ermac | 30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34

Analysis

max time kernel
179s
max time network
189s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
06-08-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34.apk
Size

4.7MB
MD5

625698f4f841b670a4c6cfd9c312dc0e
SHA1

e4d9d271a250f95ac209e3f2f599f0d08295bc4d
SHA256

30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34
SHA512

817fd75351be5b173e81afd833d6dbf05836a89af4cf2b2cf2b820ff2ae5a9043b48d69d8d0b6a6f8d60765aef505bbf7de399aff4f6657817b6b6062f6df4fb
SSDEEP

98304:XVA7SS5Cwi5JRiPjml5rqE3oysqg/6lM7mnrnXab9YRKL7j1LC4nc3Ie:ThTM8Xaj7dfc4e

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

ermac

http://195.161.114.58:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://195.161.114.58:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/4957-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cjmhafqes.nhabester:AppMetrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4957	com.cjmhafqes.nhabester

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	4957	com.cjmhafqes.nhabester
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	5240	com.cjmhafqes.nhabester:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cjmhafqes.nhabester
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cjmhafqes.nhabester
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cjmhafqes.nhabester

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cjmhafqes.nhabester

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cjmhafqes.nhabester

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cjmhafqes.nhabester

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.cjmhafqes.nhabester

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cjmhafqes.nhabester

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cjmhafqes.nhabester

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cjmhafqes.nhabester
Framework service call	android.app.IActivityManager.registerReceiver	com.cjmhafqes.nhabester:AppMetrica

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cjmhafqes.nhabester

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cjmhafqes.nhabester:AppMetrica
Framework API call	javax.crypto.Cipher.doFinal	com.cjmhafqes.nhabester

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cjmhafqes.nhabester

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cjmhafqes.nhabester

com.cjmhafqes.nhabester
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4957

com.cjmhafqes.nhabester:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5240

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
1.1MB

MD5
6c3956ace74316287087d03814257c7c

SHA1
fba97f4c684100ce52f52b40212bfa0570656878

SHA256
1a7d6b636d6e092f16dbf89493c7ccba18941ac91a8080ea71624b3cb6a374ed

SHA512
dc82b438ccbcd0b635a2f95c893ed6ee3ec5e4e55e93a34061dbe59445eca6dda37e2bde1c4b6d9ad0ae9789b2af8f6c1da4490b5c9ee79e99a44b8f5f8a87dd

Download Submit
/data/data/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
1.1MB

MD5
0da0197126eb9934d36308871bfaa445

SHA1
a880de2bea96025550744f034aaf9356f00a5a29

SHA256
47f3c38f97784e91162f3e0c438ac235387b7a2e2fcc36fcce5b6ad1909b838d

SHA512
3d370f1bf5cc57946ddda0f3290998fae5c7096ff6c5e69531dae52726ccf9fe1c3248e8576032e0891dec8e351d0249e2049853695dbb2415c57b98492245d5

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb

Filesize
4KB

MD5
9e8f16feb353692cec0df67fea6db841

SHA1
b3dd5056d7d524176135d656b78be6a00676bd07

SHA256
4aea01cf4b809c88c6dae6005147e9ef1b3cbd700e0bb391b10ce9439d98d515

SHA512
08ee0dfaa7bb49eb47d1b83b14c0444e7c036f07e256ed89d9e983dc224d65fb547297ca06e163565dc1cd3b2b9b85ebdb3d3241735d16334f373010eb6800ef

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-journal

Filesize
8KB

MD5
941551dff1a42b9e595a98178d42f388

SHA1
46d1100160d5554bada9e576ecefeb19176c1529

SHA256
86c98f0cfe19b8bf652df866c82f47c684fb6fdb7ea0033bc27ad1a4f4f45edc

SHA512
e40499eefaa907d2e44734f8134436f0822191d1357c69ec612d029367e53841fbd20de24f0e942f35bc74b12c01dab979527c60f2e502fd79b274b868689633

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
106621ca7cfb8a62ee19316093b7161c

SHA1
821fa7cb0742a7631c320a94a3c6a9659343f21d

SHA256
3dee762a8e12d59b3ea3d851a760c0dba7f2c3f411c319eff184e01a911adf28

SHA512
6b2facec2f05dfbd040ffa55da00455a9376f50f28b59cc9ee07fd259141bc853d31b67c629fdeaa2f234ff00855177d7f08061d0ae271ba296f2c39610521e8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1ec124f4abc8fbfbf2ca0b702dce0bd0

