ermac | 1d39c849fe442eb9527624b21e3c4930b8d8d3b9798480d45f05938cecc69d87

Analysis

max time kernel
149s
max time network
159s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
19-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d39c849fe442eb9527624b21e3c4930b8d8d3b9798480d45f05938cecc69d87.apk
Size

3.4MB
MD5

cd1cdc1e5f8e10bf1895f281b01da7f9
SHA1

3470dbe08127daa38cd839fa479d8cc0d6527637
SHA256

1d39c849fe442eb9527624b21e3c4930b8d8d3b9798480d45f05938cecc69d87
SHA512

4852ba54b4a5cffe0d8445f81db0d45fbf49e081c962f42df99aa31ed7b9e0cf2a79e1f7055736113fbb9d1a6345656330c61bdbe354d028d20a509890282fe5
SSDEEP

98304:3dSCGaIgYsiE+2LsOKiWsFZtnHaDlmj+O3NbwivlTXY:nIZsVLsOWmj+OBlXY

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

ermac

http://81.177.140.60:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://81.177.140.60:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4501-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.hastenwret.naueruqwes:AppMetrica
/system/bin/su	com.hastenwret.naueruqwes:AppMetrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4501	com.hastenwret.naueruqwes

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json	4501	com.hastenwret.naueruqwes
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json	4738	com.hastenwret.naueruqwes:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.hastenwret.naueruqwes
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.hastenwret.naueruqwes
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.hastenwret.naueruqwes

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hastenwret.naueruqwes

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hastenwret.naueruqwes

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hastenwret.naueruqwes

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.hastenwret.naueruqwes

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hastenwret.naueruqwes

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hastenwret.naueruqwes

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.hastenwret.naueruqwes

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.hastenwret.naueruqwes

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hastenwret.naueruqwes
Framework API call	javax.crypto.Cipher.doFinal	com.hastenwret.naueruqwes:AppMetrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hastenwret.naueruqwes

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hastenwret.naueruqwes

com.hastenwret.naueruqwes
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4501

com.hastenwret.naueruqwes:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4738

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
1.1MB

MD5
e19379756b7aee6bce9e086431df4723

SHA1
b864d3b9c0f5fea2f3a0adaadbb03100b1f38a2c

SHA256
70d98a8ed863ac50b25ccf50d29e8235551a5a0a4c01f8bcfa1f0e250bd20ea2

SHA512
e6a51b09c3fbdfb9d400faae1c751505e939ded73b82f2339c7af0898e20b024302030bf55ceadd08cb3be59e1644d257fa7d9b9bf52c0dd822aae1fffd71a41

Download Submit
/data/data/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
1.1MB

MD5
7529865cbb3d33ab230859febc62c318

SHA1
e77907e6ead8805f54a47f07b40ce7d53072562c

SHA256
f2e0651288b4ea7253c3d7f92738cbfa3d5b169872dd1e850a8a356c2a2841aa

SHA512
705592c3bea9cc129044def09f58eb290500edc9955e7c0b31c47e3d509a595254ee42f878f4c287e06e64335d1302cc0fb89d904bedda91bf664b06686155fc

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7802f2efef39a000b582c542199a9a49

SHA1
672fe44eb7d2d5bb9aba061bb37d38243726ebee

SHA256
8329c2a48d8d1bb59384d09fc3a8645e2a9946e825463937e9bb05ac62605544

SHA512
fdd84fe4e14ed3a32d608b08ca2ca41455bd5f01b6d091f546addd4fb3b7d4e991d239ec05f795ace53d333819f3eb03462aea609692fb21d65f656f98bcd008

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-journal

Filesize
8KB

MD5
d71027df8e55ebb056987157fe8f7ca7

SHA1
f82477fd844f58f10e97ca2cd2f4d28c1c0010f2

SHA256
8eeea8fbf4f310fbedeba8fd5fd0435afffabd590dc800440ee4ca9d9655acc1

SHA512
6390f74bd80f5cdffea377ba95f0d65679e524b214ea39a551c98b46ea8407b6cbe0697da5e411eaeb416981f179672b3a33d134329a8ce75840e45b5848bd27

