ermac | 30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34

Analysis

max time kernel
179s
max time network
189s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
06/08/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34.apk
Size

4.7MB
MD5

625698f4f841b670a4c6cfd9c312dc0e
SHA1

e4d9d271a250f95ac209e3f2f599f0d08295bc4d
SHA256

30b7f588b157cc26b56f8df6c894560cf68f4d52ec5c0f4842d02ccab4d70f34
SHA512

817fd75351be5b173e81afd833d6dbf05836a89af4cf2b2cf2b820ff2ae5a9043b48d69d8d0b6a6f8d60765aef505bbf7de399aff4f6657817b6b6062f6df4fb
SSDEEP

98304:XVA7SS5Cwi5JRiPjml5rqE3oysqg/6lM7mnrnXab9YRKL7j1LC4nc3Ie:ThTM8Xaj7dfc4e

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

ermac

http://195.161.114.58:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://195.161.114.58:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4640-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cjmhafqes.nhabester:AppMetrica
/system/bin/su	com.cjmhafqes.nhabester:AppMetrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4640	com.cjmhafqes.nhabester

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	4640	com.cjmhafqes.nhabester
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json	4839	com.cjmhafqes.nhabester:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.cjmhafqes.nhabester
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.cjmhafqes.nhabester
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.cjmhafqes.nhabester

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cjmhafqes.nhabester

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cjmhafqes.nhabester

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.cjmhafqes.nhabester

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.cjmhafqes.nhabester

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cjmhafqes.nhabester

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cjmhafqes.nhabester

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.cjmhafqes.nhabester

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.cjmhafqes.nhabester

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cjmhafqes.nhabester
Framework API call	javax.crypto.Cipher.doFinal	com.cjmhafqes.nhabester:AppMetrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cjmhafqes.nhabester

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cjmhafqes.nhabester

com.cjmhafqes.nhabester
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4640

com.cjmhafqes.nhabester:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4839

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
1.1MB

MD5
6c3956ace74316287087d03814257c7c

SHA1
fba97f4c684100ce52f52b40212bfa0570656878

SHA256
1a7d6b636d6e092f16dbf89493c7ccba18941ac91a8080ea71624b3cb6a374ed

SHA512
dc82b438ccbcd0b635a2f95c893ed6ee3ec5e4e55e93a34061dbe59445eca6dda37e2bde1c4b6d9ad0ae9789b2af8f6c1da4490b5c9ee79e99a44b8f5f8a87dd

Download Submit
/data/data/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
1.1MB

MD5
0da0197126eb9934d36308871bfaa445

SHA1
a880de2bea96025550744f034aaf9356f00a5a29

SHA256
47f3c38f97784e91162f3e0c438ac235387b7a2e2fcc36fcce5b6ad1909b838d

SHA512
3d370f1bf5cc57946ddda0f3290998fae5c7096ff6c5e69531dae52726ccf9fe1c3248e8576032e0891dec8e351d0249e2049853695dbb2415c57b98492245d5

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb

Filesize
4KB

MD5
dea3f35819e374034ac1ad79784f4a62

SHA1
d9b49d8122bcefaa8175c07e9f69dd5556b8c62e

SHA256
5a0eb515c5a4620e1c4fcd8a0385b2b8af562482ac3eea0b9f41b96dfc1ebeba

SHA512
1e5b7232919a7d10209d22f858363638257d6e4aececa6dfe342999ff49802e777cec79a229d14686434622f269f902a13b79e5a852f82b540bebf06702688ba

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-journal

Filesize
8KB

MD5
454ffeac4ba8414f0c99766d9987f722

SHA1
c75789075f21203685bb1b88579bc916dd55edf6

SHA256
a7fead64a12bc68eb5300679c29cb0a37ac4a8c28f83aa6b0c89001965fc98a8

SHA512
ed194f37530f210eaead69923c7e238dd84e23c8ddcce159b77cd3a545684ea7465b5e35155a5d00941dde2425244afeb604baec6707369110f4d5e2054179dd

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
106621ca7cfb8a62ee19316093b7161c

SHA1
821fa7cb0742a7631c320a94a3c6a9659343f21d

SHA256
3dee762a8e12d59b3ea3d851a760c0dba7f2c3f411c319eff184e01a911adf28

SHA512
6b2facec2f05dfbd040ffa55da00455a9376f50f28b59cc9ee07fd259141bc853d31b67c629fdeaa2f234ff00855177d7f08061d0ae271ba296f2c39610521e8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
e44a073a05b155bdde6c986e32b36582

SHA1
177553c55de0a5e1a5a12d50404ed99770a9b69a

SHA256
0fdcf3a9e8a68bd272eb369052d9af92c90e61d2923f7196178d61109349b89a

SHA512
ae207828bd640761a00759e127bd3f9a2bd82621b49ee0810a1a990ce8047fa2c2e33e6f6d840c2783beaaf4e816ffdef59ce519d59b45cec2238ccbd52ff60c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
5929af7e14cee6317fec0cb417ab552a

SHA1
e87b152971478fd0653043e92a89d4944f545d20

SHA256
6a383deab43332d3ba2034f3c2f824eda140b5b322a3289fca4bd0557a7182a9

SHA512
4595510b3a234b08746c626527ee384619749f8d66e7251019e977f6f7c2700a4c98e350f68ad4d2b32d07f87fc9ec4a38feda8deef203ae62f9947b4848f24d

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
59579a070a010e192ef313fb5b3fcaed

SHA1
d053a44c7873c2319d1993326b7fcaa3cfd69d30

SHA256
9978eab08247dd703a5219d4bab4ba838dfb8b135cb0ff426aabc51e965e9290

SHA512
21891782fb77e7494308ccd7478386566e11078da243abf86fb1c02692e9ede13c04cad60f6e38e3ddaa7a1c1d3f3fc4d15058defce1f3ac762d5bd2b79b9104

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital.dat

Filesize
20KB

MD5
d75b81a785aa5579706d5071b3c8462e

SHA1
40c8693f5f3e51c1f3666598d7b3d5d4c5029972

SHA256
4e1a857f8d3cff6c030000853b4cd9c27ad4bf967911f1c3361845a1783f4bfa

SHA512
c34d4271e76b58a127ceea97e29008303bffbacf33f8b2a5a8d3550ec4561e73289699c57f19e382be2d169aa783f5cd7f8d84d60539c255bda4c5d27a95530e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
306B

MD5
1714f08b866078981da254689aeb9946

SHA1
0ed8fc9f841561b8bd9d93aa5c051da251fd530c

SHA256
35defd908b5e4353d5e96a29e29909ac56425fd719047a14f6147c1c03fdd3f7

SHA512
25431fd2675376d66d98409c849ec35f74dcd46bf5b165d4a7a88c1beb4be4fcad9a25b323429a2c73a8f74db1ea3960ffff8befddd898e439f71c91d6641286

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
300B

MD5
41823a1f5e7f814427ec34244edd046c

SHA1
aba2e49fedfb7fbdaa0dda03fb1b18b5987d7cc0

SHA256
50432a8b4212ef1096c5e172c195efab7e0068b9fa85ccc809ee50b077d13a35

SHA512
376778feb9006743571f828e6a58ea084fc5debc3bcb184df59d06b08dfed062a54b7eff04b088f2b36d803d1a51e56619a8f7438cb1bb31def1e3872c67e596

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
f5337276357c35867d9766aaae120b37

SHA1
a75c3c04bf49cd633c77e6864905cbeb2dca18d1

SHA256
28f7b362b96a3206ba1df7aa193f282f181a17219008a801eca73e6706525273

SHA512
07f7288d32e4a7e5256477488e2e4c28df5ea0aaf97acff29de7363933f66103ab2cad3a6ba49c3f61132edbc44338e7ccb77d41283609b4cf0a072fa8a5c5e7

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
af0ad8f1cb44044035d43a82e4f85b89

SHA1
976036ba409ccc4ae8e40f060ad7ef9799746ede

SHA256
3c7c55963bfbbfa757a6cf2b990a331989f5c93264f1af1155667a5d9668c32d

SHA512
c657d5e9d241b803bf1d2f990972906981b67db82bba6904e9e1227830eea87fd1859399d1474d9f292bd4e19abbd61c54c1fef37ae6c670c21a239995204003

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
1a227a67e708a1d72288989b90df4eb7

SHA1
b7e556c7819521d3b0e7fa23558c1070fb38e713

SHA256
315f5314dad3e8b5cb0f1585c9495d167527f04547692ccc25e0716e736054fa

SHA512
3deace8fbae8c87d35c9819747d0d915beca600a2e4be40fedc7eafac29c979eebae09034cc3b621529d7195d1aaf5eaf12c7315a1b247e2823b135b3efafdf8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
8b45bc7640a35bc8415349e146744480

SHA1
66c012d46bf99d14c673c63744c153790c8749b4

SHA256
3caefca4862c66ca1bf1ba010373703877e4487af84caa336477a1b0ef86d3b5

SHA512
a168ba344f8ad6e2bffc4989245f5cf96c5c937986813fcab4c1a7d6f4901f6ad7cd4db3d5d98b5fc1e7fc5cf1482924bc2241d0ba69d28af00bb65414600a0f

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
275706e104426985ab5e8b16548eed74

SHA1
bbc8ebad0212ad7bcdfbde55b7967ec8a609632d

SHA256
cf25f7b28330de697e39d040085abac47ca30b5fe6cd9174d0bdd44ccaa82d18

SHA512
130b4e7ce8b44968124270ebaa8f324e1d3fd5452ace621dc8ddf21d0ce4dd9a5529ee9ce0ab8cd85d60e6a295e7675948a80bc96d7f1985b53a973bef2149c6

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
d1c3ff4c86695b34b125c3924511fef8

SHA1
a9dd1bf00b77e61af0f00a7f31ba219abbf46d24

SHA256
99670ea232466d6b5718df0e9cd2fceb6d55dfde29020cc1d4b6cea82ae9ae51

SHA512
35a1ecfd3c5e2e3340e7a0fec8e2b09380538f77dfb64b839456fa7c1ce3992e7eca1875326e5b9de7e098b472a5fb489f2c4cdb9500bfafb7116b38570fcc6f

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
f70e56f8c489b69e1a63a87f68507453

SHA1
f934a94b4a3533f45be5b1e1c1681d4a1211dd17

SHA256
49dfa713490651aaae840a00dad8077b5662e9469fee1f3aeda6c020ce6b5ae3

SHA512
067ff27a5824da49efa0bbb74a4dcc3e8ee4944c12e376e7d308bf73e6243576796ffeb61c81a59b926d90f60cac96b0fc70f1659c34a482bd2de2c096078304

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
fefe5625cd0a7a3698220bf9738520fe

SHA1
8cb6f58c35f44131907fd15a8fbcf27a5b81c4c4

SHA256
8c4c7b5940836a5b4463b4dafa06e04df431b66750f5a35c0909167aca00b748

SHA512
b711cfb637a4504d8d21d1c73de8a765c1a7fef0ae1d41256238363699cc577a6ce52122a943bb517539fa756af56979010015d871051c5abf1ecd9dc9c6e99e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db

Filesize
36KB

MD5
33f81a5bfcfed2122532a23693d2f1b0

SHA1
ff03a4e21e03796fbdc4b5f3d2b628faefa43c95

SHA256
213781ccd38da37d6e7afe88f8ba57f3b23328420ac8d2114e92e936a6474953

SHA512
7afac69091e16505e0e97f044410f83efb17ba6c24b84838cad0b33a532b9fa2640d4741add1625d83396fd9dbd0e896c5ff4a166ceab591dd6cd14204485566

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
512B

MD5
581dee816a7b85a3267c61729dfa57ed

SHA1
9273f7c624d14687ba613c5e4d6e4ffe62ba5253

SHA256
0374cc4eccd8ffe21840bf0783b92bb5b96f8c2333adf72eac3eabd175855704

SHA512
96818c3cc0c5359ae80d03b8f021880434eafc9c050a61932c03b1cad99c96ea8bfe4acd8e359caff58aea8bf157994f4f662ff403e4af6bcc2bdb023b43fe3c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
796d6d906ff2210a9d32a4d98bc70990

SHA1
332a3ae0b0490467cdddd725ca6984dcae12a5dc

SHA256
3440e723c0dfaa98b3015ba81c8ff3e71ec38abda8a7637b816a62536ac97305

SHA512
d1c13ca6e3829c81551b83539c196fb6c36a1b72b447fdc09ea901f216ad83f530d5af5dc02f5d2eed6b330e0de63c81d0b6ec9740eb7d13cbbd36edb4892f0c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
325b9262df3feebc8a6d6d3fa46cd5d0

SHA1
b2be32bb46c57c46ceaf56f488f62dfed354fd02

SHA256
c06c544979916d81eeaf34a91942ad4a2d4a680028f4ee5385fb461d28d15959

SHA512
fd2dcaaf1bd19279b25335e073a81abe6292598753417dcbf3b09702fa270b889317f7d0782589c03bbdaecaf29228f1ba2fdc675d163889562a80b51ca2fba3

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
9bdb5d8361ec5a3804222a64a01f00e0

SHA1
5a7784dc8fe0c1a7a278fc01e5520eedd98aa44b

SHA256
8582ab0566906507094fc06e2963f9dc0b10298a105292aa803a2eae421476c8

SHA512
c63fc8ce8e9d60b36b60f9a9683368a2b8fb6a9d8c5c0f2a31813bfeb577bcfe4ceab1304ef0892dcf379687ae2769aa4359faeca7a7640f6ca7af7865f38099

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
c0d88d54b61462938ee940b33541c3b7

SHA1
a6bc0c88d6af0f80428c5540a6d21b92ca7ca76f

SHA256
0d1eb4d24dc656b9221ddad69464d42b16173e8f559f2dd7511f10a954e21c78

SHA512
783c39b55f5f504187936dfc43606704e28d11caa8f0cd6f32b419c0ae4eaa8f4e76f38caf715f3c16db055c36e6fee7706c449404dfcce49fd6c5a8a614308c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db

Filesize
36KB

MD5
2c11afde98428cc8e7b82ada9d4d2790

SHA1
930fac7ad08eda421fd8cff75a38854691c4c1b9

SHA256
1ea00e480668018b4db7382e0f848ed3bb8ef7421f0ca62fa246bf62d22ce021

SHA512
2cebe1da7f2246b2f6aab6ab198052db46457d29e646fdd1a0cfcbe16d7420894829fdd81aa4b82b2ae0dc9a0cec68cc5ba9fe91d271bc6c6822216b743bffe8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
4d87a49598f967932a58f657ad3f1cdb

SHA1
722fb173534bcc7eb496915946526286e9494fd8

SHA256
2a758bc17dd0353872c34e7fcf5b1412cbf33d85f9eb087602d2be4fb6d9dd32

SHA512
eddfbbc51df325f2f1826ad71e7155a1712a1673e68cf4e52fe773b19dd05985c1e2ba1070d094426cbb9c0aca2284d0110a1246fe96f59e8f6093b99e539449

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
974327365c997ea5de4d13bee3be2f7d

SHA1
bae16ffaaac6e8dd7e374a8641f58cb61c3690c7

SHA256
a0810f9eb26cdb86ea10858ed5092db9159338ed102041b4d56e45e54061c123

SHA512
cf75aa9e4762805bbf54ac2e3fc18ff04ad6eb456a088d6744bdcacb98f20de65bb886cd158d2eed69a2607afb059b07250cabb8cb079c685e61288a5e715bc8

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
b900fc887a86d2c05cb4342b33dda903

SHA1
f5b27312040be59aca5d717afc6f3ba99a34fb50

SHA256
8d8f7466495d4eed8638b110e9252eb3a172fd18f58d7a29fbbf396907b54098

SHA512
17715d73c67fd377c3032a5d158cf77f39632e8b6b75e91d71bad859035cbfdb730ecc843d2ba0c32b571f39f9147ebf1e6b1004a39fa36b72279430d6db66cb

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
0d602852c4baab07ab7ad1e92e63f99b

SHA1
4e9ac92bef7e48ede1f4ba7f3510253eceb46505

SHA256
a3f8ea95e753208d0bdb9a6280a2809066a3e6232862184c7e0d69451d4b887a

SHA512
0005b1d399183a35e36583adefba0874cb6a46ad72d89189ba34c2c1969c9b075befeaddeadc98fab96a05d26a69a709aa3cf94144ba479ec76355dfc6349e9e

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
fcad16960aff58291e71a0d1f5244cff

SHA1
b56c766beb6bddc6e5cb94c9f5861543a0e4f35c

SHA256
81e8f600c85f834c0e47771fc7ec1550819cfec4e445a67636f79ca16af2f362

SHA512
fed5847b798943259cf4a24e61500463e6189a07fc8ac0cfcc9b7e93a90ac4ca3744d2556249984ae8c9b306fb12d398bafd8c6e38d0faa4700c44a098b667e1

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
5ecc0056ee45be44755a61a52e9cb9d5

SHA1
4389d29cc429f5ba8d54485135c8fa3cda572d54

SHA256
878d8005625ed007b5b541822994679478a411d5ff13369cc6e46a1ca6050aa4

SHA512
83fe3b852c63835fdb78c33fec0cf39cf6c45d1ec0572757bb5097f6319e7c81b1ed3c7af28e2dfc706b8d6541aa23b3d45257e1cd5932556d9b5b6833644e9c

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
20KB

MD5
9e6a4fdbd4c39be9ac701f2b2f2fbd60

SHA1
3643376280c7442e35af7197feb76d250875528a

SHA256
0ba789d6913e1068ec8f6640a976cdb3e06c45a6756a286b019b243ad29d7ee1

SHA512
ebbdf211691780c057236e55e47a802ed39ce029775414bcedc7a99f97e049175719ddbb939e973a456b1810134053449a01562f9ef3f90643a8011ccd034e6f

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
a358c776708bedc57da5576ee0734fb3

SHA1
f974d27fd0127e61c88011932907c253305a1026

SHA256
bd06e33c80451673929e4956621da0200551e2236cd7a9246a07f011eccd2593

SHA512
a8b1695f1037573b28cd21856fd6b81cfc32b733b4ff512deacd77541e4fe018f26a0e65c0d47786d3fca9243e313cbe5157a72b2a0e146be613cd3ee51a78f0

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
8c582f3cc15a97aee5e446c6d0b17da1

SHA1
c311dc36e2c719b3471acbbf03760371fe1022c4

SHA256
5b1085f60f89cc0c92a7461a853bcb154d8581061e65cc930faaf114f106fa93

SHA512
f575d96c8ac90a449922332bb76a77132ab20350b0436b66058ac55615df176e78a8fc6eee38115900a4af65ffa058728672877e9498329cda465410e9413550

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
ca77a4cac8920ca276f5b82984064ec1

SHA1
b11e846582798be721f79950797bb6d27caf62de

SHA256
1e64452cc81cd135c6754819920004d52385ea9d8f0af63a912f52f8d9b097b8

SHA512
7548924773d9a857acb38da531eddb069baccfdfdac31c92f4332ef736d3a2b6c048a3529483998ef7f7c70800c327b1e4652afb77c7f9059cc8487c6dc90200

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
cc745cc6d96249b8fcd07553242dbdf2

SHA1
7dc16e7a2eecb05c7c7dc6e80d63279a8fa2bc08

SHA256
85d9d5339a81e0fe2560d091e12a88b9515e89568d6c39a89f793f305e851d42

SHA512
af55fd1395905747d60df2337b61a9d7f1b2d1f9ba5201b394d2ca3d883e4fe1305f7bb7c20309b7595732823c1dd80db08caa83c26a57dea32bb36c62572b1b

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
8a6402fbfcb33baa176618505e6a8d11

SHA1
9170cf988cf67d48d36ae1fddc9cf0067e7e3f7e

SHA256
fe0c66da220c2c64b0dd622c2859e6f07205786a607fe540cea7609e7067e6c4

SHA512
554104753fe9eca083921f81b2467b30b0193a5c53b04e111bf9409631d55e37d09fd4979568499e84bf6b915459dcc830a572f3acce27cc822d5abd06b8a6db

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db

Filesize
28KB

MD5
d1cc0856833777beee444aca624c7f09

SHA1
99585c2c977428b523707f25a1d49bafb6b6c237

SHA256
9225ec2569b04f958b0fa0525cb5746035cff3c0b83ee3df76fbd423d797d15b

SHA512
4aa6ad72ea96026dda35ae35cbc8d48aea1f776be5c77b2a39a22b699e36dc0b46b7f6374571d2773360ce6d039a7007d29c58daace6275aac1f7f3cbfaf3238

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/db/service_main.db-journal

Filesize
12KB

MD5
c61cd9aae52461333b03e3e6661ed0a4

SHA1
04af118edb0bd3d7626b49dc2b86243acd78ba3a

SHA256
26104cbb2c6ef5fe62685b4c2cbca84e89eb100dfa9bbc4dcc537c993ca6998e

SHA512
5e9eabaa24754f297106aedef23712ea2175d08f0f243391bf320a0e0b832305fada6307956aeea92fa8a31918a4e6354feed2eaae61fb11135b2e01fd5fe35d

Download Submit
/data/data/com.cjmhafqes.nhabester/no_backup/appmetrica/analytics/uuid.dat

Filesize
57B

MD5
12c96a1fb5ecde9dc099d8882fafabaa

SHA1
7b2458d53f180303be4818d55790e0f42af3fb91

SHA256
a16727143ebb79c47ed6934b02bd442fa0df3092e4eb55d48628f51926957977

SHA512
6101240a40e5bcfbd97444405f3382274a7d06178f3cdceeb6ef959cfa08a6507d597751497e55a984a79700bb8743caa13f7441082fd6625ee39d72e73ed02b

Download Submit
/data/user/0/com.cjmhafqes.nhabester/app_gym/AlnAf.json

Filesize
2.6MB

MD5
befb4b100d4e601da8f68e907b0cc2cc

SHA1
407531c6f16599c30d7ae3862aa010bb8c661ad4

SHA256
c030e9997d7688c0ec22c35e02ffe6849545d9de94a1f173d268c0470c5f9ab3

SHA512
8231a201f8b5db6e7e7fcec66f05c86e67f9edfe8044f1558c790469d275d232d414e5c492e31a7fcae11b8a69be0fba3fbbdef896196aa0090db9be6b9db4ef

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads