ermac | 08113a4affb0356a63a356fc88a88c7eeaf3fe7d0b8df852ea8723f014aadee1

Analysis

max time kernel
148s
max time network
153s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
09-09-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08113a4affb0356a63a356fc88a88c7eeaf3fe7d0b8df852ea8723f014aadee1.apk
Size

3.0MB
MD5

d2d453c7460e87470fea92c2cef75a13
SHA1

2b5caf78c0050a2dcc413792a5c7d270c77ca2c7
SHA256

08113a4affb0356a63a356fc88a88c7eeaf3fe7d0b8df852ea8723f014aadee1
SHA512

c55fc60588ecc354cd28e47710363882bcaaa89a06c3fdeea1c86229963142908ce3966a2c8d367595198a0aef95a07d2a494bb3b70ca78b922a60e97685024a
SSDEEP

49152:PL54VxsS/XTRr7sExiulh9XKDjhSmUoZgEk6PcTHPuhQfS6TXY9oiKCWR82p:pIlr7tn6jhZG6PcTG6KCXYaCI

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://81.177.140.77:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://81.177.140.77:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5049-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.hifasters.mavageras:AppMetrica

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hifasters.mavageras/app_claw/PPN.json	5049	com.hifasters.mavageras
/data/user/0/com.hifasters.mavageras/app_claw/PPN.json	5256	com.hifasters.mavageras:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hifasters.mavageras
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hifasters.mavageras
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hifasters.mavageras

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hifasters.mavageras

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hifasters.mavageras

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hifasters.mavageras

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hifasters.mavageras

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hifasters.mavageras

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hifasters.mavageras
Framework service call	android.app.IActivityManager.registerReceiver	com.hifasters.mavageras:AppMetrica

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.hifasters.mavageras

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hifasters.mavageras
Framework API call	javax.crypto.Cipher.doFinal	com.hifasters.mavageras:AppMetrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hifasters.mavageras

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hifasters.mavageras

com.hifasters.mavageras
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5049

com.hifasters.mavageras:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hifasters.mavageras/app_claw/PPN.json

Filesize
1.1MB

MD5
ddd8600e3e60fd7b836ad3a1c93b5ca0

SHA1
6c5a525f85c727d88a06f9cbe6a8b9c74526e69d

SHA256
41d4db51ae63ca3580d9a7c13723156bbc86dc3646b78ec8b3e433f742210cf3

SHA512
6a986ea29842e7ce2c807314d331a80284cef8dd171909cd5a8b63f2b0a578d6564a0c8d73525b09c7475ee17023d65dc853604f86ea720bec5384012484c977

Download Submit
/data/data/com.hifasters.mavageras/app_claw/PPN.json

Filesize
1.1MB

MD5
c6cf10c45d1104fb5708dc566589d57a

SHA1
759c4317b59a95def6fff1ec6aa192342095a63c

SHA256
bb68cf3d979d013e530355fda785e6d3463a35f5040b4afde7118733bc875d87

SHA512
b3cbae31be3267f751f6e9bec84b9d686b056848d2d0adc752f0d114184824a2bd966e2dc971f67f1e1226a9e4ebeb4813224ca7e6c8ff4dfcf8702390c23d35

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb

Filesize
4KB

MD5
af3dbfe782493be315460626cf698186

SHA1
fb23a86b96f765a5eda343832950096a58e2433b

SHA256
ab6798561157f09fea2b9d300e901263582ca448914bc83178d2edadb6fad583

SHA512
189f8d05b711fbb18ed718688e9868d815fc623de0e7ea52d05fe891cca9d052457d050bdfdd41094108eee14aed78ca457666219df201fe0369a474fce11a63

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-journal

Filesize
8KB

MD5
c26457c7941faaeabfbdc2f0a7e6f242

SHA1
07d679978ce48952c7d442ccca5423b0214a54d8

SHA256
e2af4377085dba129b4dc583b60effc7336240b88c6f5c5c972ab78ae9b96547

SHA512
1b3263aedf4ea5a27c5520c47f7a6d2a9540885783704029c57544e1c433855eeb0f82e5fd24edc3077d5decc735c6f9b4dd963d702b2bbb400a290c2bf77ac3

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
106621ca7cfb8a62ee19316093b7161c

SHA1
821fa7cb0742a7631c320a94a3c6a9659343f21d

SHA256
3dee762a8e12d59b3ea3d851a760c0dba7f2c3f411c319eff184e01a911adf28

SHA512
6b2facec2f05dfbd040ffa55da00455a9376f50f28b59cc9ee07fd259141bc853d31b67c629fdeaa2f234ff00855177d7f08061d0ae271ba296f2c39610521e8

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5154f2963afbaaefde0c95f919785b31

SHA1
db3f4511f5dc73848706caa4b17cc558ae520147

SHA256
5d3ecc1f2eaad8fca829967ce1e5028043d80cd8a3aa382115465ced5e676988

SHA512
ddc607dd741fc984003083ba0985fa8237f6c06acd8e2f1e89f8fdf2869e5e17185ce384fb54f1926f29b21d8c51574a8ff92f8e26e6e87dd48470351078796a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
1054267a7e209b1ae2a65c28a1de2774

SHA1
d886ed9fe6f60ebc5c21dc5fde1344561facea1f

SHA256
37561d0053d9949c585f7b507474ab97d54aeb50d7c170699f9b5cf5d385ce85

SHA512
6e8303ac8072d8e918a8dac56211a0ccb446a34c3b2302ef50a79f11b4dbe9307adb8a9de0880f0b24f3fa29d38b062f834d0e96a457b4e9967e055811863e73

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
39b27a6676656835554e25356225d245

SHA1
47a73870922228b012c6e3f103a0cc202cf7b3d8

SHA256
7c9fb605ec63ab6acf0b770d3ce9bcd13a216f5f87852d33c9bd4cba0c435d38

SHA512
efed3e3fee4ebe057bcb32dbbbced56cfca57c1ea4e36235a91a127c246dc8845f84c1e7a630a68b2f12732b10696700157ea5ad3d6c9d1701adb9a79e6dd0cf

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
284B

MD5
9f7e7b943ced94ecea9c61007a0fbb9a

SHA1
f8eb0646149acc824d3efb1857a79ce80c4493c4

SHA256
443943337c9eceab0d9a07857e161bb50014d575613f4da438cc7964990ede84

SHA512
bd92be2a381a0fb26e7b5b5d3b99e2b1a4c35e5a10468574eb6ef47e10c4a91d1cd662afbc96657a528637fd124d53a24a4f4ddcb6ea3a84c893af4929b2a3a4

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
3KB

MD5
61fb16306cfc35d4eeebd924cf95699e

SHA1
b8d8fc30a791c250d547c1f9ecae734d6854ff7c

SHA256
38eb6e66de2a9b31f5d44f4fc2d44d5088728c8dc51579d65ba1423556450575

SHA512
dfddcbed7e3eabdd3ea7edf008e14d0a06c28bd6b25c558abf9f19514ad0059fd7d05d27eaa9c71e690300ea59f3e9ee7243e1ee1d82f6d907f038a81684291d

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
280B

MD5
f83d7545a7033805b585f9a5d586fd17

SHA1
004d0b47fe5f1e95f38f7c342526ee2f3c0c430a

SHA256
5f930350c32acecfc653e06d563c6401a1285ea04d89f9ce7cdaefa68777d055

SHA512
ff061738244aec9e2cecc5552e946f0140027cdf32942d8de03ead607b1ee7ee99c9d7f361284e4deb7ec7365d13b8c70cd930bf4cd9793167b6b66b6dcb81f4

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
6b9b90946bbddc5245495daaf01fb5dc

SHA1
149eb809466eb856f41d17fd40ff09c20b5601ca

SHA256
4dc9329b08cbb1ec1841231cb6e911e64c93072cc332bd4966f5bb23cc797d44

SHA512
d99d8506ee152c97988107421ffb2cfe5e18baa6c0d65f3b6d25c457edce1a0b8b906d5bfd27ee99e5ee8b5718a3fb885dca6bd72fe5e853cee492aa4a5944de

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
0d03a412bc053e49dcc3ef15c0dc4606

SHA1
7e0a98d7ec0d221fcd78ab442897428cc4d223fc

SHA256
0e80b2be82b706b914808168e2622e2b22b9e88ed98fadb853db5ca265f548bc

SHA512
c5672a72757769ff24bcde907131d6177033573c001681f0a39e1f05384846b9cac0b07b503d71ffa7b8e09de450f0e0d6ccfbc169056c0d121f7ada822203a1

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
f1f8b4e9849fbbf9515c61d47049ec69

SHA1
d0faa8e8ee887d6894cc21c87e077e21682cf033

SHA256
abcd9ef994eaa0c8472402529827ac40cd1ffdd9ffe8bec35d76e635ce9cd6bb

SHA512
d66a14048982a1f0de42da44f134b91d3f468af967561d9af55e8cc6b086cf9995b93e0c04d8ebbe54f0926c9dc7cb13c1332f0847dc9441ccc2dc0a8bb539f1

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
ab9ee8f1cbeebca2f840ef463da90a7f

SHA1
d6ddc8de80ac96ed21112cda05b3436b23df496f

SHA256
9898187bd2819c1f52943a495d74ff675325c38198e326e0b883752ddb77d3ad

SHA512
4cd3783bb167fc967558f41b9f777b27b61726926003fbb477be1e2b636ad7de2e3e042c1d19c4dd399721a7fbb14b16f287fdc2c68267eae625ad10d6853a1d

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
a7805a9958be4c3a1d89a7d35427b652

SHA1
b476f02d6ea66dde7a04a962ad62f1f840093cb2

SHA256
22da1307fafdae2c2ad796e9358e6b5fc3285c07b790c3565cd83420c5623e64

SHA512
6509a214063e158a594dcc0468c1d5138fbe6a9688058522ab715ceeaa65db69275ee3f870da2a0ed72f80ebe959e46e33ef6abe60b270e975de3e828b91c7c3

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
b8d1a4c74a6780d7803a1d7690cd85d5

SHA1
68b249f312e02eb36d257fd0467cf17c4920d2be

SHA256
51f5dafeb8e3b03af79951249ed0052b81b0f77359fb09b72a411949db79a93c

SHA512
166b91c7b55bbe66c6b0bb67b22cba29c671a910a0f89e2549cb520d6b8451b3284ee0600cb41cde72e59cc63593a7a5da24f5a44e24d9a89bb25acf0aa8fe36

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
1a1babb8d7c652080c21270d8ea4461c

SHA1
fd72c82cfbf88542f4adf76399d3a0195243e9d3

SHA256
af7298e2e9bcf7896ef820b2d71a08ce0accda6be40cbed22cac5dbff2c15b1e

SHA512
9a2e7f9fed7aaa31eac6c21497f8607647596a16f805e1cab940747fbdc7111ce09c8f4f25857fe53529a78951ebdac302f91e0a090d083b09d689c78981322f

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
26c003475f410e013d80523264d86f43

SHA1
bcf1e8becaab541bb71f851c231d05d5d6a0bea3

SHA256
528f36d68bd699f6313d90134f4473cd2bd4d407703fdea8f00bfe47ef39def4

SHA512
e462395673c26fbc9a47c02ce9c9547b1b6f70fef98c91f6428f2b6d97ea40f35e9feb3274a078a0158cedff9762aa7228ee6e2f26f0bbdba51d9f08c6047e8f

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
a5c7a363a10dfbb3d14d1722e0dc73c5

SHA1
c3a39a7817a7e72ce5ffbf6f4170f1dd086e8562

SHA256
da4ac59cdec0ad9ee456fea786fd94fe760205d44efc283c9345e22c8a296ea8

SHA512
23a92f5a7538b16c58f5c1ba04704da95824b169c6334e7a9ef2c3289b1357230549e0062a15594877233eb8bc8ea3169b5516c5931f827826d7e8e463a05fe1

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
512B

MD5
f71c96318d9a2e36e97656fc10277dc8

SHA1
c23f9ab744baf28318faed4569b462607b66c3d5

SHA256
ac5cb333ac63101ef05d13e3f51f56e3c17ffb05e9e1f9d5c32e2f7ff3865c8f

SHA512
e7c983a37257905977fe7eaa5130e4d945f81e972567c60c7440c4c20ccda6d7f93fb9b414ab82512b4422de272d199bc341014b0f15b5b69c7abd9c83c96605

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
1c2e2805fd14618d8284c2fb1136120f

SHA1
fa7addc7e1fc913e327034d15f432f03a03d8d8d

SHA256
e82512d6fe6ff862824d024e7b6cce8a558883a68142b0792b34640fec98a88e

SHA512
2b0e51936d51c87b41c70ea43a123ff5ef9671fd56ef53f99da1ce057172eefda34acf77a859892884560db585acfabdeff7c5aab90e09e89c8067c569e106ce

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
927b6b5458193ffbceec7cc8d710f962

SHA1
64a263c87820a89a481f01b114281fbd7c52a2c3

SHA256
27d2cb3dd7ef8990425eab4949af7f4f982e590a7ca37971b77bb71da5cc6471

SHA512
9b9d263df201322a827dfe4837b36e529ba3a5c2ee628a00dbe694bc356e19977f9c5a3f16b6231ec4c8c7268d7a7e6aa728698af7d169c0350e76cd3f8495fb

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
a3ef4bd927d5761ad6f3fc196fbc6058

SHA1
5fd98d346241040eb4d5a2d3db02a9ec8f11ca6c

SHA256
27006f226beb9d8dacc6503b7d96dde1b986981dd601d53c6da332f178845839

SHA512
3d678559b584f15c9eeb40cf3c6d890c526e88132740ab009d5e94dac92e85c008102e6ecabff9967553ab38b857db0370db05faefd44b816c280f4cc4f05a92

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
7738a7e1f428cbd75d220f089fd26e4f

SHA1
719617d2c9d7d86ce507fe7d9fb698473c6bc8d1

SHA256
b3d2478e3c32ff0b8acdb283f5eebc6c64fa7f611cddfbae188aa92edde42163

SHA512
244631b88875deda2090fbede5a836c1b203fc5c866d6141ff2b172255557ad40b0c5105f1e2e88263e15867698ac7f2c91dd0ef6abdc79b2269e5a224ad9c1d

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
36KB

MD5
78cc8f50b020446532dae8c87bcf3c6d

SHA1
978c5130380dd8848ba22e7cd22b35e988292ff0

SHA256
f245a010b8ffd6b9ba02540b736e9bbfe5bc0c8e72dad4ba88533ae283c2c20b

SHA512
2b32b9725c49202b0ebdd8384c17cd6c77f1b5fffdeb7b5e233b5d0b2145c932f610960598e827fac4db397502ab904c6eafe18d3f7c8186a4c0e9394c534ad2

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db

Filesize
36KB

MD5
5a6be78674c9912b012d39c45a9ed528

SHA1
98b5bf738bb02f90697ef4d49beecce8825a985d

SHA256
d130dae02d921c7b45c7aa019d7cf16f44e3a4dc4910eb395af953faa4d6464c

SHA512
8ae1b9841f8b7f57636566dba7f914778120c34e180493f76f24c994d8ca3de902fc8f0654e53de40d02acbab60418f6a98588ed634e631ed6887d2a7c7621e4

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
98e15e17bbde025a0b0d6787edd48767

SHA1
8f4aa2c25c5f5920fcf4eaa71b5ef99f5168ca53

SHA256
38709d7d614ccb495a685a780e1e954edf4f7be24554d278d63be4e563ad1af9

SHA512
55fcc3851a1f1297263bbc68a7472e9e5fd4f1afa7369ecdb63f58a8d97a57b3b61b6133e310053a4082773731b2c8dad67e9589423a1d2b7b65321d76eec1c6

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
09ff6185fbe121914bce9d72f92b8f53

SHA1
224b05cdeaa031b15f39317c043c0e14f59e12e6

SHA256
787cd689dcca2895545cd884ff987d832a4a9e40f31bdf4c6558681b79aab942

SHA512
a49c4cdf20f687b97349efccb00880e94c115cbaac2fefeecd49df7e9b1bc0edc97a101b1bfcdd7bbab3e1ee9e4097d4c2590cf224968346c353395709b1f28e

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
c6feba820eb8a928a085d8efff26d5c1

SHA1
f58368f7def64d3f53ee87e5260ac9851918de38

SHA256
ff0648f6610d2a891916359cea95775dc0f8f66764fd17afda67dcd3974fdf69

SHA512
d22606638f156efb74521f6a31ffb3a2a44d88b6280e2bf1599773050e6323eb63b7b26ad5fdff5883e95a54a69438de365881d158593a4a335fc4cc98553a33

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
0567f8da73172b833bdf5388315cb769

SHA1
befb05b5d0a4c9453d48d0354f98bd1e41aa66fc

SHA256
d72a8435d42506a0493010637e36f456533833cdd749473a4fc3fdd415022f50

SHA512
9f5636c6331e6294f6b023ad76dff63cc33b331776036d51ae9411eb4c1844185e9d36d7d7bda7fef423629d150e73feb443c9c423eb7e90b19954b1f2a94c25

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
bf6722deaf4a0fdb42ddbf5da0da3be0

SHA1
c72174a8f6e1ca6602b4b44edc6de877aa56e436

SHA256
cfceeb7f4f73bf153bfa11584f78e445443fd0659be7056aa82e5f8659fe1685

SHA512
b9947c13feef1c7ec4a4c4f632d5ed8d27fbca7ec439d3ffa7bb3e230d8e51dd1de45ea0b013341d42d65bbbf4e20ea3e2397e55a41a5acc6e5348c989ab8985

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
c8ba27480c830b5895229ffed72abf21

SHA1
b677340d57c8dda96f79482ab8d85c4b0588c6dd

SHA256
ca4844951dd8d2906a42aa32877d8d1e1accf34e135d9ebf9ead1585a13bded1

SHA512
d3065bd0ae7d4817ec9ce9e5cbacd057e44e90908af4930a5ba178fbc8ad8d744eee5e75e4a9200073370e0920184b3036f914a488e7ea165f9c8a9eda0c1f02

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
20KB

MD5
3675ae338753373604d9700082fb4eef

SHA1
57a78eecfc9cbf688fd170917084717c06641328

SHA256
54bb60b8eee5b1341df6c62e826367892a672c4f2b2ee6944aa9995a13008604

SHA512
632c2843a924ab5cfe3aff8406a528f609ec22cc67994262f00b316b03cdc0557cfe41e26d99348bc17b865335cf2142b73160af539ef2f8cf9862b7a3394821

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
4f04507f96030f699643aa72c3cbaba4

SHA1
ba8ae0dc652128586aee87aa1b0da19c9e23265d

SHA256
bc8b4fad0ef1bb96f43116bd5b6ed7ae3047a1c5a49890b0c00df5c5fb68e360

SHA512
84a124424bfa7c2a185eaacd563cf5c0eba8c12928aea1cbb45696fbe08efc6590753e395a00366d908789399ad363b1380480495c24412255eb86e54d834af3

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
d594fba2cecbe6e616672749c0562385

SHA1
01fe87d3505efc737352388287b2b1a2e726716a

SHA256
6bf90fca21f8c9749510c67e2e93aafb7c2f35670882b0216b726698c05fc9b2

SHA512
680fd18ca812690ddbd3764fa1792c0e7335aa3a363e635227f839c5fd227c8e81d3beafd785e792493ee94592c47c213529f46c7e4667e56cd998b89d9da4cd

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
89faee981a87d5c93ec5759e842c3fde

SHA1
c1ea71141a2ac0d32a5089f756eba27228903fc0

SHA256
1ce294628562d1a0e4d857c460934612cbdbfdf28c20260cbc6d066a6cc4bee2

SHA512
ee522f740ce011c1566f38f0e0cfef09cdf70e43d130026f9d4e6dab3a2396b5771529fce2d1e0557cc9ffe4b9eb3f9339a3591cb628d3ce9e67b1c44b4b7b18

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/service_main.db

Filesize
28KB

MD5
99e43079e003ff2fdd3ac90b11260e4d

SHA1
31a7f3059b0fe896c0a7a7054e7b3ac10d7de468

SHA256
f8de22a932031140b76d7097e38c47909040d659aec51f6107cf73bfc5d64713

SHA512
551762c482fba8a6db4763ca107f28c11f8c9272bf2e8ee4d0c1b746221e484186f9153c14ac16a4371ec6d4d0be87b3f6098b27b4635a9723704f32f6b07893

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/uuid.dat

Filesize
57B

MD5
12c96a1fb5ecde9dc099d8882fafabaa

SHA1
7b2458d53f180303be4818d55790e0f42af3fb91

SHA256
a16727143ebb79c47ed6934b02bd442fa0df3092e4eb55d48628f51926957977

SHA512
6101240a40e5bcfbd97444405f3382274a7d06178f3cdceeb6ef959cfa08a6507d597751497e55a984a79700bb8743caa13f7441082fd6625ee39d72e73ed02b

Download Submit
/data/user/0/com.hifasters.mavageras/app_claw/PPN.json

Filesize
2.6MB

MD5
29b8af8f38080ecb091921e4388afcb7

SHA1
54b2d68b9d6bdc435e4439e5594f69b47169359f

SHA256
aac31d0e9abc24734a4a4ece28909ccc8e9cd583af024eb49b30b84c05d41273

SHA512
e97c639258c52012f3745e7dca7c5ef0fce8f7a0b3eac82a048e6ef6aa4b57f0e2989962178b1ab3ace2d36d86cb138b2b13cf39185ce48f6e388c45635416c6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads