Resubmissions

29/05/2024, 07:44

240529-jk595sfd9x10

20/05/2024, 06:02

240520-grv2msfc7v10

27/10/2023, 07:30

231027-jb7fvaef2810

Analysis

  • max time kernel
    67s
  • max time network
    339s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    20/05/2024, 06:02

General

  • Target
    signal.apk
  • Size 79.1MB
  • Sample240520-grv2msfc7v
  • SHA256 549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • BadBazaar

    BadBazaar is an Android spyware used by GREF APT group.

  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • org.thoughtcrime.securesmsplus
    1⤵
    • Makes use of the framework's foreground persistence service
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4306

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .version

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/.version
        • Size 110B
        • SHA256 6c05e4eb4f0e8ebc9ffbb29db5095028eb39b17fd5fb41078ae69cecb61e7c1d
        • MD5 SHA1 SHA512

        .names

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/.names
        • Size 169B
        • SHA256 db6ebe5f9d38b2450aa09549a1db1f9a66c39344983f4b118939b226f6556fe2
        • MD5 SHA1 SHA512

        .names

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/.names
        • Size 235B
        • SHA256 db24aa032a4fe28e4991d6ab844dfa2f8de828317f0c048c30067bdc2d184048
        • MD5 SHA1 SHA512

        .names

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/.names
        • Size 301B
        • SHA256 ec3cdf217ede68b712d0a6c5e6bd54617117aa0c80105e909a5a4885d15075b4
        • MD5 SHA1 SHA512

        .names

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/.names
        • Size 367B
        • SHA256 116f74c0651c9090088688b67cdade791e019e29a46ecebf4657624e003e8031
        • MD5 SHA1 SHA512

        .names

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/.names
        • Size 433B
        • SHA256 1d33432f5a9f171ff4aa7a48fca6b6ae4f96dab4abdd1dd4f9e38812b09761f3
        • MD5 SHA1 SHA512

        .names

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/.names
        • Size 1KB
        • SHA256 337cde28165ee3283173cb275aaacd100f9387c958c1586be5e3ab2e9557798d
        • MD5 SHA1 SHA512

        01fd5973-ccfd-405a-9f34-41cb1f2fcd13

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/01fd5973-ccfd-405a-9f34-41cb1f2fcd13
        • Size 295KB
        • SHA256 1bf92b669eb93fdc04d9ef6fc6fca53739a81e72bb89fd2dbcffd13e74b52254
        • MD5 SHA1 SHA512 SSDEEP

        0956cd2a-5895-4385-83c9-f91e73bc9028

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/0956cd2a-5895-4385-83c9-f91e73bc9028
        • Size 285KB
        • SHA256 84f42dc7c6cce5c0743d5850ca0914cd5807f921dc274e040943aed0ee5ae2a7
        • MD5 SHA1 SHA512 SSDEEP

        1b817c80-3e83-4a87-a3aa-383c6c3ccf71

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/1b817c80-3e83-4a87-a3aa-383c6c3ccf71
        • Size 155KB
        • SHA256 3527dac6ac01f06d79e2d00a4878c3e5643fa50bb6fe2438216e6e1e82e58d15
        • MD5 SHA1 SHA512 SSDEEP

        1c179dd6-6e62-4552-a07a-f0b3bd1242c8

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/1c179dd6-6e62-4552-a07a-f0b3bd1242c8
        • Size 97KB
        • SHA256 61aae44f11e9a5d8c485468e18ec8a44448628ba728c3528699c93ff43792f76
        • MD5 SHA1 SHA512 SSDEEP

        2309e873-6fab-44ed-a917-9b7cc521c189

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/2309e873-6fab-44ed-a917-9b7cc521c189
        • Size 319KB
        • SHA256 9a64e30c201db856568cbfc4e5c888771b5758915929f0d59b254db34a75c8e2
        • MD5 SHA1 SHA512 SSDEEP

        2716612b-01c0-4d15-aeab-8549d597a90f

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/2716612b-01c0-4d15-aeab-8549d597a90f
        • Size 283KB
        • SHA256 765ddf6290a851541fb53aaf69be53c8d6766b1f3493089fe147def8ad95b5fb
        • MD5 SHA1 SHA512 SSDEEP

        3fc6be66-ed8a-4569-9d7c-ddad718b4255

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/3fc6be66-ed8a-4569-9d7c-ddad718b4255
        • Size 171KB
        • SHA256 420c0c16027e176890ab8f0634d4d74b259a864b031937aa5ccd313cb8a604fb
        • MD5 SHA1 SHA512 SSDEEP

        4151407b-170f-4c02-b7b8-34b4b0c8be96

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/4151407b-170f-4c02-b7b8-34b4b0c8be96
        • Size 117KB
        • SHA256 cd4ac416eb31f621175d792b44a48732a0a2080747434a9e9ad2b4be78981350
        • MD5 SHA1 SHA512 SSDEEP

        45d207e7-9b5b-4ff1-972f-6e82af7fe2f8

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/45d207e7-9b5b-4ff1-972f-6e82af7fe2f8
        • Size 160KB
        • SHA256 4aec45ef3e64d9d6a6846635b442eacb51dbe226c174e545696d0125f0d615b4
        • MD5 SHA1 SHA512 SSDEEP

        460cd8b5-6ee3-4c9a-b8e0-db67f682799b

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/460cd8b5-6ee3-4c9a-b8e0-db67f682799b
        • Size 195KB
        • SHA256 2191bd206429b522cce45d6535afe84f8353ca8d3521934e09745beaa2ab07ca
        • MD5 SHA1 SHA512 SSDEEP

        46581022-016c-4626-bc9c-90de769f8594

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/46581022-016c-4626-bc9c-90de769f8594
        • Size 186KB
        • SHA256 b8cb9cf6962cb155ac439ebcba532525056478d6926f8c2b6a72dbed1a173a21
        • MD5 SHA1 SHA512 SSDEEP

        52f984f3-bd59-4d45-bcdd-3c2d1c6ff01b

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/52f984f3-bd59-4d45-bcdd-3c2d1c6ff01b
        • Size 395KB
        • SHA256 87809c21cb858ec2091b9b712b87779b42b376cf62966269d47ab43c9332017d
        • MD5 SHA1 SHA512 SSDEEP

        7062ddbe-981b-449f-a332-37337ab1a168

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/7062ddbe-981b-449f-a332-37337ab1a168
        • Size 98KB
        • SHA256 79a9fafe5fd31eb1b6e4f8844968ae4a23b7c14ac3c3f6e7fb9c0a6f15182d6f
        • MD5 SHA1 SHA512 SSDEEP

        7679bb4e-1cbb-469d-9488-ad7afc0af4ce

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/7679bb4e-1cbb-469d-9488-ad7afc0af4ce
        • Size 165KB
        • SHA256 ff15ee1508aee6516da040e87f2c0c82c803566e4e4648fce51ca0e0e4dba910
        • MD5 SHA1 SHA512 SSDEEP

        a27aaabe-d9ab-42ee-b314-9d1df0d46e09

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/a27aaabe-d9ab-42ee-b314-9d1df0d46e09
        • Size 310KB
        • SHA256 02ec8ec2a3489a95471f22a177ebc1bd434d5d417804666bb0b7d9ffd3e672de
        • MD5 SHA1 SHA512 SSDEEP

        be43bcbe-855a-4d88-8f6e-cbe1b7147139

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/be43bcbe-855a-4d88-8f6e-cbe1b7147139
        • Size 286KB
        • SHA256 f1eb4bcc3ec6744e430e088f21c44222142e851072cd7d25f3cbc2462199f0f8
        • MD5 SHA1 SHA512 SSDEEP

        be6659d6-340c-41d9-a4c7-ac6c277a2be6

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/be6659d6-340c-41d9-a4c7-ac6c277a2be6
        • Size 308KB
        • SHA256 287d73a5a9a20919b08d7d95804ab40fa920df04983d98537f9e25ac75d973ea
        • MD5 SHA1 SHA512 SSDEEP

        c45149bf-b680-482a-a8bc-f2008b54703a

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/c45149bf-b680-482a-a8bc-f2008b54703a
        • Size 270KB
        • SHA256 9557a0557bee6df5a4e4be675572a9cbd933181f03d1a96116f9d4b16e5456f6
        • MD5 SHA1 SHA512 SSDEEP

        de05caaf-fa21-4659-93a3-cbe39112fd7f

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/de05caaf-fa21-4659-93a3-cbe39112fd7f
        • Size 170KB
        • SHA256 95b59c1e384dd1520c9b9dfe7d42224844cd9df61c8f49b78a7118ab8e87b63e
        • MD5 SHA1 SHA512 SSDEEP

        fc89fec2-4c1c-4c19-9b97-72dd6cf9e613

        • Path /data/data/org.thoughtcrime.securesmsplus/app_emoji/966c1479-731e-4e58-a845-70a0f4623f9e/fc89fec2-4c1c-4c19-9b97-72dd6cf9e613
        • Size 230KB
        • SHA256 2590baf12671229fda1c82b60dab2399c0d7fc4fea6f5c427c989515c9ce7f07
        • MD5 SHA1 SHA512 SSDEEP

        .version

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/.version
        • Size 86B
        • SHA256 ebbee0c2cc5f7fac9c8604588ee7fbea3affb4a4a6f413f871de68275ee3d051
        • MD5 SHA1 SHA512

        .manifest

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/.manifest
        • Size 498B
        • SHA256 4da27a09e08aec873f2ed3fde45acdd498b40cf2ca4e629bda77cfc566414017
        • MD5 SHA1 SHA512

        .map

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/.map
        • Size 99B
        • SHA256 a489ffa9e1d3516b1934a1975161f19edabf38bf203857ea9e60f093ca869a82
        • MD5 SHA1 SHA512

        .map

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/.map
        • Size 163B
        • SHA256 dc4038fe8fe909520e40d90d1ab6990f5a33c9bbb01c9566d4d03a897dc6aef9
        • MD5 SHA1 SHA512

        .map

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/.map
        • Size 156B
        • SHA256 863ca489a5a7fe22f05b7f36a81213bf3be788857a1d39a016beafea59e13d07
        • MD5 SHA1 SHA512

        .map

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/.map
        • Size 220B
        • SHA256 c91118961529eba75ea244ea1fcab7ab992fa7cb868499d810ee47b7c66f9e85
        • MD5 SHA1 SHA512

        .map

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/.map
        • Size 288B
        • SHA256 bbdf545f390c919c722a069fe75d2297542df15307622e7398e95e7e764fb322
        • MD5 SHA1 SHA512

        57530ce4-42f3-4e3a-83ee-f0ebb8d81097

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/57530ce4-42f3-4e3a-83ee-f0ebb8d81097
        • Size 56KB
        • SHA256 305f941c2fab1d6ee97c5a4460f8653ff4ffec429701e2c9648befa1f593a345
        • MD5 SHA1 SHA512 SSDEEP

        784c7935-8d79-4cd4-b9b2-907a60a40cdf

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/784c7935-8d79-4cd4-b9b2-907a60a40cdf
        • Size 547KB
        • SHA256 aa2d31dea9ce8bd4801ab6a74f0e50707b04efd1ea49f8da58165020abde9c75
        • MD5 SHA1 SHA512 SSDEEP

        9774fb2f-426a-4d93-aa43-c4d0de2a6b87

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/9774fb2f-426a-4d93-aa43-c4d0de2a6b87
        • Size 307KB
        • SHA256 a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3
        • MD5 SHA1 SHA512 SSDEEP

        ecf8fa9c-20b4-4ca3-98ef-51a626c24eb9

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/ecf8fa9c-20b4-4ca3-98ef-51a626c24eb9
        • Size 308KB
        • SHA256 3c163d15b129e997225435c2ec3544afd57a1082ebb12f87a48600f9a1c74869
        • MD5 SHA1 SHA512 SSDEEP

        f812e1e5-c55e-48cd-94ff-b0af322ca933

        • Path /data/data/org.thoughtcrime.securesmsplus/app_story-fonts/27b80ed9-3ec6-4cf0-8dd2-bb5e2decc5b5/f812e1e5-c55e-48cd-94ff-b0af322ca933
        • Size 95KB
        • SHA256 9b54b1da124f3c8175ca6f3eff36bf0476fb2d8b4cd5650f827e8e41d1854820
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/com.google.android.datatransport.events
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 442018434a7f19e4f6b9dc27ae79e70c209d27526c03069a3118e3671ddc8652
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-shm

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/com.google.android.datatransport.events-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.datatransport.events-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/com.google.android.datatransport.events-wal
        • Size 52KB
        • SHA256 ae6e21a8a28a62eb799f78ccdfa5edd44ea42307d9a1d7bff27cf80da2251dc6
        • MD5 SHA1 SHA512 SSDEEP

        signal-jobmanager.db

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-jobmanager.db
        • Size 4KB
        • SHA256 534b206df09c35e1947b6cc9fc43372f6edf3eb9ef87c9859b7bd5d9ae564ca5
        • MD5 SHA1 SHA512

        signal-jobmanager.db-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-jobmanager.db-journal
        • Size 512B
        • SHA256 f48e76b09cf7af984b2a94dafdcbc45e2816aa72b5e5322e9d33dbe1cd67694e
        • MD5 SHA1 SHA512

        signal-jobmanager.db-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-jobmanager.db-wal
        • Size 752KB
        • SHA256 d4e1bc4a888871d367f6292d407c5932f6b1a9645e44ed5f9e2eab61b1ac10c0
        • MD5 SHA1 SHA512 SSDEEP

        signal-key-value.db

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-key-value.db
        • Size 4KB
        • SHA256 9848091171f4b36a366e23451dfad0c9acd9dd3020af344e5b653e0bb8085954
        • MD5 SHA1 SHA512

        signal-key-value.db-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-key-value.db-journal
        • Size 512B
        • SHA256 312dc1f73aad83aef7bbd0155a77861c9d0f2ceaa13b751162fc1092edea1258
        • MD5 SHA1 SHA512

        signal-key-value.db-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-key-value.db-wal
        • Size 402KB
        • SHA256 3cf89582d0d3ecee2bf4943e1d6035bac09ea8a5f375ae1d77e0c34f249873b1
        • MD5 SHA1 SHA512 SSDEEP

        signal-local-metrics.db

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-local-metrics.db
        • Size 4KB
        • SHA256 5962cba4295c0067f600f53ccf80c837e7b72b48a08934a88333c78b10da278e
        • MD5 SHA1 SHA512

        signal-local-metrics.db-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-local-metrics.db-journal
        • Size 512B
        • SHA256 ae4ad97a52e77af2b155b41312cc94a54106696e8cac51ab763587a56145bf5c
        • MD5 SHA1 SHA512

        signal-local-metrics.db-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-local-metrics.db-wal
        • Size 36KB
        • SHA256 2b980e25c86143cf4f8f6e1699878445787af2b49325e23a58734be9b9d5de26
        • MD5 SHA1 SHA512 SSDEEP

        signal-logs.db

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-logs.db
        • Size 4KB
        • SHA256 e6070a6f729f1ac4e26a7c7f17744434fd34c729d13738824e83a41b37b0b410
        • MD5 SHA1 SHA512

        signal-logs.db-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-logs.db-journal
        • Size 512B
        • SHA256 9f716d13501f92735b7dd2423ea82288e3b2be288acbb8acee2fc612dd480de6
        • MD5 SHA1 SHA512

        signal-logs.db-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-logs.db-wal
        • Size 1.6MB
        • SHA256 7e3918bb513dd1d2a060c3e23ad3d6ede47dfe8996c72d112b23f02b06ee591d
        • MD5 SHA1 SHA512 SSDEEP

        signal-megaphone.db

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-megaphone.db
        • Size 4KB
        • SHA256 3bd3b1b77d93f5e79204a9f302ac2c99ed44764d9dab40b33de824694c44a9e1
        • MD5 SHA1 SHA512

        signal-megaphone.db-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-megaphone.db-journal
        • Size 512B
        • SHA256 37e79de30a0be41cceccef9bb98d3af3a36430bf224126ed65778b27b4945dbb
        • MD5 SHA1 SHA512

        signal-megaphone.db-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal-megaphone.db-wal
        • Size 32KB
        • SHA256 b4d649e5f132cddd540437d90b2df46551effeac44af3f1af2db1c9ab8e024f4
        • MD5 SHA1 SHA512 SSDEEP

        signal.db

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal.db
        • Size 4KB
        • SHA256 ac29a4583b8593d9b4213ebcfd7a80f2eab40bb805a587117e3d3f3d7a20220a
        • MD5 SHA1 SHA512

        signal.db-journal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal.db-journal
        • Size 512B
        • SHA256 1e8d435afd76c7e1ed749d39a12a60f8f02e9b9c11161c87030f925458765d8b
        • MD5 SHA1 SHA512

        signal.db-wal

        • Path /data/data/org.thoughtcrime.securesmsplus/databases/signal.db-wal
        • Size 1.0MB
        • SHA256 ead5161fe6ca85dd2f9853a0dcbcd7555d75cafa5d3832f97169dfc90d79646d
        • MD5 SHA1 SHA512 SSDEEP