SHA1
8b05b7ceeab90b25416005796d5e0f2f88ec7ae4

SHA256
408569ab6b697e1345309f67437cf981341fdcc11952cca839b81528650cf3a0

SHA512
b8f9a4426013aa5f8aea1252e2043a33e2468a092dae4c55eb8a3dca8c15a844062fa0c91bc3c39a3bd969aec2c619655e32a9f03cba84359c3345accb9494c5

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
d173ea0be36c4aeb6b620748836e091d

SHA1
29caca73aad31993a63d99353a15644b795af5aa

SHA256
afba52bb657d00aabb831ec9f64a10dcef766178b915cac74551850303e1ceaa

SHA512
52d336fcedf8f40447887a068a3105c7bcf568e3409e47f818a1ef7e40bc86e57c8760c23253a872a2f9bd5dba9f817d0613c03d80d9e4974e8b0b321aa27c45

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
306c273225218de4fab4f182cc74bf03

SHA1
5027159f852a124d63c3ad0f7122b448f8688336

SHA256
44f509e59cd97347306c4cae8b700eb6ff49b575aca5e0247fb6d378e0e7c9cd

SHA512
3160392aa369e1cdc32f918f714141a6e342dc45601d9c06e4298a75457a73a3c1c563254c382066c09dc9de2927ae4eca61f1610c920626bde1d68998974ed5

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital.dat

Filesize
12KB

MD5
40b472e490b1c857015af7e83c1be8d2

SHA1
d782abeea33c412aed60f34fa9947e27125daa1c

SHA256
9d018a40ce195c80e4fb696dc7af193bbd6a139164fb815b9f39ff7902a7687e

SHA512
baf16cef56a690fb7c0ce37cfc4956289622c44a6ff1d245622e496acdf911aa2e1ac03646d13b76733afa159c1866bd4e063e7d3ffdcbcb4d1840adf03da56b

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital.dat

Filesize
142B

MD5
941a829a9e9089167f4c172477a8ebe4

SHA1
47d20a30f14b72e0c8442ecd73870dda9970013d

SHA256
1c0250bc5d087a7e7f9c9dc81f979306975029a15e63783e71f4c9d8504d32fe

SHA512
1aadaadbb28bafc30918f85a48059cef7ac8bb4a213c93a28cb5000dc4f910f8cb616add2f38478295a69734933c273373af268230bbeb2fe9ec1248d83aee2c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
306B

MD5
7fb11368151abe8e95dc5da8f30e800d

SHA1
f614c91630645fbad0993e39913f8650096c04f0

SHA256
68f48fe50574a1c1a1487dd409bdb2531f07f8eea72e0da62b05cec0e3c6ef4c

SHA512
ddd7d28a712b5fe4a416e1361b2c95ef296b808dafb86d15836262c516ab22f7ed70464227905d6d17b3c6a03bb22acbadff9f315bbda083486ffb4b9f384fb5

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
300B

MD5
0dcc9dcbef4ebf12fad0c998b9a9b6c1

SHA1
d43d87e6c7fb2324d709b0b42dbbdd183cf5cdc0

SHA256
b58ffd7099b3b3773e92e77fee663b880d39ccd98d4d9b7800be49191a8c574b

SHA512
40f15b7cb3bf124309a29d8ae6eac56b1efbc2247de173cdcb2b78cf9966507babbb305693ddfc7d4cfe54e1612710204dadc841ea5fcedee8bf3193043ceb4b

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
6b9b90946bbddc5245495daaf01fb5dc

SHA1
149eb809466eb856f41d17fd40ff09c20b5601ca

SHA256
4dc9329b08cbb1ec1841231cb6e911e64c93072cc332bd4966f5bb23cc797d44

SHA512
d99d8506ee152c97988107421ffb2cfe5e18baa6c0d65f3b6d25c457edce1a0b8b906d5bfd27ee99e5ee8b5718a3fb885dca6bd72fe5e853cee492aa4a5944de

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
d902df7cc36336784cd8af348ae30105

SHA1
d394f272182f99e4e5e2abf8a9c16163c8686253

SHA256
8726430fd17c1059f60e9c1f02b16efc0ab635e4c5410f35091571d4b8234ffe

SHA512
0358230bd8371052c6a38ca9648ea04ef3fb4fa7d0d863b4c04a5d36e70002a63ca1ebf8be4037659d9c97eba803527964cd33bb4837b82e669aef08ab69afd8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
e8740f780cd9137ec2f6e550c85681b6

SHA1
6d5a814bb0fe5224eeba220124d79cf4cf2eec0b

SHA256
1fab0ee93dde196fe7021b50c01bbea0049fdc56ec32afa6ca2b17888567ca55

SHA512
13fe0389a482ed8a9eac6be2ef944f8620d9a3f2ab4b23d7d93d00bc853be6695b809f43ab83dec2092bf31598c841b772947e708f65078727cd206502d81504

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
5b544552bf5faad824be5227d6db67da

SHA1
246a6512e157d912d2a324729e68f1be4ed3f649

SHA256
505996157c514c838c248a8c14c4a992e2cf867248b747043da80478078bdad3

SHA512
3859d4d006d53d860c2d831555e94c115deae4856367f9f4e63e2c6d6eace107fa5a7299a5387a84203bc0e88fe4ffe9a00a7ca84870858540e49b874f6f3d55

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
8bd8c25eb6205a5bfa2e90e5b2745b69

SHA1
1c041b5e52c09ccf478ef134805483c597bce8e9

SHA256
9a96125101415ac345a3b49572f1c2dc3f2bae5df65cdda49df6186ad51e1994

SHA512
2d050a3f2e81251e4bc49719b06a6cce7db11f06784e23f5cd84e2c117fe48770ff466e2427b6b9903c0b9141585b437f1a1fabcc6927a2eff85d50444884f43

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
fd6d0c059a5f921e537369b333b0e537

SHA1
b99f89a7ca2ae4b45d86a51e9ea9eec5d0dad9ef

SHA256
9d0a15d995c68dc4f881b0c757f0836d529a2da31067dc414426ea07b42e5245

SHA512
51ef0945b0de011a0865c015749f41d864d63daf4c4a7b2fe4715b9a3d2a8e192af79ee25d2cf934e921fc3cc56151622362c69f2675c1c914df24525f1776f6

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
8b9621244084faec04c8bfbf63d64710

SHA1
ba43b4a0ecbed7925a82b47c3c04a692db7f3bcb

SHA256
8d83ad39440e5ccbf105095f2710536965fe3703bef800ef3ccbf1228e0efb39

SHA512
42064a2ad40ed4c884d9aaa6490ba9d1e1c59a095884c9fb9c5762cdbddcc6ca12745e1c607ee37009d3b6714d0cf4e2e476fa899cf36b03139702f1640ce9dc

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
512B

MD5
200a463dff663b4b0809b0e7a2b735e3

SHA1
6c83162046cf07368284847c2bdb4d3c64715d81

SHA256
0461cd39254659ac537713718117b53d0ad82ed8a767b1abfa631c3afe7f58a4

SHA512
222930c0e68eb8d28d0239cf19ccfabc9fa48c7b7af8c1fab2c9ccaffb87af729a38a7c55ac2bdb6b0132082ecac104fd25cf8b0f3ef81d38893a7713520c95e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
f6255e46f8eb3a961bcc5be09df977b4

SHA1
81b9c7a306d4ec6261a785634bf9684d135df872

SHA256
a1caa16b26db01a3e261458907d96b2f61daa9ffe749d46bd5e5d182a90a25b5

SHA512
1e42776156346774851bca8047b7ad7403390e6dc4b99849f0cc0429273f3505d119cfb6df5bda47b27b7428e4a95f203d746bc82c9e1b70957067d4bc08a6e6

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
c95ab0254d0f9d191b561af3367ef88b

SHA1
97eb992333667318791b259ef99fecd28b608a5a

SHA256
550014c36e986af4ded1ad184b7f63d49015eb79cf9bd3ecf7d422a36242437e

SHA512
b266666fde35186108a9d2bff46aae438ffc08a123e594af2a0397629268e808700476b0e8c75044684cd889214a8791c24505ac429332cc1cba83e285f54341

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
07441ae87c4e1b696b673a03a16b4a22

SHA1
2b011d0daee788cde316c188b4ca0be7ffa339c4

SHA256
8031881373d69e8bb4d032213414ed4e39d816f3f8d86e1d1fce6d4b17353b7c

SHA512
378ae0bc9a81645e137e74ff5cc5be3089c115e871023cc9bafdebdcb538363d12af899dca06ec73aec4784cef422ba0098a3e0632ee012e0b9b38d5eb5da44c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
5eb9f5aca9c8cc42ae88bfadefcb63be

SHA1
ba98d44e2af6c5bb231464e8e7b396920d175133

SHA256
31df6ef11d0fb8024f99282ae7d89dfbac7b8ae85ca156e330136e5b1f8b1a39

SHA512
66e3c4ead78d77369989680f6d91c152703dcd5c369873af55352aae5318d21e3220ca0e721e7766dc7d903fa9bd5e765f89a4200cebe5b64d7ecabcb500e077

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db

Filesize
36KB

MD5
2ec0f522bc5ab25d19e9c884c4e95aad

SHA1
57ee39654841da265a42825e318208bd3e073919

SHA256
2bd0d89bf3c906e8f1a6b6e99942288ae60296fdcbfb931e332e5bf45d039efd

SHA512
af5ff508ef5437db2610555b6a92bd9245097fe833c75e39d65fc0eab887b08fbdaa782947aae2a95fb2c8619f83441d2f68f227d09f56394362941b29da7b9f

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
20KB

MD5
1281e1cdafa23ff09a3865f277f3d708

SHA1
0a2c1c2e09642e394f98e29e90e4b487a231faff

SHA256
c5a69aa17f0526d902f5f3c4631176e6ef9d1dab5fe2737e1106387cc7bd006f

SHA512
ceb0be80e938bb06062025638c255f49f9f05be8ae7243636bb77025c441bf9052bdca05a9b12e6246291d7b63730ef911a0315aecec6b3f91ba6ca9e4fc84ea

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
20KB

MD5
7530c4a74fed7a14aa7d9f447c4db71e

SHA1
f5cb6aaeaf56265b5b2ad081a10ec0fd2aa70775

SHA256
eb8240aeff818dae3e7700057ef8552197183ca5d94c6a599e0c9da99f27d178

SHA512
6a7aeb995591db38b3f283aab03cea470ac50b2c022b8546f636e7f7b698985e5b5e00c467987dd8bfdbc10278592401208aca9108e4f3ced3702e7f6bf4815d

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
70737a7a639e35b7b6a4c07892ea2f48

SHA1
cef9e0e1894d26000992bcd88bdbb980f22be218

SHA256
2d79054ab30c19706f5201deb1c23c561d92b5a1e002dd1adbdbcc31840a8482

SHA512
fff40790445932b1c0b5a05d5fcafef980cc2806399b75a1e77943f06d9997a9d9b43c5625c6c1701b3b14a9a248067c7df130d8c346823544cbee4ed86552d9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
70e6f76692da5f5c75b5f34471de246b

SHA1
dcfd38eede1f2f36c407eb1ceaca67fac67492e2

SHA256
add967a6fa365b337b0171ad458710afa29faa8928db1385f96b584123842c67

SHA512
dbe91b811b5e1a973aef702b26f016769b0e9b934ada0535fd3bcc4fa8ab0b5fc8bda551e97eec8c9ef5b0e03b78687dfc1f2af900e497917098444a4ac46c24

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
60730c3c2a5e6de2ac70cf1648c231de

SHA1
88adf4d8577f247e7231b80e4d59b7be6bd1f67a

SHA256
34ce11ef9fe60ca0a5194bc7fffdc9cd4222e4207d4c459514cae512b8d351e5

SHA512
035f159e34213a6c9c290f6464e86f0acb71c3ff32c3020fdfedc091c1e34fa3d748a11c90e60457facc65fdc4b413b77c01bb80c0320c5fff160952e24dac2b

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
7446ba71246a9a15bebd97ca8700ca34

SHA1
7b6ab7a17cdec39f425fae196903e35fd0778202

SHA256
04712e3222002cc5c167b3e7e0c903d16eda323dd2f6df05ed299028c1257753

SHA512
b91153cf2a1efa758d14e933dc121934ef24b67e8d9ee64180b5b4d369b18bb045b80cf88d2ec95dc81754b9652c01138fb446a229bae6a489b549843fc1251f

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db

Filesize
36KB

MD5
b6d5e6c1e01aba98421ca20f4a0b84f7

SHA1
7da89da126f9661caac43e94920f40ae05d44b01

SHA256
b64577b8920212bc68ef23a45b865e3de53d5d1bd13ef0d30718056f62f9e849

SHA512
ec8bce6a1cec6510e77337d783ee87dd18498926ad05530d739353e33908bef18f39f00d80d37d272c1a3743d2afaf95f720bec4969ad071ecffb1fff89adcd6

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
512B

MD5
0b2064248a18898bc02461e6d85c66e0

SHA1
7e0a4b98c7f7534bb11946267ef5fc28d5fcbc93

SHA256
4693eec94c93abe089a49728847418f59ca52d53543051d219000245edc27c16

SHA512
4f6f20bee6c9dd457c109111c7fa3d4c7983602448aae75e25fc24c427efd46b18fc0f9e583b76c28199016da4196571b6b1cd2d7ae478f891ccb42dc14ec6c9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
931c960728362c0adf23e059fa617daf

SHA1
890f93e9ad3d8f96ba78d0adf791e354519223fc

SHA256
e6478d1221ab9f888dbb46ead0f3e51d172c6f09b2f90ad42a4f822ccdcdfac4

SHA512
c5744b4df574a9e2e94b37e97c168407e1947619c3acf6e0c7cdb38fd66ac46831c81290166eade23e1c6f62ad4b95a61b69a3a7f0dbbce7fc1511807a1dc3c6

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
ab5347b0937882aafd42cb2cc0d475fd

SHA1
84cae51757bd293650e03fac3a88db3130805481

SHA256
77598d3e99c856f24c484778a5dd67d3fa6f44cf5eeeece4df156b8151b3b54c

SHA512
46cdbaa2e4cc026c6ad62a39723e55b3078fff0fe2ecc0d620b7019bbdffcf9fdd4e628c06d4411b6433b39d7d662c900e3146a818a85e0a848295b4d852d05c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
7e284ca20307e29fc9a87706dc7649e1

SHA1
902e9e10333b63292354c88eaa6c047b1cce8bba

SHA256
ba497c70488e6ae907abb85bcb876af9d4e3643d000f1263180b5334b55cc377

SHA512
bee02e90cd839966686f9a6cf405441c80409b041dd4be7153727e4671ebede9562fea0a3001494614cb360617675623f5298f521d4ab94499f80e2a5271287d

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
fa6dac7cdd4195805739086e536b81c1

SHA1
48296ec8a7f1d89b9ecfa5aa048163555319ad02

SHA256
e8c6f177da948af1743aa443fcd852bc5de70afb3e23aac8b515d05afb46ea74

SHA512
7ea21cacf1a903dc8df9ef8e705c7f8ee5ab368fdec1db074c3b157b58f8afd23502ceb277b58473492d065ae0145190e8a3eb3d02bd9cc99651d64d97c4073e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
ba3d2944193599d970c1e2c6f32feb6b

SHA1
c532429f18d49bf26895bdbb5deab976cdf16ae7

SHA256
f042dc95ad867fe23b048c968dcc059fbc0927eb1d6d22c230767e82506f0a2a

SHA512
aefb6204df88dd0afece209f1cc23f0c2c46361cdebc99adc326650f41e9a84d39c0794314d499e8fe312d86521f8c76dfca2422740d4551643af50241c46afb

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db

Filesize
28KB

MD5
f7b7c364fc483dee7aa3c70d6c946c43

SHA1
8f1beb55b886613dee9384131e2d50d3640dfd7e

SHA256
69ffe79161c3e783db46f393259e51cbde1faec0574549f7ee01a6347f823d05

SHA512
fd6d58e7c54cd97ab565e8992ac8a78793b9738667d052c7f519e3c5fd8cd4d257ec7714c54bdea0802673473258f444995cc983568154769db43b4a681fe18c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db-journal

Filesize
12KB

MD5
74e4e1b448a318304a6bcca1ce72be92

SHA1
1018894877b168a2b7eed191ba221392281d59fd

SHA256
9c60b540ab1ac6a773a3eae59434f20166b1979700f76ceaa654e731da166a55

SHA512
684950e87f4072932c9f4dfe69b344abcc1d78d49b303cbd8cf82a1b7e68c59418cf0f46d07d4e19dc2cc0ae2039adcd828eb7ee9b20c3bd90504916232fc881

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/uuid.dat

Filesize
12KB

MD5
5dfec9312d86bc80d1b4830e543dbcb4

SHA1
230f5effbc7ea17392ebd3af72dbe057cc7143af

SHA256
34640b1b52e2ffc5795a74aa624d93c068e553a5f99923160a69e0e6a5fc8b64

SHA512
e55111b507e0865f390cc0345373e96139b4e2472e90130440198956709715056b4f692681741d93091343f7b63da52c059a7b6cb767d4a07b54f854bfe3df79

Download Submit
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
2.6MB

MD5
befb4b100d4e601da8f68e907b0cc2cc

SHA1
407531c6f16599c30d7ae3862aa010bb8c661ad4

SHA256
c030e9997d7688c0ec22c35e02ffe6849545d9de94a1f173d268c0470c5f9ab3

SHA512
8231a201f8b5db6e7e7fcec66f05c86e67f9edfe8044f1558c790469d275d232d414e5c492e31a7fcae11b8a69be0fba3fbbdef896196aa0090db9be6b9db4ef

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads