ermac | 1d39c849fe442eb9527624b21e3c4930b8d8d3b9798480d45f05938cecc69d87

Analysis

max time kernel
51s
max time network
153s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
19-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d39c849fe442eb9527624b21e3c4930b8d8d3b9798480d45f05938cecc69d87.apk
Size

3.4MB
MD5

cd1cdc1e5f8e10bf1895f281b01da7f9
SHA1

3470dbe08127daa38cd839fa479d8cc0d6527637
SHA256

1d39c849fe442eb9527624b21e3c4930b8d8d3b9798480d45f05938cecc69d87
SHA512

4852ba54b4a5cffe0d8445f81db0d45fbf49e081c962f42df99aa31ed7b9e0cf2a79e1f7055736113fbb9d1a6345656330c61bdbe354d028d20a509890282fe5
SSDEEP

98304:3dSCGaIgYsiE+2LsOKiWsFZtnHaDlmj+O3NbwivlTXY:nIZsVLsOWmj+OBlXY

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat trojan

Malware Config

Extracted

Family

ermac

http://81.177.140.60:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://81.177.140.60:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4378-0.dex	family_ermac2
behavioral1/memory/4352-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.hastenwret.naueruqwes:AppMetrica

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json	4378	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hastenwret.naueruqwes/app_action/oat/x86/cX.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json	4352	com.hastenwret.naueruqwes
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json	4597	com.hastenwret.naueruqwes:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hastenwret.naueruqwes
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hastenwret.naueruqwes
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hastenwret.naueruqwes

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hastenwret.naueruqwes

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hastenwret.naueruqwes

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hastenwret.naueruqwes

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hastenwret.naueruqwes

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.hastenwret.naueruqwes

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.hastenwret.naueruqwes

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hastenwret.naueruqwes
Framework service call	android.app.IActivityManager.registerReceiver	com.hastenwret.naueruqwes:AppMetrica

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.hastenwret.naueruqwes

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hastenwret.naueruqwes:AppMetrica
Framework API call	javax.crypto.Cipher.doFinal	com.hastenwret.naueruqwes

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hastenwret.naueruqwes

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hastenwret.naueruqwes

com.hastenwret.naueruqwes
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests changing the default SMS application.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4352
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.hastenwret.naueruqwes/app_action/oat/x86/cX.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4378

com.hastenwret.naueruqwes:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4597

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

User Evasion

T1628.002

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Protected User Data

T1636

SMS Messages

T1636.004

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
1.1MB

MD5
e19379756b7aee6bce9e086431df4723

SHA1
b864d3b9c0f5fea2f3a0adaadbb03100b1f38a2c

SHA256
70d98a8ed863ac50b25ccf50d29e8235551a5a0a4c01f8bcfa1f0e250bd20ea2

SHA512
e6a51b09c3fbdfb9d400faae1c751505e939ded73b82f2339c7af0898e20b024302030bf55ceadd08cb3be59e1644d257fa7d9b9bf52c0dd822aae1fffd71a41

Download Submit
/data/data/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
1.1MB

MD5
7529865cbb3d33ab230859febc62c318

SHA1
e77907e6ead8805f54a47f07b40ce7d53072562c

SHA256
f2e0651288b4ea7253c3d7f92738cbfa3d5b169872dd1e850a8a356c2a2841aa

SHA512
705592c3bea9cc129044def09f58eb290500edc9955e7c0b31c47e3d509a595254ee42f878f4c287e06e64335d1302cc0fb89d904bedda91bf664b06686155fc

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb

Filesize
32KB

MD5
1c4274aa7a9a5cac8c6d1df71e4588c6

SHA1
abaecd685e01cc68801292e3dc7085654a22feba

SHA256
3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be

SHA512
1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
cc201859a49005e9b8406dcf6cc45368

SHA1
bdcb04bcc10f625aaa021633e01399e0c0b538c5

SHA256
98643878ec5a0ee67f29f0bad4fa6529d0fc1fba3aa0dc27b2cacdbda7e5d237

SHA512
9d6e96740e3628bec5afadbb5cb182640eebcc98d6b0347f7fb03723562a2d0146d71a8cc37da3f9f91521c4c1bc564f890c62c9aad7810bb5464b3c02739eae

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
bc90d5202be543454a05a18aa8bd1b34

SHA1
b4b1d2919981ba52b85a0d4cc3ff7c4cebeab5ef

SHA256
e873a70f678aa87cf21dee89cd1072a3638f7f20942ed91fda1a1a0cdb9bdd3b

SHA512
a73fbca28a8edcf83074166311539786aa1a66e49def472770c3a8a33f242645e5fe06c6db112c4ccd95426fc312d0ff2e1309a6f0ea57467bae4355a243682a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
1eb25e8191d8c26b52acbb75746b7996

SHA1
1f878c5fedf593bba44adf8b810497e87881214a

SHA256
638ab2670368a4fcac74fb7b2a4d0d5b186850a2ea16ae4ff1f402e928a55b4d

SHA512
a13085880b9548f8615eb9755f82b3f38a3f5918cf2af1f3bc1974a55f02ba1c2b0645d9a9b799ac7084a57cdcbd61e18a5e69ceaabe5897b5e8f3a3dfc3b33c

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
45439ceff17ca24e6d0bbd930562ec94

SHA1
b4f0e241bd16147a56fe5e3e97370d3142d0621c

SHA256
13058470f996a1cd1410294d7052f435bffaf0a642979e9797ce3dee7954b192

SHA512
3b4f8f74d744fc7527c750cdbdcb051f482605fea869eae384dfd5fab9a9eaa985e9acf4f4f2a48eccb7dd4d37fb124176e5b7b787b9b613a879412a9a811cdb

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
306B

MD5
46460a4849c2a041d660f945dde6e35c

SHA1
a28bec0ff033660f799b902411f1d16c4246ed76

SHA256
6df02bdf8e4e0815dd6d01ea457f79c1d4d44af992eee841699207f8e2c26e66

SHA512
dd61398e32cafcb02bd63d5e95b0179e741b4f2bf844e6705bcc56336c500d9400d612315400fe063e29f987e702e386a3a5e4ba78c804f1e63ca2c8c13a79be

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
8KB

MD5
3c13e2c8bd92684275053e552e29bddc

SHA1
6cbfaa9283a3ed6c2db4e0573370eb8df328b546

SHA256
45d06a4f9877959ebfa411dc16a87b8cc1e9152cd0a3b19d1a6634c2c02a96e0

SHA512
54311f245b41c565b6208a130477cc3c261006635bd3a731bef25053dce03bd7ee868d00cfe98f26700f73ee844603d6a1579cb4d5f515be134d40d682b3d1c5

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
309B

MD5
e7cd2a488b8cabe2f6039d6a90278d47

SHA1
1d41721d72a0ff1e5518241fd024abbbc56de7e8

SHA256
94de3c199550c6f8629d99b7c074b21434fcdd315aa311eeafd32bf8cacfab65

SHA512
f640ac4c3bb49bad6e3880ff171dd8f283555607e3b3b4bc8783c09492d9576b401d1ada922a2a048198fdd017222a65b9a0bc10271c11e9bc499acb0b13a18d

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
88ff8a822672daf3693186649c53a2c0

SHA1
51751ceb951518f281f71cd3f981e7003a7f4e4d

SHA256
beb5d1e3f2ea9e78c128a1373accdc6956e83de0d80d2248a73be557b3ce3155

SHA512
7f183d18de64f957d4197396c4a9b78c6ec4f2eefc2e6af54a8eb546decc0312ab38dab9312112c7b893757c48e055968c80100b1a599990a2c33198fb6e5944

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
a81e60a2592895c0e4878900fc2cee6e

SHA1
cb2f3fccdcc50342ccdceeebe7a2fc44f3c9d8f3

SHA256
895d35fdde65c9d7f846af8ac339de5cb63f331ac00c2ee381a0f4735f219f8d

SHA512
4bf49f41ef2ccd7ea57f29e038dbc2da2fddd689273919aa3bba0dcb21d199c78a60d6dda6aefd08419fbf5dfe9c109d2d8f5b0e7a0a9dc2251dbe031be7df5b

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db-wal

Filesize
32KB

MD5
9395c3b167c052bfc2862728d821a804

SHA1
267fb9634fb694492107f5803b29ee26e10b2224

SHA256
67666d6986c3c36d200361514ec9796527d8766f9a76c4876d2d5aa05f4831a6

SHA512
f50fc8df88a34a7acc7a42c2928ce53564cba6284179eb638314fc5f874a4f8c77ff8535b625733b27d158367ab8bccfd86ac9d9aa99d8e8dfe3aad6f3c21295

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
5dca09950419a96f727c80384db5a662

SHA1
541470157b3824aa4eea60f9799e22efe296c369

SHA256
5b375bcb27b2bfd6ece47345d1537a49a66d9edc918bf31fa0281cb053c274ba

SHA512
f30940559d2568d4630d39944867a38be8fb7ee93ecd79848356d40ea285165934f1df6ce08f9390e556cf6deaf0f154f1d27c04eb1f1c27fb3e904c15fb2ad7

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
5de916489517de6cbc980b5e303a997c

SHA1
f33abcd5acef34de0280fbd4b917425941d305b6

SHA256
915e9394f55df657eccd1fc264c797240c066445fcb7a962f65ef4b1c3a7fe4d

SHA512
c2aad67d4157fd24a1553c819031d26218793f4da73d050c8a12270485ae4c3e13b3314a5d3280cebe5dbdf776f6c921c7bb18723da0439e218317f69bb3194a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
6c764b68b6f4418e7f94eedd43f4f65d

SHA1
6783c8f0a6fdfff06e3146d2bad44b388fdeb96d

SHA256
3a3015af99f15c78320e5c214c3d72758fc115f582e5b849b69f7c4759417f07

SHA512
753d42a43902b6cc1ddb9245cce35506cd79595541067d242db72068aa14088e1d70f9ecac72776f1641bc55423bae40f2086a09c7dd5405bd0d944c73c78da2

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
354KB

MD5
a53f1ca4f05c0f569275fc81a26833e2

SHA1
4a08c0c5797cec3fb73ce9b89644b8330a697da4

SHA256
c93db11afd51529500288b645adb919805b74606070609461b6d3b274c2ed7f8

SHA512
df43b78497896192a3a0de29a1c11a6a5fb2d2074c1934523fdf8dea12310d397b5f1c001aec5b58542e8d41c8ca006e5fe0db49b4370bb90757e5b0f5b51e15

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
f99e4a833452af6e327563f840a4859f

SHA1
af1c9a5cd0f34bae8a6121a950b63ccd5457889f

SHA256
e828e58a938c59afd398ef55b97f7b4a167d5a5c423859ebc7c187f9bc98b75c

SHA512
96d53c4b9fe79de49494879b5dc832714e47f16e2d1f655c62cf5241161ebbca48b40a7e50a84184e11c1fe6c5ee7017b791f4d3394d3945bf27c45683333d33

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
32KB

MD5
7e903cfc861d981ec162995f36b64ced

SHA1
ae4a92ee01df068cd46882d6801fe63ef6db400b

SHA256
c7ba3979e1020602e0b3b7735f6f496deb28d6674a67a7f785e11487cbf3ce81

SHA512
bd2f5e7dbaeba57c21f79d10fdb8a8f625c19bf62c4e5d67e68f76f2cbc9cd097caccbd1209eb5e925decc41743136f66e8db7dfc3e94884af7fdd7b4dfa1c39

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-shm

Filesize
32KB

MD5
9eac29f62be79bfcb2146bcf79c0b660

SHA1
df5f49d122c11922b95642c37baaf1b91ea39120

SHA256
27b66d31c376bedd13ac4f58dc63b9aade986fbb6d53b0b9de4914af66ad609f

SHA512
3229cd47a7857d0adaed3d35d7d2f8bc347988c1e88033a3f682adc746791a7d90adf78e6f780aab0be8719653649a83807a60519d90c476aee48943fcbd21ae

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
32KB

MD5
a08a6f5a00be76f589fb0e1944704861

SHA1
26e436994adcb69db54ac6a7920b0d646e8b98b3

SHA256
cb6577cdeb82a0f2235e252698619856bf2242ef420be416dc66f2a7d3d737fa

SHA512
65d453f03ea72dc0b82d06c1b15730745c272bc8c3820fc64a28b77a4f03df08017b511294f5c9dc469e6cc2dd6e115975516ed5945a1f42ccadcc2df8cb0f77

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
8KB

MD5
3c5f8eb9a0350bb79fa154a0769628fe

SHA1
aa68a92c0f641b2cc4f3242d74f60207b5184a31

SHA256
d2b3549f004097b9fb35204db806ee6d938e8dfa48ef057b120e82444f5966ef

SHA512
cace3266610dfe21793838855e71c8d3a00fcbcd3fda1968c63c64327d964a6b9d49c69ad90c4659df83a8156b315f4417c147b2e64db88ea3a5f7079cd8c3af

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
8KB

MD5
9ad537699deaf623bcb578502982b1f6

SHA1
dbc5212c5ac9966fb4de3b40e8354184abac76b7

SHA256
a70d17da50aadf38430f405f863b73c4aa0148f9ec93d4f013de268c6b33bc6c

SHA512
f2e0eb4f97e5d46e93c7c24dd2c27f8ba1b20fbb2b083bf63b61f2f7ce994f6fddd33708da73ed1ad66a9af041e8f5e7fa0b3fe2dbc0e01ff957dd0442b75601

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
20KB

MD5
9487474229f870185a198d014300f0f8

SHA1
5e1266e673d8fa08489464214623a60546a5a53b

SHA256
e48837f9f3585d2c4431b1f9d45b8ab5c760e00ad4f2d2bd0eb1c5a4c960b527

SHA512
f235f507fe351d7ffd1890a33a98fcbadab92bf7ed8189825cf691f094073f8b21b5a098e8961bfa71d9a1dcbc812943c99b2b8942f60e36796af797d6822a90

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
8KB

MD5
134c507b76d7585b52faba8b08e61674

SHA1
416383f768883596044b800a9abdbddb83eeae59

SHA256
66af4069955e4aa074717fb50062396e87c3b93049d9aa1951ecf7452e8fe953

SHA512
466aeec0b2e1348ffedef21345be385590863f9a4959a90bc7a139357a76f549574761f2ba146feebaef59fa8a0df45e8747bf31d8a48fec40884dd8aa80a5da

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-wal

Filesize
32KB

MD5
c4074d2cb22691780e373fc0ad882ed4

SHA1
0d751e2f2e0718cb3220af7da86d933eaefdd790

SHA256
a79e55d3164776ba62905a29ac0fcf0686e97a6bfb8e8deb8c88d83d0ffcb0db

SHA512
263227818c1e0869f96a70a6d220f70dd4c1a6da59f60d0daa384692f07e886e0258f7cf9d0a44a9b5b01d23165ed46c3ffa364a2c76e105f98a7d8a698d9bf6

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
0deaa79247424b041891cdf4ffc77e00

SHA1
9bf770ce1dcd3fb52488923199f88948ef2044e7

SHA256
40a3e154a4d7e3e8140c09cb5892af10faace76523b9bf2767baea525da32478

SHA512
81145ff45b515e0d53f5ae3624be705f5ece554b25cd81070fc72a8cedb77d79b9d77f60c0b46fc8967b6c4bd238f69c52188e49b949583f25b7ffed8544ca20

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-wal

Filesize
382KB

MD5
be7718d2fcda84028c550c4e82e0d04a

SHA1
9a3a842d2405a3e0869bb87d4feb3a1a6f69dc32

SHA256
e37ae905a0b0fd73016a306db5b8a03547434569d914b575704bceb09c880ca7

SHA512
ff3c537c28aeea1880bd2c3d3f66a9881ed588a4a2c803f03d1985a9308a6683d20a95d98881c3229735a34fea7f6d7a92b164bc1d27a61924d56a189c183e66

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/service_main.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/service_main.db-journal

Filesize
512B

MD5
8277d5cd30bc3d7df6d2ca037d7a4956

SHA1
1c94157668e337dde119b5010a4d905b482ede16

SHA256
172d829870fdc8750c98d25f49a2ebcc98d1bb9fe735af64665da785accd57e4

SHA512
0dcc068d2abb7e1c164f612c59318f53611758e69b78c235b5fd9f1435c9b3d7a83449e541d0f3f3409115b8aabdac3e76f91d90babd3611035d9bc239333c30

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/service_main.db-wal

Filesize
273KB

MD5
f14c040592c37e12e9be701f8e9ff585

SHA1
7ae64784913715a9989acc4d2b961c33053a27dd

SHA256
5ea09c778d7c5c39fa578d30a910efd4ca18820e4cba2d98434bd29eeaf44ae6

SHA512
42d3203932da7f8108e1b5707bf39099bdec2dc8dbc1d95718f5574151185fb1a14347cbab571a333880fc86cdfaaa5614d1b85f64a3fd5c6fcf5f1484053a2d

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/uuid.dat

Filesize
20KB

MD5
dd28b49e63b75035d9ea2775f6ec5a1b

SHA1
14c5e2a68fbff2f5072c8c2f2de594471b13d8d5

SHA256
ff33d16044cb288326592461ae13414c697c780f2d02b6fcdc3b8bb1c300e881

SHA512
53a63e99e5ba019204c73e0d5201271acf34702309b53adff6400f71fe3502e22e5cc5eab6252a3354e9f8676779269e342d0ec7cbb501d8e28c80bde737f515

Download Submit
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
2.6MB

MD5
89f26ea0de5adb158e748513dd4af324

SHA1
3dff765c730acb33c2e4a186203d123930e7aede

SHA256
a7c0a4761904b007ec4269233efad9f35ca188a9536d6255c878b431b6361cfc

SHA512
e381d0b9efc9f10fb8a9145bffb564c2be7ea4aadf45dd21489ec132feb081b3eb8cafa7c2f2614d619eb0c93f091ece4fb8e8ed36d8d0aef4a3c0d2a7f53354

Download Submit
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
2.6MB

MD5
39dafca52bdcdcf389595691113f7741

SHA1
fe62af4ed65dbeda43b8395e08c5f8b6f2a3e8b2

SHA256
e7c36e2e82d38d40cfb630ca3f15d9891e560b20ffd253d6ec7f3d536d17b8ee

SHA512
3fa8488af84e42302f262601696f28132e406cfaccf59287df65d22f5ea61eec1d1b2f16cb68a2bc6c0be8277c7185d078eacb934a8f9832c7a05972fa7482e9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads