ermac | 08113a4affb0356a63a356fc88a88c7eeaf3fe7d0b8df852ea8723f014aadee1

Analysis

max time kernel
147s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
09-09-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08113a4affb0356a63a356fc88a88c7eeaf3fe7d0b8df852ea8723f014aadee1.apk
Size

3.0MB
MD5

d2d453c7460e87470fea92c2cef75a13
SHA1

2b5caf78c0050a2dcc413792a5c7d270c77ca2c7
SHA256

08113a4affb0356a63a356fc88a88c7eeaf3fe7d0b8df852ea8723f014aadee1
SHA512

c55fc60588ecc354cd28e47710363882bcaaa89a06c3fdeea1c86229963142908ce3966a2c8d367595198a0aef95a07d2a494bb3b70ca78b922a60e97685024a
SSDEEP

49152:PL54VxsS/XTRr7sExiulh9XKDjhSmUoZgEk6PcTHPuhQfS6TXY9oiKCWR82p:pIlr7tn6jhZG6PcTG6KCXYaCI

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://81.177.140.77:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://81.177.140.77:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4771-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.hifasters.mavageras:AppMetrica
/system/bin/su	com.hifasters.mavageras:AppMetrica

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hifasters.mavageras/app_claw/PPN.json	4771	com.hifasters.mavageras
/data/user/0/com.hifasters.mavageras/app_claw/PPN.json	4977	com.hifasters.mavageras:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hifasters.mavageras
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hifasters.mavageras
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hifasters.mavageras

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hifasters.mavageras

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hifasters.mavageras

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hifasters.mavageras

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hifasters.mavageras

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.hifasters.mavageras

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hifasters.mavageras
Framework API call	javax.crypto.Cipher.doFinal	com.hifasters.mavageras:AppMetrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hifasters.mavageras

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hifasters.mavageras

com.hifasters.mavageras
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4771

com.hifasters.mavageras:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4977

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hifasters.mavageras/app_claw/PPN.json

Filesize
1.1MB

MD5
ddd8600e3e60fd7b836ad3a1c93b5ca0

SHA1
6c5a525f85c727d88a06f9cbe6a8b9c74526e69d

SHA256
41d4db51ae63ca3580d9a7c13723156bbc86dc3646b78ec8b3e433f742210cf3

SHA512
6a986ea29842e7ce2c807314d331a80284cef8dd171909cd5a8b63f2b0a578d6564a0c8d73525b09c7475ee17023d65dc853604f86ea720bec5384012484c977

Download Submit
/data/data/com.hifasters.mavageras/app_claw/PPN.json

Filesize
1.1MB

MD5
c6cf10c45d1104fb5708dc566589d57a

SHA1
759c4317b59a95def6fff1ec6aa192342095a63c

SHA256
bb68cf3d979d013e530355fda785e6d3463a35f5040b4afde7118733bc875d87

SHA512
b3cbae31be3267f751f6e9bec84b9d686b056848d2d0adc752f0d114184824a2bd966e2dc971f67f1e1226a9e4ebeb4813224ca7e6c8ff4dfcf8702390c23d35

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb

Filesize
4KB

MD5
8f67ef284eac59d453bb26f9dd4e86c4

SHA1
c0a7b1a20634f9ba7105db401f33bfd38b36ec9c

SHA256
5e994f86f6de593dcd0af7b44b281ee016c73ebadc759f859af399051d83275a

SHA512
c4d73ad4066e0b07201dd10080eeb3bfc529cf844c93998eede4dc208ee867e0b53fb20a5efae2c38f786ea7349551fabda81673ff850e87903eeb1a517bd66a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-journal

Filesize
8KB

MD5
4a3a36c9447a68c9d78f27880035817f

SHA1
fbc5afce120002e5e99c48fcc0c38d935b4c08de

SHA256
a326743d9ee92582de4f30a4fb352bdbec829847eb9e7a25ea711634ed87a9e9

SHA512
7806300a6d2f214556107ab5f6c1177d50905482481311fc31a8002b9bf4f493b3f723cb665ef000b24667b860dabb9d06075283d2b614308fc93d8cdfc9cb1e

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
106621ca7cfb8a62ee19316093b7161c

SHA1
821fa7cb0742a7631c320a94a3c6a9659343f21d

SHA256
3dee762a8e12d59b3ea3d851a760c0dba7f2c3f411c319eff184e01a911adf28

SHA512
6b2facec2f05dfbd040ffa55da00455a9376f50f28b59cc9ee07fd259141bc853d31b67c629fdeaa2f234ff00855177d7f08061d0ae271ba296f2c39610521e8

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
17813350377d3ec3c43706e2109e5b64

SHA1
a3217b5663879c4f4d509f36729ef3329db3406b

SHA256
1ded9abb230cece3c1aced04a0077c9a9a2cbe657df31a3074a74bba095a3e9c

SHA512
8f5e7c6ee3d3e2ae02eae51fbc26193159deb84701dd965f93312812aec5bc6daa05f1b7e40e2410ad4cdb7503d71a43020422748c3eea96e465536adceda1a0

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
c1e5ad92645ff69e6bbaa7c90da5a5c5

SHA1
68e6996c3323316bd655871d51e16f0336b21a6a

SHA256
872acb00fb55984df4cb98f4d061712ba916f4901de515a0b84bc4fe805f9135

SHA512
ec09ab067995f5c223a898c31f821b34c68c37bb29b0e17f86fb4821c42ec9e2bdaf42f14293bd6e31c4e068c1f2551b459ee5819f09902f4886f8abec8178c0

Download Submit
/data/data/com.hifasters.mavageras/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
01fb0834c529f68a9f96c574d687541e

SHA1
f40ca866b13327f0693116a89e5260c2a65fc442

SHA256
fc64f4d9bdf3f916d9c5f65bfeff0f6ff7c7e1cfb75f3c01c3beaeafab40e5d5

SHA512
21a62e7a62c93ae97a97ad6499fc41dd0ed596fd02c4908f73ab419a1058270ce4f36b1f7cc7d436bca124ee11d2ddfe8f00cce619af2efd14037ac4e7d83ac0

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital.dat

Filesize
20KB

MD5
9b3664b7f8a51bbf6265f0e05441abf2

SHA1
801e5bd2304c06108b8c1cde91f3f6904caaee53

SHA256
f34e3b11ea82091e14fedda43df007aa6a32347ea5a0be40fc7d7ba8bd911077

SHA512
7d0292ca22622fd22b7be26295f75420985c0d13f5b993fd695c19b8eae9910c4feee26b863f9bab5896543b6cbd241e5b713ce1862e9f905f5464b88262fff3

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
284B

MD5
9f7e7b943ced94ecea9c61007a0fbb9a

SHA1
f8eb0646149acc824d3efb1857a79ce80c4493c4

SHA256
443943337c9eceab0d9a07857e161bb50014d575613f4da438cc7964990ede84

SHA512
bd92be2a381a0fb26e7b5b5d3b99e2b1a4c35e5a10468574eb6ef47e10c4a91d1cd662afbc96657a528637fd124d53a24a4f4ddcb6ea3a84c893af4929b2a3a4

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
280B

MD5
f83d7545a7033805b585f9a5d586fd17

SHA1
004d0b47fe5f1e95f38f7c342526ee2f3c0c430a

SHA256
5f930350c32acecfc653e06d563c6401a1285ea04d89f9ce7cdaefa68777d055

SHA512
ff061738244aec9e2cecc5552e946f0140027cdf32942d8de03ead607b1ee7ee99c9d7f361284e4deb7ec7365d13b8c70cd930bf4cd9793167b6b66b6dcb81f4

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
f5337276357c35867d9766aaae120b37

SHA1
a75c3c04bf49cd633c77e6864905cbeb2dca18d1

SHA256
28f7b362b96a3206ba1df7aa193f282f181a17219008a801eca73e6706525273

SHA512
07f7288d32e4a7e5256477488e2e4c28df5ea0aaf97acff29de7363933f66103ab2cad3a6ba49c3f61132edbc44338e7ccb77d41283609b4cf0a072fa8a5c5e7

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
95174d3a5b3cb3aac15539113774209f

SHA1
54657cf0fbf21a364bd703e139883e989c3cc3c4

SHA256
aa33218918788d1277d2b9528a3dd909eb92049d1215ab22bef9523b8e3e96f3

SHA512
8feed8706c9f601caa1245dbe89c1bf207de10364a2251691d5568dbcad91750295a905c0dd658c96b28e32add9a2a240f01821ae71cbce5b73dd970c503aab8

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
309a9b06a9f6fbf4185e08d5450acdf4

SHA1
59e4e6c1b6618c06ce84d81f87d5f91b1bdda5da

SHA256
fd63bed8230f0c664f1e5b102fa58d865922a8589a2b84f822cd72badc03bdbd

SHA512
424b84b27e6e41b4c7187c36543d733d3111014f5c28bf554d4f019cb5e2c4cdb4f05b41b64edcb374396cc6c47c72770a56515af589de5e2dc01b18c708ec65