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
106621ca7cfb8a62ee19316093b7161c

SHA1
821fa7cb0742a7631c320a94a3c6a9659343f21d

SHA256
3dee762a8e12d59b3ea3d851a760c0dba7f2c3f411c319eff184e01a911adf28

SHA512
6b2facec2f05dfbd040ffa55da00455a9376f50f28b59cc9ee07fd259141bc853d31b67c629fdeaa2f234ff00855177d7f08061d0ae271ba296f2c39610521e8

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
7da50047b843d9b0f3043fd8527e81c9

SHA1
58e3e671ac3ef22d4340bf7c869aff4b9774bfa5

SHA256
3c1b3f0d8c3749ebd629867d1eedb134ee5722eedbb740d21b64231b92dd416a

SHA512
d64ccd3c426bf0a811728bbac2736648aae296c3f5edd511dea647a4acf3748dff5d055f8f1c6695992edd9264feaed1c6227a8554d7ae855b0191cc2578e95a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
2615146aceb5df7b2684a14ebfbad14c

SHA1
842700c4ff9627590c1eb5d4bd249941ce0b4b8e

SHA256
8e005c9e123c90fd2e76dac7dd190289c8caef4e6d6ebd18517a6884f06a30b5

SHA512
e14cecf6fd5681986df56417c34b7e2ff38354a626a011711b6a0328653c60b8bb77fa1eef5207913474a3ed34a17929b3e3171daf02fcb8a5d3c19127806210

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
e600611ae36958b48017e3549d6108b9

SHA1
babf8237d732bf6c3fcd9962551116f5a3161725

SHA256
1c2caf518f678e2006a82e5e5831bdacfec76db5bca6af71da5595a8e262ba59

SHA512
05b0dadfc93a0fe974af65c1c49da22c83b4e53a17da077014b44a5bce0cc7285794bd8a2569da6d2eba00b046b8fe8feb18d0727993b61f2ddea792748120aa

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
307B

MD5
c7c420f0b0e976016da54207d8f5960a

SHA1
e102d16105a8dadebe597180660fa7954e0d45ad

SHA256
9a9598fa0d8359f0a3c6e991c5148efae2a891105d2e1c44cb032da3551fcb44

SHA512
eab1771e864bf2f4e672c4757dff40f38d537291d9d6face28ea99d8a642364ec91bdbeb2f78577ca486b44d08dd9fcd9d733348a3c52e6b0b8520d34877c97d

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
301B

MD5
904cddb9eac75cbd85bd591430268d53

SHA1
364efa87e9c8ed243009d248f64e0ea269bb14b9

SHA256
4a4647ad3e84d14db67619ca0ceed0df539d2ea4de9cd8d66d0b6cb8c8638ce0

SHA512
b990a631b7f2f052fb3ae5d28b2afc2b2b8e6a704888d42e00c6cb6a9e3c78ac664eec7af2bae38e32008b18c42a93681b8fc1528c93ef54c052307110d08ee0

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
f5337276357c35867d9766aaae120b37

SHA1
a75c3c04bf49cd633c77e6864905cbeb2dca18d1

SHA256
28f7b362b96a3206ba1df7aa193f282f181a17219008a801eca73e6706525273

SHA512
07f7288d32e4a7e5256477488e2e4c28df5ea0aaf97acff29de7363933f66103ab2cad3a6ba49c3f61132edbc44338e7ccb77d41283609b4cf0a072fa8a5c5e7

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
65e916cde49b8e652b8ba46fcc7150ac

SHA1
745100d4ae897c2aad20c9a935b4d7c0b5cd97c8

SHA256
75e94f4ba2a14b3e5e276c8a631f60d872f88b25b85bd45d9b62e60c769a1a0c

SHA512
361285149614242751b28f56a973e0c2023f7aefb0d251eb7af28aa242e2a1c2b46eeb739c6d16f6342d14b463d177d405c90e57a8eea7cf82936fa5555663d8

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
8637317cd436ac9cfc7d4c04b312db97

SHA1
98f01eea0d1257ce9206fd24f0e48e4665bcd39f

SHA256
0526cffb36233c04ab87e55414de614d6fcf1efecf97ff7cdaa517bdfa8f437b

SHA512
ffceeb58d214df78fada7cd93b49901bf47872c3c46a18cbc7ab282ea44056b610b482a1c2676a5bb65e08214ddcc7aceccbfbc85cd25bda04f7f6e6058af93f

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
4fe019f943845c5d7de3b6b5faca8209

SHA1
5b3ed7be62c1abfeeff2443efc3ddc7b3a76b1fc

SHA256
d19a3ff5f5a63a5c28765828da0a30854f80956a22572afd263a4f635279c67e

SHA512
63f9e22cdf12ef911074ee01a6abab97454ff5c32eb38d1ed09ed5f4305103a66738734192e310a846fe7893271750cb1df205160347fc08a30da33231e1bf5a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
275706e104426985ab5e8b16548eed74

SHA1
bbc8ebad0212ad7bcdfbde55b7967ec8a609632d

SHA256
cf25f7b28330de697e39d040085abac47ca30b5fe6cd9174d0bdd44ccaa82d18

SHA512
130b4e7ce8b44968124270ebaa8f324e1d3fd5452ace621dc8ddf21d0ce4dd9a5529ee9ce0ab8cd85d60e6a295e7675948a80bc96d7f1985b53a973bef2149c6

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
6299bd9622568c764ccb6c1259982d17

SHA1
fba2d6b85294d9bd195807f86a9d542cf6d127ef

SHA256
e1c73deb957cf128ffb27b6b55874cdff121352f7c76349c249a04b2e2950dda

SHA512
9bcca63ed23b828034f27b0c43b1b04ad5a69bb80ef7327bd7c1ac8009dc2a84f78e383d5f1979a0330bca07945ff00eb5a35b5ea9177118b168cecaaefbaac4

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
e038a8fc3303314fd556183a0c58c875

SHA1
6548ff0a998836284ac2c709834d24173108db18

SHA256
8eb69335dd4ef0e17eef8b0600f0dcfb094ff08d08b3597e6b9aebe6c915d826

SHA512
957758254a7c07f2ea0471379c80104505412c041150f87d9a525108f583a98e6a1b4d9db7fb15b48c3fb61d43f418fd5443a4947823bb953dd7479c761783fe

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
0334365281775db39c9cceb4da85b04a

SHA1
3cfba5e3619dcdd239b5959b38775d98a5cc6b06

SHA256
22df5aa65226bcd8b34267ec829d301a58e46ca998024811acbdcbba01e755f0

SHA512
31fe8ac01fd8ab8d9c43ad794573190f962d473ab9bfe3b472ccb3884f8a36368ef996db98b6a1f5c1af49c84bbf664f3471aef07c7fbfcc89b727aca4eac6ea

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
512B

MD5
49ba7abdf5479d48cdad57624d195edc

SHA1
c241118a93312d3072c7666154b38ddac1be9de0

SHA256
b2f59b90717705e0f9484e37954fd1b090fbe918faa7f16b25ecdf2b7ee1f17e

SHA512
83b01ceac6b6455d69298b6a63d3c29de0ab7df57b58d1ca7d0ca293f6c5c8345b7a03c3322446d832d4cd9ff0652a5aa218b1f57e546bcbfbd45bb3a2109930

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
c71f8c00e7150fc91ac441609fbbcf02

SHA1
36a6ef4419131abdc86547aa1181097132a735a7

SHA256
a423abe1dfa96394341ae092e9d4a2d13bf7ad452016672574b0ffa57113a385

SHA512
3439753d3ad0458560a204490aa7367db4a746c9f0842006f0281f2bfdef0849d3944dda5a2299890c33575aa88c82da7f8b7a41c7467dce3d41d8c572e15910

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
d899759e5eddec4fafe907ead408a3d6

SHA1
d9fc3e297875f2aa9f50dbc09c25be8f8634f2d8

SHA256
b5f37d8ada7e3e83f1175af8be0b9bed44e2f74ec2d888e5235a0c0946b29760

SHA512
81be999d7833804f6ec4912056611880828d279ed95a4b47f4824bd0f8549162131c6262752239770b1fdd5336645e4eee8cd5f7f80d42353cb8d591c6606041

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
8d30237dce2519cb02aace4de73d63f3

SHA1
b547af1784ef744bc0ae670f18f9f05436886266

SHA256
31eebe3085e234b019e816bf75c8994a4511f0d7760a14ca7e7dc20f53a77a3d

SHA512
77f117bcf91cdc3b4e0876351179bf3c19e6a8bb81f344135c32f27997fd39ef8be687cf853b59518f3614fa2a3aaccd8909450faae43b385dfa4ef64d3ae9a2

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
21136bd8c33deb3d653a4c5a1def2d58

SHA1
6eac9e9a49c09f78dbfebb2e943346198640d8cf

SHA256
7858a7aa4d8a93d41b873fc5f592002bfb8e269df0a372147e39bbbcec038b81

SHA512
1fd17b122fe825b97e215732c2e3554adb1c001a159353eee6e870bc9f6b4c2dcb64b5e54c22c7d727e1e3276d6316e5740fe4d5785260dafb4f2b74c16703de

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
6f00f636d45e950be8ae686aa1c4e74f

SHA1
f84676fbfc75b738cc6585ebdd90232cf6610d44

SHA256
0ab4f33cda63f75c2a6bcc8b0910c97e0314c8027be8926a9fc23f4839f570f0

SHA512
cdb3c02e2390393ed99c7ea9860af8e152bb6927ab077b0d233bf3d1651c16de43444d6d2467747a028ba4fd7872031bf7a9c59245202c662ad944c7f3aa14f1

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db

Filesize
36KB

MD5
c27def2e8bc9c2170a940c41e734292a

SHA1
9fb1d05d9f2d9d6dacc47f19196eb44d55605f9a

SHA256
fabcc19b0c3cd89f9c4df19c81b2c5d82f9d110a9904ed3c78e80515b016eacc

SHA512
fb1db6a24a3ce86e1eabf0f278ce7be1e6ee481a0ccda52dfab9a4e08e46d24ea489de0153e4ecd857765244f9bf2f832219ed09273bf94d7985a92f1226f514

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
dcda44510ebd5ce4370621f2ce0986cc

SHA1
c3118cc774d2ca7546a1d085da2305ccc422d24e

SHA256
57ba62d1006975d1cf438f2a9a5e9d8a4ef441e7f04054a191599b09529e215b

SHA512
1e20528810bfb8a9aec75be5c84cf7a220f230006c372d461bb3756a10cae525644f8eb908301ee118320dcbeb3b520932b2eac5639c274cf3d6f2d90999a82a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
30e8a4a4c56a6646b3c4fd0fd2f24fb2

SHA1
bdebfa76053b85450add980f87da685ec2012e35

SHA256
b998bfef99afd93fa3e12f78122d2ec553adeeba12dd0ad1e5d47fc6dde83bf4

SHA512
c9fe2aaf605f0a4dea7b0b0d007dc144e12971ec6b27e21c438adf3c9a5b80a734c2323df6aec2977f6d19a7b5c0d7bf577e046af6c3cbe50f82ff0a966bb1a3

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
824cfd5c208d19d1308e0c12962796ec

SHA1
d155c87290e2763c45bcccfcfbc346c4dff62b63

SHA256
a58f60becebbdeee6815ea944c6ae8ec1926072f13cac75d9547bd94a71353b2

SHA512
f94b854177e92ec80b0ad525103fd5534be9d451dcec7dd2bd0d428ea819a7568f5f4df1d40617cddc3a64e66def453efab97a1f97a1a121ee300eba4cea2c76

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
23bb4f81033d33aa0ae6f3c7fcfe2d8b

SHA1
89e4ff241f74ce6d6b48b4a1f11a867e3364584f

SHA256
a0a1ca57339e654a96c9031ae4adb313c283fe6582acbced0aaf188352d4296e

SHA512
068c1e1c19970242fc574431f671bd98aec8b0827f060319a859b4757fa7591e8915851014532904eb0776b92893f5d1b51a002af83b28e5dc708cae39ad5c40

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
1c6d09e5e8ee3ff47a931186aaff4ec8

SHA1
ae2c52778ede452b7e5463fb46c0d4d48fbd054f

SHA256
733d9f544bfaf2017e51c8c11da0e18234bca7894a7f62fc1cbb9f7d1cf94400

SHA512
5c02c02ec494f4562abd69eba5a2ad56fda090c5a29ea9d503d3cdb50a9739dc28322708076dde36d53e3d332f1eed10de432533418f9ac94a15f3251a255216

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
13912c51617f4e73ef2c90d217ac1728

SHA1
568071760cfc338e158b146eba41dede3da4337b

SHA256
bce918901a60fd7e6d27f775e562d057f714fd3e8c5cda732f4fe01895782e8b

SHA512
c55d06b52fa732b20c4a66aa132b4d439ac15c38282360f74508717999f9d912f67013968350f603c4e9ea33e1bd4ce02a0a2785410a30a96397bb23cc0af772

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db

Filesize
36KB

MD5
145fe9fc6acd5df7dcecd8849cd199c9

SHA1
4194e2711bf72c0945fccfe68702af78ec5d38ba

SHA256
cd47cda9f898356f16e6f8e83449143d3099c738b498043c89ad55ecac8d8f5e

SHA512
67665b200c7fe9049c7da936204aa92b54c0a69c2455dcb51d31769dc091ea36cc0eba836eccf80dfe0c55819e8c0c7c121acbbbbd8bbf0c99b6c0dacfd3776a

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
512B

MD5
0fac5a09d48cc1c2dfe9ddde6860d581

SHA1
d507b790e1042dd80f6fdb907ac4c11aad8232f5

SHA256
a01614dbf367e6a4607853ceb758fc960f3af492f5364411f92ea8aec41a3cf2

SHA512
79dba0035fa2f4d2cc5ae9f4e5cb3e5619110d7e3a2f15b7129d49dd4304504d03d4ad1558976cff2e4219692ba2c5832d221b3174b5fbf499a30728ae896bd1

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
3e4b0e8e1345123cc6c22cd18f2a16a2

SHA1
a89c8617160227042a5a7faf23f96edeb5050832

SHA256
39406f8c81e591d05007680a7d4a66847c99e10c4038ca77c43d21a1374e33c1

SHA512
9d8ba111b671d43e8bffa6e9465151a15ee5113fc9fa72abfca0b9f900b2004b9e52f186fc867e84b505780d46168511a5d9a2dd7adab301ff9e351ee06c7d2e

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
0756c7feab0778211d7806c34af2e7b6

SHA1
558434ee712825227679c68d7758d557668b1faa

SHA256
3206d0df24877aa7f3cb5b0ff832772991ad761300d12a5f55b4dd16aa414df0

SHA512
bed8309ce4e63886a6afa7e7a94422f211f9eef43b84d1a255a54550871cd2ef7f8724d7b7d6328488eb48626d474a4f226820d6cf077b19bfb2af28ad69ea75

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
593c19898633a2eb6649aad0ce5df98c

SHA1
7be94165f28e00ea136e8627b2e623fbad3715b8

SHA256
8a2284d514a20e6905443cade57bd6c1ffbdd03e9aed58213d3739953640c6cd

SHA512
365330789e6613760d8e89056385347f6f5a1fa428b3e45b4bc514b51cfa3b9c0efcd5b730a1b9bd3a0954f7828ed2629ccfc48ce8e7d4c98131e0541ff2f9f5

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
8a83630f21423e22f5206145f9e1107a

SHA1
917461a52f525b8434d9fa860903ca1e13a6b7e1

SHA256
d8dbf544948765b9da0e49245b9054e1271ad8d004e2c4e68715286edff87b17

SHA512
a368db1c867a333f6e7dc385d58afc0552948d76e36205e9255e54e906af401bf2b60d2d7dd3b3c94946e23431eaba2e65a8b14a9fd17c165d7de51452faa4ab

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
0244aef4f0a25181a646ee7c9dc6aea8

SHA1
f797154c2dcce77e7548d5126d4004f124cbd804

SHA256
b6c6468414de2c5d93495f8c38ec20b6eee35f45aff8ab40f90b075a5b5df859

SHA512
4a674315f780128a0f695555c5800e50bdf834329160485aea3e998fc330ae57bf688d6ab438106cdbe254c8ad3424c0582121b8d6f8d4d0c9743e8b4d68bed8

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/service_main.db

Filesize
28KB

MD5
e62087041b6e699e813ff36e18bf8663

SHA1
c27d727eab4ac6cc533d361271f15be0518a76b5

SHA256
7f9c68ebf4e5afffd2d3076a56db6f3f559acc331604dc574335dbdf23724afb

SHA512
634bd3fd9dd7edb5295dd62467bab208325307f86949cc604f51736282cfba8bee88ec8a9e75ab8bc816fc641397d843bd05ffb9b85aeaa1653c5c3ed884fa50

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/db/service_main.db-journal

Filesize
12KB

MD5
8cfabb94d38de9647b72fede8fa43dd9

SHA1
f8dc0a83048e982b2619f03b06f0cbac209bddec

SHA256
38823761144ff60ea427a900f7420f24db5f722d6ab6478d8d37d8e02467989a

SHA512
8eb0bfef75195aa4810f2b4ac9ce2d7193448124ccb3d59d7e5a9a4c9053c3ca8244b83ad7e3933f6d58263fdf2cb8a18a60ace832752a1f5931376cd09635fb

Download Submit
/data/data/com.hastenwret.naueruqwes/no_backup/appmetrica/analytics/uuid.dat

Filesize
57B

MD5
12c96a1fb5ecde9dc099d8882fafabaa

SHA1
7b2458d53f180303be4818d55790e0f42af3fb91

SHA256
a16727143ebb79c47ed6934b02bd442fa0df3092e4eb55d48628f51926957977

SHA512
6101240a40e5bcfbd97444405f3382274a7d06178f3cdceeb6ef959cfa08a6507d597751497e55a984a79700bb8743caa13f7441082fd6625ee39d72e73ed02b

Download Submit
/data/user/0/com.hastenwret.naueruqwes/app_action/cX.json

Filesize
2.6MB

MD5
39dafca52bdcdcf389595691113f7741

SHA1
fe62af4ed65dbeda43b8395e08c5f8b6f2a3e8b2

SHA256
e7c36e2e82d38d40cfb630ca3f15d9891e560b20ffd253d6ec7f3d536d17b8ee

SHA512
3fa8488af84e42302f262601696f28132e406cfaccf59287df65d22f5ea61eec1d1b2f16cb68a2bc6c0be8277c7185d078eacb934a8f9832c7a05972fa7482e9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads