
SHA1 b3a04e7c6731e78905c41964648607ce9e93ac94
SHA256 318d41dfa9905cf3d390dd0d5b28d14412b37af1e6b5e548c473ee322b0338a7
SHA512 dfe82a80bb90e2fec362fbacbb8b8bc847ed3bfb7dd5d3f2e74afeef92aa89de3f102f681912ba2def9fa191165c154de0438ba9ba6e3a901376fcf2328a44f7

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Web Data

MD5 b663831f8cc130493476d94f2d7a5330
SHA1 043a1956ab8e40821d67043f8a9110a8eb36fb93
SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
SHA512 e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/org.chromium.android_webview/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Web Data-journal

MD5 d4c204a1ad0be4679279ab4e7c217082
SHA1 38408ba0d3b8a8527f5a090c42bc8d1f2b9e49e8
SHA256 c5cad4cd882df088627987db97dac7fcca6a05e032636902112ceeb18bd9b089
SHA512 be15d5a62414d832bb85a9ddac5c23239d8749f7c8e67ca4bdbdf198d3a2b38f6ac9e8ed72207cc8541f21b954f929dfb04eed87ba70eb6e8029b36f8c190560

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

MD5 6d5420c09e3d9b228edac15f024aa91b
SHA1 a10b7a265cecf99b13f98ac4812ae2bba401f67d
SHA256 deceb0136935acd5dcc420fde93ce7d3ce6911dce588de946bb2ed9af66d8c7f
SHA512 8e8e7cfc36fe90287f57f2bebe8fa09fdcfa6872b6d0ac8f1a4cd9aa42e46ad9db2d0c1439d597fb8be761f745f2bcdb88001ae4a8b4e07b54a158a5c3714820

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/GPUCache/index-dir/temp-index

MD5 34f1d13386804ca7148c59a1821142fe
SHA1 e14b99905a6a6eb520ddc58437e2414d9d68333f
SHA256 1c77ebcdcefade8fb49cfb366e596c31f2f71ef47bdb996719e5a3f7ced6e711
SHA512 f2d209ea430bab7bd26c6c1fc336054b594db1f8a012558b7fe3ff32c4dc788065244033866998f0bea00b63fc74b48a3c8844a653279c54981490525c617b8b

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/Crashpad/settings.dat

MD5 3e4f85d1ed7f04c884b40bb2c46e2565
SHA1 59cc33a0de79354fe8ae8991e8024d2946febdc6
SHA256 550658b0b3e22eb2364c5a79bdf178a3e67fd45efac12fa88a8dda6d3e11a8cc
SHA512 9d2a4e0203a223b954affed8cdca70bcc69428f2660a292474533560c87f763f3acde10b32b2b3381c8771b4eb39acf31ce21bafd3a346f0077b59f644494e67

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/.com.google.Chrome.7G1QIS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral3

Detonation Overview

Submitted

2023-02-13 09:54

Reported

2023-02-13 09:57

Platform

android-x64-arm64-20220823-en

Max time kernel

1245013s

Max time network

164s

Command Line

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Removes its main activity from the application launcher

stealth trojan
Description Indicator Process Target
N/A N/A N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Removes a system notification.

evasion
Description Indicator Process Target
Framework service call android.app.INotificationManager.cancelNotificationWithTag N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv

Network

Country Destination Domain Proto
US 1.1.1.1:53 growth-pa.googleapis.com udp
N/A 224.0.0.251:5353 udp
GB 216.58.208.110:443 tcp
GB 216.58.208.110:443 tcp
GB 216.58.208.110:443 tcp
GB 216.58.208.110:443 tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
NL 172.217.168.232:443 ssl.google-analytics.com tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
RU 45.93.201.92:3434 45.93.201.92 tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
US 1.1.1.1:53 accounts.google.com udp
NL 142.250.179.205:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
NL 142.251.39.109:443 accounts.google.com tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
NL 142.250.179.170:443 infinitedata-pa.googleapis.com tcp
US 1.1.1.1:53 yeyqvlcc udp
US 1.1.1.1:53 cqxbrszkpxviivd udp
US 1.1.1.1:53 gwdyuwwrnva udp
US 1.1.1.1:53 cqxbrszkpxviivd udp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 update.googleapis.com udp
US 1.1.1.1:53 update.googleapis.com udp
NL 142.251.36.3:80 update.googleapis.com tcp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 1.1.1.1:53 edgedl.me.gvt1.com udp
US 34.104.35.123:443 edgedl.me.gvt1.com tcp
NL 142.251.36.3:443 update.googleapis.com tcp
US 34.104.35.123:80 edgedl.me.gvt1.com tcp
US 1.1.1.1:53 android.apis.google.com udp

Files

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/gjurkbgk.djff

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/tmp-base.apk.fwrjerw3539101288229772460.t5r

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/rr7wgwovr9/wufulgggfswwoug/base.apk.fwrjerw1.t5r

MD5 e0b52be632be5eb5c1b16f48e7cfc448
SHA1 32abed0e3399d5010a41e022e9bcbe3ddd38456f
SHA256 b43f7231b2f4428f2b38168755f89a8de469925e861c23ab7803c3b23fbb9165
SHA512 72f84075971054f529c676e8685e2fd9cf911e394acf31843b787a77c0d865309489351f4996fc3d742f8c9326be6a62f44d36af164ee0085af10aba84fc9e87

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/multidex.version.xml

MD5 ba3fe98bb4a77be98705a98b7f4ba4ef
SHA1 d63afe837bac84b2d90a6166972b21204541dd8b
SHA256 4d0fb7d325531dd2bb6cb6dea280dc4e320ed59fd3cd0068d0b9bf26d87fa5a1
SHA512 8c976599c39213940d50e6b86170357fccd289b367f62a218e1b9b6161a2b691b7c1a9e79857eb5edcb835c3419e72457983e8b64a37bd669d046b8a4aed1ca4

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb

MD5 e579a6b00eef1318f9166352228eba18
SHA1 76988896854f0139083e77862eea1a4846cf039f
SHA256 4b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935
SHA512 c47632e957d87727bf6504a82ca7a44d8da24d30cd997a0f449a96e4f97c656a1b4d9da3fcd827e2a48c59677688da0b872358ebd0f9369d898d1b8ec18d5699

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-journal

MD5 6cf71ce6cfb3bef45d0d0743b7dd4b61
SHA1 c647ddf7952cd510a4d9c3f4366ff16929ca5f41
SHA256 843353bbd4b75b939109554e585fa11c0a87f9f6ed3d86ef421d834b7f65cc3c
SHA512 f06f324a2d84b790e1c7446b43a8e34ebb09561d2b239b61e0f83ed2be3247c855ae5cb2e00898b4181b4fb550f88f193901bab1cb2e9f00700e1c17be4b7dfe

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-wal

MD5 e548ab9ad5229923886a6b52ebc2ab6e
SHA1 ce074664a3b0bedcbc1e19dc5ac366e45a5002c6
SHA256 c9721caaf50f3d767a59575a9f5cac67ba714206d7764aa11ad1c53a265936c6
SHA512 1000cb53b2aff5f2703e3919174f664d2695874a3aa18273c1b8b41869b18a9dc2e1e90ad87d7199c7b7b0b602a53e8f230fc384ada0dc63464fe9dee59b12c9

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/no_backup/androidx.work.workdb-shm

MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/settings.xml

MD5 37a5018377e89fb59b6151daf70723c6
SHA1 9974cd7cb2e9d609e0f32c73d0d026c3bb1dec4f
SHA256 6d18fe3bc31cf6039f7f6ab7ef92fc7f84f1a2266438b29883a45b79025e98b5
SHA512 86483729a5630927b79fdccc36ba036ba8d6095cae174232423ec30fc2c2f3f1748218b5c3c015ef99ba60833b629f933e15b991533cdfe945b2ca02754b086c

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/shared_prefs/WebViewChromiumPrefs.xml

MD5 97ccd9a2b2063143df56b6937f961ca4
SHA1 5e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA512 86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/webview_data.lock

MD5 1944ced0cbb9013e73494375c8ea0f53
SHA1 047b4f1be4cd464e431c4a68a5e4c66634167ff7
SHA256 0653662ebbbd04acf327cc6ac65e5c02dd47f61e66251f836805e6994bb4b32f
SHA512 028da0d8ad5b4a9527903ae380e935cf6a0297079ec1da82d84f58dcf5b0c9d55990433edd35f4b68d46dd4297238ac8fc659dfd2558910950c9d20880dabf28

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Web Data

MD5 a48cd9324b1f8754b07f00d863b840f3
SHA1 11c6614775b35a58f440971dfc87c8aaac6d6173
SHA256 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA512 35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Web Data-journal

MD5 b506d0f78dfe7ac6173c752c2c9f0eb1
SHA1 a7f91b156a1955c11eac255bcffd45db519c400d
SHA256 0b0b8a3da65d782cceffa21ec4b9ae104f0c3992bc1c34ef2df20eaba94d7fa2
SHA512 85126aae59df7e85e7f22054fa9d70463764052bf1609a06aae2e8fe0bc391951ae8b2c8418864f857c907e106f460da8a28b74a64a2d89faa9f64cca981587e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/Default/HTTP Cache/Code Cache/js/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/GPUCache/index

MD5 6d7d499960179766cd4261d12dacc411
SHA1 e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA512 6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/GPUCache/index-dir/temp-index

MD5 bd418f6de0c559060778a30a371e323b
SHA1 33d3f2e4f4b07c3cb468d7997fc62012c708774d
SHA256 96f981c7c146639aaecf22fb3a98391a24fd4c56c299610b0be2e52897b127e5
SHA512 e65c1ab035784d0e1410b90f237f765dec0137ba237422bfc88851d26d44952a90bc1265d4877719e74ed263729325185904abf07f8ee00b240f360f29ac62b8

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

MD5 141afb0e682bbb874c687d81c0d207fa
SHA1 9a84791bfd14ea83b737c5a2e5658fa0e6478163
SHA256 b50c2be39a72441926833140205b40df017091c994f667e9837597404e64eb28
SHA512 ef2a7cddb609c61bd3c0f674c53cfbc14570a954403aa0a2467191df7d645739e5d84828eaa3aecb52f2409cdbfb862307d50a002f71566746d1f13bb404e305

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

MD5 c24133c20d7043dac8da1ec285b38282
SHA1 03dc8267086b983484324f6e9be6e8208dd70b3f
SHA256 55fa56238712d9f38a67372d36e70fcf352c5043e2986454c73033f9c853d626
SHA512 8bc5cfcc71415f289ab17ec145da3f191978bcdb10e747d30ac9779c8d5897687f54d36a098befbf155eee27fedaf69ae293e29ece34395337bfa52db69c7ed9

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/Crashpad/settings.dat

MD5 befda864b0664a9a06cdda0d03ab009b
SHA1 1bccd70541ab0ad3c0d2d2963aa4a6c8bfc626b6
SHA256 54d8b3ee6683dbef2071f8799bbec3bb39b633f22ff39b4806aad5cf3730c12b
SHA512 a4924ef75b8cf8f936ebc6b3b164d23e16a7c618b3399ac8f2d6655cf5dee4dc4d1b429dbd76ff544cceddb9d077ba2a629f2586cc09e347afd1412db2a7445a

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/cache/WebView/font_unique_name_table.pb

MD5 f080fa2a56ab5479d58063e5ea871447
SHA1 4b3fd57a98916fa5784305b76ba30af26b5253d9
SHA256 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA512 8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Session Storage/LOG

MD5 0e6b73e9be2d14349a1f571d9b48ead5
SHA1 62a68d70a7ef4c5c41b146dde52f0db71211d868
SHA256 6303c702275d11d6b85b910c725b6b97fc1cebd5a97925ba73838d34964a7742
SHA512 fb1684f74c0236a0f8ce249e0edff6794509686e208c7c72f4d5e2dd21cb0bef28df9ab10582476488efb377e942c630332cae054da7d36292c21f48771244ef

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Session Storage/LOCK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Session Storage/MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Session Storage/000001.dbtmp

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/Default/Session Storage/000003.log

MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

/data/user/0/com.cmdomdoz.bgxcvvyj.zmwjypsw.oyvfwgnv/app_webview/.com.google.Chrome.YyVMeS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e