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
e3702375f453233f86668762423ab70a

SHA1
a57ebdc611e79fc035e644b30916a3351db9b4de

SHA256
318631abf7ac95379dfc8d3831c7027656ab88ccb4220731d938ef18fd572641

SHA512
f4e0eb705a4bb56d2721bf7afb0548d44c38ddd6d5396fb798c0a7d25ab86652b7c569e7c60638f0329559d8a8379a52f04f4f7b11de33aa39268703acc7d2c0

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
52b066f18e143c8f79d19a188f477017

SHA1
1358e282fe587235223e8135f358003410d8ffe3

SHA256
bb1111384beae370a96ca6495049308b97a483071b88c6c213f092c4a9c6bf71

SHA512
03fd109b4c9e5e517a8fb781777f411f2002fcf29db317a934df1d1b9ea84fc67fb137ac751bfe6226fd5a8d49a48f2032004a032e8784c6b78b0f2fec76d1fe

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
ad9c607787ee813d820c3528f6c0892e

SHA1
16abd553695a642b4c4bc33b633e8fb8fb686062

SHA256
d0930102c29e68d3751253fddfa4162ce0cb2c9b6ed995268dfda73a33d4cc46

SHA512
935fc2020452ca3f304ff1cfba7970a7a7dd1b6a68bc9e4c5b171c7d7ae301baa41266de7b59425ad00e4abe019041dae7bf9d3b5dd29e15553736f8a65ee0f1

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
2e4058d8407093b89758285a2c56091e

SHA1
e1beb52100ce787cdcc3826f8240e064007c4afc

SHA256
c00606b9450ab4e2bf58fed3c33fa0e82f1d8cefad7ce193d5ba3c338db79aa7

SHA512
b48eb8145635fe1aeeb194e526949831ae15a89446001b775831acc814a1e3989f9333b1bc51a8c78760d9727cbaa2060d788270f3e2e30e2b33c94a9c96386a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
401f1a09f74b7ba96d97027870191c8a

SHA1
1d829e540e7ecf13157d57b932a78e6c6608fd58

SHA256
7755bb57e65c2ca54c8f3582713e49fcf01ec7925e4fa606b754183c05c95d51

SHA512
c29c84b62e6e4a9dfa9c91b7702517fd2fc90daa242b78c0fb327e6ac3a0529dfc953f2d857d0ab021e8b7051c0eed57858e592775aa9722dc42f9b8df7baa80

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db

Filesize
36KB

MD5
428092b785bf4e053b1b0d5168e86a0d

SHA1
4569eb1b2a32c33abf97c3d011ddd5db59dbc6ab

SHA256
c89724b7722642beae39ae27c771ffbb41dedd5591efaf8da3a07d4bb207f791

SHA512
83f870fd71e6f6e6de7decc72e9f9061a5c8eae0adcd10041f93c39c289438e34a191d5be3732d2d2b74e552332d274d5f04752535eadf42e6da5cad596679ce

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
aac08edd15d77595825fbfb253dd16a9

SHA1
defe4eae446795b37c9d7c4e94ecce33f59cf1d9

SHA256
f07805b887d8a4859b4679e809a946585c3e8d02aa2d99f9feaa4074a7400ea2

SHA512
87722ea8a9c560b8aff45f11e40924f9c693cd5ee0d5392d837db2defe84a80d0bc3b256d1a91eb7c7ee51d91d12340099ebd8ec6feda3bcd82e798f62da940a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
0a0fc014de077fba16a1667a0e48e44c

SHA1
8a957f9d2beb7950e8b2966063607bc75da6b414

SHA256
42625f4fadff5fbe799226646d945450013906c3cb898ee80b1eb7ef4a43f27c

SHA512
225f7d881d67a56f9c3789881acd67b6fe876895a3840a6973edbacc4a2d11af310f9bb9a020c565a644f3f4a5ba12d20bb4abad28145bbd7912bf79c6743d86

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
edb7b6115a476d5ecf30579e9bd3eeef

SHA1
3be272ed7587928bf5a01591634d022896264fd9

SHA256
e37cce49da9c19b9134f83bb4d4bd8cbe6399f2282a1cad0c468a32aa3d9237a

SHA512
d1ab05cbfea397e8909547c89b737158564a59b3643419d4ab007d15577523e9654febd2723d35a7a0b4b1b8833616c4612925314e24138e7d3f9938b339f4c6

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
7c5b90535b4d7906be49c74af2f7a512

SHA1
7403bab803301a6dc7a6adb0462fc5015c1c5797

SHA256
f343bf63736a00c395bac28d5bc1a3725b74452d0e5ed7a941e738195faa2517

SHA512
b550bd46e2ad7c562d4755f6a158e525af48c415d7fb44f050277865d17c02069e180a56a6b4621c8428dab514dfc5b3efc5caa1dfdd837a6b30695b18f1bf6b

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
e002bce4f2e1d841dc14fb0fa58ef403

SHA1
17e3ada9fb61f6527c7a52880a25a67dd93b7e65

SHA256
6bca46a583b112af3e7568a07049c85c8437c3701b4c4a6c40e3590af1d90293

SHA512
6cdbbb3f830e79c23fd2afef0c7e306fa4f03afbbb8ad8724f91dc6a4966ff276029a51843936e20c01a75cb3c65d74c011b29fc6fe1b0d6462ecfc916077af9

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db

Filesize
36KB

MD5
311fce7728226560d97173102a03f74a

SHA1
40dde283980012b9a12387c89cbdece5eeeb479b

SHA256
6ef89567f402e4893c06f2467ebd1a62bfec7d426987e9c2eed1c1f5bc1341f0

SHA512
8eb03024b811ecebceb7c2185375dbc4e7583571ae1158b226f5885f3fb881f203e8e0066651c87c3887cd5f2636cf12ac56e7d40db4dda862fccee1a9b1aa7a

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
3963a9c2eb345f24ea884e682f37ef3c

SHA1
e387b6c1c4c169c083054e15f7d309a74d6e54e5

SHA256
469fde44d0496941c072c7fa3d5db290857b98f75b2fc34683fdba5989039ebf

SHA512
f541c212e5ed97db52104e04ecb41ca61deefc390c9e68b3277a0b4deb7e9cd37946f6505be67cdea58998c5adf972d25dd6f598c1efd6296620c391b7b2a9e6

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
4882d43e0e9d8b2261c4dd19333e3d6a

SHA1
400bc7a730cc0703d1e97de9bfb8f7089c267322

SHA256
30ff5f29da2b52cafca0523cd8b44919d56f31d5b0dc6a202600a089dbd515d7

SHA512
d721658697bb3401954572f410e2c09a8ee39d890bd6e431736a181ba99b4ab992cdf140f956365ec7e8f4ef06c74a5c385aaddd75679d9fcf370f1c99207caf

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
c39c335e27b2c71130ee1263cb147dd4

SHA1
25f3a4bbb9e22935e075e60bf99f5819ceadcfcd

SHA256
cc4b9834bc77ed16e070871fd7d7282c4eb022d271a889b906706162b35b4f41

SHA512
65b3a8d7e156fbd5306dc615ba8c8c274538a58c4a78ca4cf619a5eee822c778aeb34d75d4e5b59afd75e891fe8e8196d1194578ce91493fe8f8efe70eed7663

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
ac4a3012cdfb70aacc7d401817cd7530

SHA1
82474eb9d9ef8a58f98356a84cd4d5458b52350d

SHA256
55996766fb8cec8b4c1dd6ca400b9f107aa2ecd35cb6db7b901eb9a153bbfdd5

SHA512
67011928f7fca35037a24dec3598eeaba7e91c66da1f8d81d7a9eed6e22129b7b904fac7c5eca28727a3ce3c24a11e651f51a5d7dde9b5f0536cfcc4c23c9329

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
143e733eb6999a198b3d3187674c27e6

SHA1
bacdd9397cf068195d05d497e30f90a6ebfac283

SHA256
42da6ae199a7e70af2be3cf8d71cc5f91505363f04424518696bd8532df9201b

SHA512
e1ad741a13c92484ec2c6a30ca951135045f2d773432e3f2c1f3c298de25f05a98c124b6dae99289756ee25f7485cd9b88179e32912ccc891363db4b2f5a0ac4

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
bee1b26ec735da410d4e9f7dcb9e69d4

SHA1
e3e7ce9527d7d90d2b658134022cd2c00dc0cf4b

SHA256
179167978a51d17cdf8f68bcb5b4cd963340481416216471bacc66b28e8dffac

SHA512
0f6ba9b84ccfd119e137b6af5b3ccf03db393ff7eefc38db623eae7f9da9803ba0c44eaf37027c007ced763768de12dcc44cbf6f11438664a17fbe618d5ca386

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
20KB

MD5
c7ed08c160e18d478e1e9df06624b355

SHA1
a0227b2a80534cc59add217968382a19bf042e71

SHA256
dd9777c98fc97c6028863af2cee3fa8929c1abdc2b8da0d5eb3d8c414496c665

SHA512
a8c860ea76ab85dc5b621cbda03ffe0ab553485bd8ca36416c536ed909eb1965aa143527371538bbd7779d2d14aba9982e1845b9dc27907ea79f5e6f9245a81c

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
fd8e6574be1b068832b9ef7177869c28

SHA1
70be26a3e990aaaab51486f4b6fb3fdebec03bcb

SHA256
6c3fcc7af2698641213f5ab92b401345f787a0894fb7ad73042cce955760612d

SHA512
4d1580611240fc77b079aacd93d4e75ce53a9df72058755075f163ca87c90f04d78bedd4916e925509f1d5bd8f1bc13dcafe713ab15a24aebbd5c55d621cfafc

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
a7bc5e3ed20b61cde90c540e16fc334b

SHA1
dfb94eea9e92edacb61ca069b79616ed2335e6c6

SHA256
a815a734b80986370d735a72b21a46b73ac458254fa1840dc99cc3cb4ba3427a

SHA512
3409132cdd190bb24ff33b411821764ac913887b1adc31006771f9f2899acab2fd151ac338ed5b3b19558b175d6de68304cd68ae0c0a8b6df535945ee6789782

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
48b07405561da5e8c99df79cdaa8caa2

SHA1
8f10b79b901dc4e1e89335d172a7ede33fb454fb

SHA256
35cbb50627b993d82e19da2a57e212c078420a15f526b067f2eb172675040dd8

SHA512
1fc176ff565979e1f688f15fcd37b60893f69972cebbea64035500a864b00a6c4b898ba4f6ac088e5da45d2f0327b52d982dbe3030b87b39829e448e8156ed91

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
2b1f8bd050bcacfeb41745541130654f

SHA1
e8352b834026ffb249230572c7bca98225ede26d

SHA256
f6641197e63b2751491e2a6ee5a3a96c4f1f65c5b88dfe8f01143af0d9ed0ed7

SHA512
f360f706425e284b7b6a4348a13cbf2c9cb9bf19c2d133f11a71b3755b84b81195140f5aa825c85ee7c248018353ed8f8cd89faae15bd34c4e8efbaacbe947a6

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
e3359bfe097020b9470b760271e54864

SHA1
eb45d0795c0a2bc37d75a96cb54bc43e286d922c

SHA256
c2da7a01ff4e8b0b60ed95440944e949a52d52a6e3601d4d51d6abd085868d12

SHA512
a26e01cc6dccbb9ef3f1c37cbfeafea4a70692984574416287f975ccf66055683fb04fc4f43624d134bafb2e3161c9b9dfd7a92950395538e7915351bdd4c8f6

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/db/service_main.db

Filesize
28KB

MD5
31bbb7766e804c3d5d55f651033ed4e4

SHA1
9f14485b41fb0c9a2887e418fda0ec2f20b3a411

SHA256
bfb8c82e4172efb46de192a7d24f6bc4f069f3638aa03464a6c011bd24bbc7e3

SHA512
054f690f4a3b8f2c2efc54709b5ce44a55fdd5c2cb2248feb444411c306d640a77652e01807a316ebb7a93336fa910c9180685b2c748fb973feea7940b2bf5a0

Download Submit
/data/data/com.hifasters.mavageras/no_backup/appmetrica/analytics/uuid.dat

Filesize
57B

MD5
12c96a1fb5ecde9dc099d8882fafabaa

SHA1
7b2458d53f180303be4818d55790e0f42af3fb91

SHA256
a16727143ebb79c47ed6934b02bd442fa0df3092e4eb55d48628f51926957977

SHA512
6101240a40e5bcfbd97444405f3382274a7d06178f3cdceeb6ef959cfa08a6507d597751497e55a984a79700bb8743caa13f7441082fd6625ee39d72e73ed02b

Download Submit
/data/user/0/com.hifasters.mavageras/app_claw/PPN.json

Filesize
2.6MB

MD5
29b8af8f38080ecb091921e4388afcb7

SHA1
54b2d68b9d6bdc435e4439e5594f69b47169359f

SHA256
aac31d0e9abc24734a4a4ece28909ccc8e9cd583af024eb49b30b84c05d41273

SHA512
e97c639258c52012f3745e7dca7c5ef0fce8f7a0b3eac82a048e6ef6aa4b57f0e2989962178b1ab3ace2d36d86cb138b2b13cf39185ce48f6e388c45635416c6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads