ermac | 30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34

Analysis

max time kernel
60s
max time network
189s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
06-08-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34.apk
Size

4.7MB
MD5

625698f4f841b670a4c6cfd9c312dc0e
SHA1

e4d9d271a250f95ac209e3f2f599f0d08295bc4d
SHA256

30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34
SHA512

817fd75351be5b173e81afd833d6dbf05836a89af4cf2b2cf2b820ff2ae5a9043b48d69d8d0b6a6f8d60765aef505bbf7de399aff4f6657817b6b6062f6df4fb
SSDEEP

98304:XVA7SS5Cwi5JRiPjml5rqE3oysqg/6lM7mnrnXab9YRKL7j1LC4nc3Ie:ThTM8Xaj7dfc4e

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://195.161.114.58:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://195.161.114.58:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4341-0.dex	family_ermac2
behavioral1/memory/4314-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cjmhafqes.nhabester:AppMetrica

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	4341	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cjmhafqes.nhabester/app_gym/oat/x86/AlnAf.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	4314	com.cjmhafqes.nhabester
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	4528	com.cjmhafqes.nhabester:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cjmhafqes.nhabester
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cjmhafqes.nhabester
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cjmhafqes.nhabester

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cjmhafqes.nhabester

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cjmhafqes.nhabester

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.cjmhafqes.nhabester

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cjmhafqes.nhabester

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cjmhafqes.nhabester

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.cjmhafqes.nhabester

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.cjmhafqes.nhabester

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cjmhafqes.nhabester
Framework service call	android.app.IActivityManager.registerReceiver	com.cjmhafqes.nhabester:AppMetrica

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cjmhafqes.nhabester

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cjmhafqes.nhabester
Framework API call	javax.crypto.Cipher.doFinal	com.cjmhafqes.nhabester:AppMetrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cjmhafqes.nhabester

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cjmhafqes.nhabester

com.cjmhafqes.nhabester
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4314
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cjmhafqes.nhabester/app_gym/oat/x86/AlnAf.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4341

com.cjmhafqes.nhabester:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4528

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
1.1MB

MD5
6c3956ace74316287087d03814257c7c

SHA1
fba97f4c684100ce52f52b40212bfa0570656878

SHA256
1a7d6b636d6e092f16dbf89493c7ccba18941ac91a8080ea71624b3cb6a374ed

SHA512
dc82b438ccbcd0b635a2f95c893ed6ee3ec5e4e55e93a34061dbe59445eca6dda37e2bde1c4b6d9ad0ae9789b2af8f6c1da4490b5c9ee79e99a44b8f5f8a87dd

Download Submit
/data/data/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
1.1MB

MD5
0da0197126eb9934d36308871bfaa445

SHA1
a880de2bea96025550744f034aaf9356f00a5a29

SHA256
47f3c38f97784e91162f3e0c438ac235387b7a2e2fcc36fcce5b6ad1909b838d

SHA512
3d370f1bf5cc57946ddda0f3290998fae5c7096ff6c5e69531dae52726ccf9fe1c3248e8576032e0891dec8e351d0249e2049853695dbb2415c57b98492245d5

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb

Filesize
32KB

MD5
1c4274aa7a9a5cac8c6d1df71e4588c6

SHA1
abaecd685e01cc68801292e3dc7085654a22feba

SHA256
3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be

SHA512
1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cc201859a49005e9b8406dcf6cc45368

SHA1
bdcb04bcc10f625aaa021633e01399e0c0b538c5

SHA256
98643878ec5a0ee67f29f0bad4fa6529d0fc1fba3aa0dc27b2cacdbda7e5d237

SHA512
9d6e96740e3628bec5afadbb5cb182640eebcc98d6b0347f7fb03723562a2d0146d71a8cc37da3f9f91521c4c1bc564f890c62c9aad7810bb5464b3c02739eae

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
e65dde15c01b1bedad293705a2bb07e5

SHA1
6ed9638e4ad844d68459b31cd3561e7f017fac3c

SHA256
b592591ccfda6c8a9fcc7002bf2e40f0ff5a70a96645bb02cecc892166ac2f1f

SHA512
2ee1ffaa9cd49b2435734db794984267f834cd692359a09f521bab86b9b0de32dcb5c702261f6d69f3748e4decef4413ad7b59a8e4d7e6c3e276f7c6c32db774

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
375e6d91cc36798054a6b6ff4d791512

SHA1
c96cc559371109e5a58eaa85e7fc539b63be5009

SHA256
3badc02cf6c114a49093e5823645ec94076262651c26b280792338f72a0c176a

SHA512
417945541b93d3226dd77e1f183286887860b9e9b7ce5bbe315264fd3b640a212331b30260e46915ae75e7cbecca4e7202bd0d6498253301041d532c9e71fa97

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
15dff30850b35104f6e7a1acfdf41d85

SHA1
d303ff516679e1032d5b4ef40a86c638a592173f

SHA256
9768ecbc16af94d415c808f816a4e2d0d9c8b75b061347bd3a205a14578338c0

SHA512
751e1864dbab7d0f8ead8c6a09250a6f1f7a9e5ef9878b3cd22ff46452f0d6b00199e3e7dfb75c48ae19cd81512b57fe250b7882a96ff161fa3a1e4c4ca91d64

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
306B

MD5
ccda863751d905537c61abb19c206674

SHA1
87405203d7045d6d88c88574da58f9cde476bae3

SHA256
56e6d6dc6cf34910a8322a32abd9fa7eee0e35f5857042fd94aa8b059ffaaa85

SHA512
6862bfa02bde3ed86432802dbd134f09ffd74c176754410ff9aef72fbb522749beefe35eaa5d8d26efef570b2caa5e5e6e943666fcba6803c59658355a7f2a4d

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
8KB

MD5
41d3b566e644f2559d905f1c6cb8df7e

SHA1
50f732d934dfed45e10306571cd263597a1eb056

SHA256
5edf4de78524433359ac06b76e3d32c18f5543f97dcf806e4a8bb0f57a66578a

SHA512
04d9468e577f45d90925c570924b12abf1baf4cb6017d0bccf6d188b25e406fefcfb6b1d2137dbd694b6c7954a6ab42de534288009c7d09d8a0d5aa9b22f836a

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
309B

MD5
e1bb2ca1caa946705bc66797c8f746a3

SHA1
09085d9c291b901398a6cb354f4a130458dcdde6

SHA256
e56a592da32a510de474a8924dca8553f02e0f5048e15e7c8719fdc1351be482

SHA512
eb645f78fb4b838b915c8f2eb50911eeb5a3bba71677ca53260f641753e6b6f28643e08b093e037e2ccd5e73f0624577cd9fad84b06f42fbcbea95f8b7aa609a

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
b6b5551916e249036b449935bcd8f1a9

SHA1
1a8f1825a3fd6db1d6f3d5dcc3a3fa37319dacb6

SHA256
215b87d8db86e032a5eae320e26976e5e47d8c31d47e7378031f4c3b53ccac0b

SHA512
fef4e4e80668926dd047c7674d5ee3f6d02a75510eefc810e34313f3328809a4494ea5ff3eceaa377d0b1027581488a553b60efb0c8534d810f2316162971995

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
dbc46d85decb0c12465b1b15413e717d

SHA1
e187165de2f1378f927204c83f4116cbe4ca9e92

SHA256
be2d5883239a7f5e886094ab056476bd7e5a4be910a6dbcfcd1fd5654b96bada

SHA512
e4d61041337cdbb6e751e665a8d61c325bfef60c11eeb2e9074874a825278afe0edadbb44a7aad2e9cc4b45ddc7fdc217dbec853434a71751b23da99a919705e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-wal

Filesize
32KB

MD5
7d276c77ac20b6eec4a958e3ea1f80f6

SHA1
269669a4030e86020f055662765b3ce72574da2e

SHA256
93d785d9c8ae2a2384bb3ba05ee58eb55ea2f09a2f6abbb11ddef738989db03e

SHA512
ffbe1b18a4b2cfc4de073a370e17df98401c90d3d419c56d568b82c7a6d1daf72fbb7d1da0484ea41eed66bb4bcbf821558aa9974a4896bb569dd885db616aa9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
5dca09950419a96f727c80384db5a662

SHA1
541470157b3824aa4eea60f9799e22efe296c369

SHA256
5b375bcb27b2bfd6ece47345d1537a49a66d9edc918bf31fa0281cb053c274ba

SHA512
f30940559d2568d4630d39944867a38be8fb7ee93ecd79848356d40ea285165934f1df6ce08f9390e556cf6deaf0f154f1d27c04eb1f1c27fb3e904c15fb2ad7

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
4e5324ea2284a843d2841a8166626095

SHA1
96e2f93de96df20fd54b2a123af1163b6dbc3b30

SHA256
ef345fc66c80c84e18c3abc8458f6536828622365df8cb285328e600b0206f2e

SHA512
c509ea5e2c674ba5b4e66b8a7fefbdf542ab2e7254eba0fbe6b6ff13a2407f9686152d245eb99df42e72e7b8023cdbc473b31a99900d4d3d42c13b6ec8dff5cb

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
4119949fa89f8efc114e8bf29cb66f96

SHA1
219bfe4f5ac0938591353a5f87487f518ece1a6d

SHA256
3e7b117506550c2f88ffc38eb36eac57214a8e29039d99196dd16d87706ba84c

SHA512
39ab8637a3b5578af2247314efd5b41de3a3173942b8754c715648e7245d9f05fb0230bcfc340275871db5bc3708caa97180091552ad82feac8ea254e3aa81a9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
333KB

MD5
cbc5a81f69b9601f4c9f1b62bbb22c94

SHA1
44285f3e92ef6417761d9e288eba548c91dffa02

SHA256
02dfc9a36748d4eefbe857a6dbf138a95ad90b170232c3e5457a61b2dc40cc44

SHA512
a2feda9469160464beeb5e2321d53b6af9bd501543976923fff766230133c58316957b1407c7d1ec134e3077423fef7565d2a2faae933e3331dd1eccb50d9be3

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
96883c9c40d4bbbb069d164561043a7a

SHA1
1312ae3d06242a123e5804b8fe7adca89df7cc53

SHA256
27534e2f0b9fad234e1e1e31b8b63a668d4069a21b31f3fabc7d11e6f62d9a67

SHA512
85ca9b3f44fdde7f4b60e5bb69b6116f95a6a3d6e815bbaf94b6606a5e2a68696a88bcbccd41d7a592dd1bb111a85e0892bdde76d6e2ad0efb4dc1838ffa72a9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
32KB

MD5
5f2f001b816eb625d25be191afdaca7d

SHA1
1c01af0a0bd58478771070c22a00b098209e2caa

SHA256
875da43b45de87a4685f67aed7b28eddce6858f0e2e76d044ba2ae2debcebbff

SHA512
5dc5ab5166ef82c2c9adf33ba4833ff7d184025e1b1d0ef1d6c70e61069aa1482f0a8b6cd458ee530e8b7e99b9dc138a0318f51da2e0e7608d97da174430669e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-shm

Filesize
32KB

MD5
9eac29f62be79bfcb2146bcf79c0b660

SHA1
df5f49d122c11922b95642c37baaf1b91ea39120

SHA256
27b66d31c376bedd13ac4f58dc63b9aade986fbb6d53b0b9de4914af66ad609f

SHA512
3229cd47a7857d0adaed3d35d7d2f8bc347988c1e88033a3f682adc746791a7d90adf78e6f780aab0be8719653649a83807a60519d90c476aee48943fcbd21ae

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
32KB

MD5
23a5a43a669c36687977bd0218c40c18

SHA1
98f576550060b4716842d65cb7448cd3f02a87b8

SHA256
850890c7c9ab9e23b7a1b9183e86c4af676e59da0bcda943c768f41fe00dd386

SHA512
ac16843f230c66a3bdafdf1d184dacff7e60086fedc7992daecb4a833039890b8b0538896c0dfc410125c2123a20df5f70d26212c34143ccfd9113ed2c2252d2

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
8KB

MD5
b06ff9c4765f7ddaebf253f03f1d268d

SHA1
f4d064333ad2e8b1ca01b10e159f4f9ad28e0b26

SHA256
717e08a069fc4307ee423948e0d66d12878e82bebde1554e4ea5077e731fecd1

SHA512
0c92859555ec76777e5170730fc341de3f90de40b66f0086514589beec85461b00f527a2a148a45614b30ae4b52f3382001064e1deb5e6190bc1c558a5c05124

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
8KB

MD5
671040b1a1d60093d5f45f8619b95eb4

SHA1
3ceef6ad52e3af12d3052c26ea0ed96f9418c1a5

SHA256
df27222974e3381414ea0dfbbb28057caec9dec0e495f1b04c4b919c3174020b

SHA512
de83c7c95cff9c4f6f86df140658457eb0e9cca5181dceef8f15db62b03b8da88eeab88390294d8672d2980c3ffc9a4ba5f9c8ba41087c660b207e54ef6dba91

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
20KB

MD5
5becfad1c7abe26e0aa2088711c023f0

SHA1
fc5cd4484c126093ba9e2ebb9d07caecd7779469

SHA256
268d3af1e44308635e46104751de806fac01340fcdf73dc106831f877bbeb5af

SHA512
89cca8e37790bdd7935397e4c9b202c9986958d078aa4774a94846120291570db47e7e59e578a9b088cd23c2af490140cf7c1a0b204a215698ff919c47ea6fda

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
8KB

MD5
1787d22393069b17ce21342e14cfd10b

SHA1
e905a2859c8086ff0b15138f3e8bba4db713bf5e

SHA256
164817f55fbee9c206c5bab04e7fde0e127120e4033f00f19abdd7089d8e2fef

SHA512
429e20e4c9da4d61309235e1a6220d69022b74bc311cfbe37748610e66fdfe4a04f98ce4de7b31e4b88e941242ba9838c37f4634c582c73623ec145b0772a884

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
32KB

MD5
da8719643e3817eb583a3211aef362d2

SHA1
21060ff5dab0b92c2194dc5883b06dc2e50aac40

SHA256
957f3f13967127f520e0060a04d02d53763ebcca1cb834db7296954b839eb00d

SHA512
aa53f15a511f18a224bbce6dac1f955b29e87ad4fa42975adef5c2570e56fe2fba4c3eda82fd9487607ba2bcfadd10d68c27691569f09ca2d60902bb83742ccd

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
d36fa30eb5c661d0db2d364fed699ae0

SHA1
137a18d89ffd8c925af54135c61e09ed235d80cc

SHA256
f7b94372b62e21770feeb2a6d2b0aeca77d80d8348793f0a092132a77c0dcf79

SHA512
b514ec4366f9148d6a01d9edd2e8a49926159f207fe63aaec9e61c4df47a28b293ddf0b9660c77d8508a3cc336fa68c24fa9b5294a5750f606c60d32953391b4

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-wal

Filesize
325KB

MD5
59ab89833430f6609a2dd1a52f2896ed

SHA1
ef914eeb8d4a302bcbc72586b128a3620f607770

SHA256
dc13e209245ceb7086dca35834a7eeeb3f7104b84feda68365448ba0fd818e17

SHA512
4403afce4bce97f48e06e28394257ddd46fdc6dd18afd30b1eced5fe897daca3c4a4e7b7a426c0cae6d227896e3f42c72a021a724018c801ba3ba9c9df20ab14

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db-journal

Filesize
512B

MD5
55bc09ecb0134c6f6bbb5fc433d7f29f

SHA1
b6f3125da7e98c5e85ab5230e2fa3d62f6b8a273

SHA256
9329339f4d5175cb5c2b1c976167a54dbdc069898a23dd3a0a73b1a595bd0478

SHA512
c2dcf4f468c64317a930c101d8a655e2982b429f4393861d0567c44f5fbf8ddcf8b71af5e3de1ffbca0aaa71864f7adb32414ffef34b1f6cc9b7249606796e0d

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db-wal

Filesize
249KB

MD5
7fe5de9a5b154f74688dc3e3bb4c8671

SHA1
8267ece3c34c19d927e37e33acc503086f7b2533

SHA256
121a57d72e0fe9a94a59bffb098b07c861836d3a7e1a8c1705179572bae3a20f

SHA512
abed84c58e297061402d7a9e2cddcbf7c77a89c91be79f556ad5db31d24d94e50d4067fd61e383bcb5cb10c9ec679f4c63bd040fcbb6d0645d7f17e973319820

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/uuid.dat

Filesize
20KB

MD5
84731e4a65f45968dbc5e03874786d99

SHA1
698ed04a7f094962adf3e0787dbd2e056dab3c8e

SHA256
36fb697192ebca0cefd32538cca2ca8b691f67fcb7ab61f15f69200951a8fc1d

SHA512
dea56a420bf99580af1de7aed10d82628757affaa0f3cf5962bc7b602d3912299b4f6de017dbeebc0d476d94312731cd2c65a39fae871a103f7be9315cc2e3d9

Download Submit
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
2.6MB

MD5
a0f77715d93356d6eb575ce5f285f130

SHA1
08c1f00aae4aca4f58c62f09d67d4ffaa4e82815

SHA256
8545d45b07271da97d43c5031b3bb8116fd9f9ad4b4dc0bd644eeea338973638

SHA512
48d009fd7fbbd3bbece2ff3f09ab1e29e788870210c034d7ae76131e424b341372aafd674c82e657f7d208f9c9fcd4ac365632d91283ec766999e0872e422af2

Download Submit
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
2.6MB

MD5
befb4b100d4e601da8f68e907b0cc2cc

SHA1
407531c6f16599c30d7ae3862aa010bb8c661ad4

SHA256
c030e9997d7688c0ec22c35e02ffe6849545d9de94a1f173d268c0470c5f9ab3

SHA512
8231a201f8b5db6e7e7fcec66f05c86e67f9edfe8044f1558c790469d275d232d414e5c492e31a7fcae11b8a69be0fba3fbbdef896196aa0090db9be6b9db4ef

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads