ermac | d8a7bc4d3d900e901fafa5f3b781a94cedca930fd34b120497c0521847387398

Analysis

max time kernel
149s
max time network
158s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
21-10-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8a7bc4d3d900e901fafa5f3b781a94cedca930fd34b120497c0521847387398.apk
Size

3.8MB
MD5

533e38ae9ee490c9a7009eb2bdc7db91
SHA1

2b3def93f7795396a4e5c05c7402f252df49092e
SHA256

d8a7bc4d3d900e901fafa5f3b781a94cedca930fd34b120497c0521847387398
SHA512

456706099a29f7c819c1d7f3d1e2ffb8391fc08c199bc634725023baad1ab79a5447d7224ef667d6f3f164f579d9d0be0fc89b8847ca30f332e67ac2c0d73fc3
SSDEEP

98304:Sd9hMBfd6qGUjEKgcPB87DkWDNVTkY0w24:KfMBfdx9BkJTY6L

Score

10^/10

ermac hook banker collection credential_access discovery evasion execution impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

ermac

http://81.177.140.60:3434

AES_key

rsa_pubkey

AES_key

Extracted

Family

hook

http://81.177.140.60:3434

AES_key

rsa_pubkey

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5029-0.dex	family_ermac2

Hook
Hook is an Android malware that is based on Ermac with RAT capabilities.
rat trojan infostealer hook

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.dagterjias.matreyqaser:AppMetrica

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5029	com.dagterjias.matreyqaser

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dagterjias.matreyqaser/app_van/lf.json	5029	com.dagterjias.matreyqaser
/data/user/0/com.dagterjias.matreyqaser/app_van/lf.json	5324	com.dagterjias.matreyqaser:AppMetrica

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.dagterjias.matreyqaser
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.dagterjias.matreyqaser
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.dagterjias.matreyqaser

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dagterjias.matreyqaser

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.dagterjias.matreyqaser

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.dagterjias.matreyqaser

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.dagterjias.matreyqaser

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dagterjias.matreyqaser

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dagterjias.matreyqaser

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dagterjias.matreyqaser
Framework service call	android.app.IActivityManager.registerReceiver	com.dagterjias.matreyqaser:AppMetrica

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.dagterjias.matreyqaser

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dagterjias.matreyqaser
Framework API call	javax.crypto.Cipher.doFinal	com.dagterjias.matreyqaser:AppMetrica

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dagterjias.matreyqaser

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dagterjias.matreyqaser

com.dagterjias.matreyqaser
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5029

com.dagterjias.matreyqaser:AppMetrica
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5324

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dagterjias.matreyqaser/app_van/lf.json

Filesize
1.1MB

MD5
e72c7b279eb19c8ded23e6f77c003616

SHA1
2916c00f13ed7519ddf9f6eea3593e0360443e6e

SHA256
325d4484e85ff102a8951f260938385a94df231bbc9a4b94ae51cb302da09ed2

SHA512
80f4582dd52ec9b97753ac2bdd94c85765afdd2ebf84639b1f4021799e38b407bec5ad3cf4baa6fad491f190d5bb37d19e52c306cfee3e2c7b40695fbe48d683

Download Submit
/data/data/com.dagterjias.matreyqaser/app_van/lf.json

Filesize
1.1MB

MD5
af028fb66993327d3da2c32a5aa60002

SHA1
e992b46dc68a0942b3fa3168d3fa4b6e18d2aa33

SHA256
ae61137fa0abfa1adc626ee171910602ec1277e4ad2d643264761c8cfea6d387

SHA512
b42843be5dfcfcc43f33a288d3a0b63dbc8d983cecffc009586667ef251727714058ca352e82b7abdc8770d8dd1d1ae9844ce659ef76651c07dbab130596d996

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/androidx.work.workdb

Filesize
4KB

MD5
a3b967531c371973ffa505a1f7c4bb68

SHA1
a9479fb0312a853873549cc3ff1e98e2eb0a519b

SHA256
7441983ea157f25c2fd251474c674d422aa625e588235b544af546d5b4f7c688

SHA512
4bd8edd7a9580c37a42cbb4c4f7f8d1fc929239874dccf8696877c914adc787e0142e2fb156c60209539a2a719883a8d5d3bc7fe067aa9c27af82269d3aac472

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/androidx.work.workdb-journal

Filesize
8KB

MD5
131c232635b1b219d2180a653e40fc9a

SHA1
51ef1a5fdcad5fae215fce7bc6098f62de6c8346

SHA256
d9bd1978fec5caa46e8750af4550d212af8562364cb6f468e8a064677b32a17c

SHA512
458e2e703074c1e94d57a02f67928f636192b72f03a312ff065163be6f9d2d92aeb9b7a51bf047e19c549320f17c3ab982c7dd28059bdd19e31b26f906309b83

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
106621ca7cfb8a62ee19316093b7161c

SHA1
821fa7cb0742a7631c320a94a3c6a9659343f21d

SHA256
3dee762a8e12d59b3ea3d851a760c0dba7f2c3f411c319eff184e01a911adf28

SHA512
6b2facec2f05dfbd040ffa55da00455a9376f50f28b59cc9ee07fd259141bc853d31b67c629fdeaa2f234ff00855177d7f08061d0ae271ba296f2c39610521e8

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
c9d8c3f62d94876b3cd76fb42b91c048

SHA1
26e419c15c352334cedcae669eee40936c60db25

SHA256
cd0adbebce38c220f895fe3759aeda47a4d3fb4918526f564749414c8bfa36bc

SHA512
6b03af47e72619469e3b926e9911f8addfaf5825f7b14038dbf7b84d902d82c2d42adfca65a4da9a883885c10da5e6668f967239c4e170aa6d1f8063e15db234

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
fe8065e3cb88df61f1b65af782f95a6d

SHA1
641c0b82204d102373b688485041414a54594ddc

SHA256
9df5969a7e5de31f601e979a468061e6a3635ff47526afac963c89d70fc09f59

SHA512
57996f0877ff5f35f5d51dd547123c6de4afec7835b7ee4775e4c104853d13d8a885123911f5752bf07be5f37ff0af7107445ab4599313ec510401ead8e3086a

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
ac787c1e817efe3388413423f16f31f7

SHA1
c8bcc1c448a0de2a43ae5191438341b1a6d0d420

SHA256
1d236c1026e0f2febec0b6edef09752c4b31fa44b66016c12f11838d35b4408e

SHA512
c61d2a098c96e7bc84ab5676f0d9ec1bb3acec74bf701af24194b8e38fa6b005be49ff8b2c459fab2e38fcbe524a38a0181780f8be7229a1ad81e79eb0c8dacc

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

Filesize
306B

MD5
4ca69f11a753412cfb707347830ee505

SHA1
2b35ab0e51283666097baeb4726c03f47bd11642

SHA256
e8f1092377cbed8b0b2cd27d266e1a07b3fbe7221bc8dff103c6a07ac78d90a3

SHA512
b2c2baa14353565854c37154a7bd88349bc0a77e3f6b54f976fedff75aca4d4369d9132c89277f16f3c92527e77b962ba30ec09a6f7d0c5020b46dd23e1ec51a

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
231B

MD5
98b2d2efad651b6b9499597686e942b6

SHA1
52fcb6e1915b1d06e38bb8dbf3bb21e73d679a80

SHA256
82dd852695effd9bad6688aa3461ead3e1c5c07f2c7bd89fb839808e2da10242

SHA512
f14e9f4553be24e3caecb2d186d6c4d2c681dedcaff89f1b5460ed5a5d392f8b2ebc319aa6f05148fae2f81506c991df9ea2453c0e1b842ef46869bedb33123c

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
233B

MD5
ec4aebc8afbdbe29919cbf297466e5a3

SHA1
030860d66c0b1ea21d1fc224579f38d7dfbedb09

SHA256
2158b572216132f3cf56028506793105b6a6807e26f9e0ff105c1c68036c7d34

SHA512
ec804fd96b6ed99d28901c2a2bbdc8b8fea35477b24474c006389939035f5b75a39067bad20c4bf70fc8545dbce81eedfe9d4f689a639a34ea9625b6f55e1a1a

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
5824da486c1145a967733467cb95106a

SHA1
2134afe277fd91f14f07a51d3d3300a2d7ae531e

SHA256
32382257f2df077c8ee446498ea4dc7aeaab02521b10c0a20b0877bf1e41cc9b

SHA512
be71c8fe5b3a524199fc9083b0fcfe38dd8a071ad905fc8cdb6357f534b3a2542caa3d7447b28a0da0452b82da74c62a41a25c04bcdf535f338f43ed4ba7cfcd

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
242B

MD5
fc2e05efc87ccc5458c8dcca2f2793a6

SHA1
7f4010708a789818e359b6928a0f51a65fec0e75

SHA256
898dd53083e1215c06088dd078e4b901ec985ad8eb39366c5cbc1216dd2391ed

SHA512
52c337ad615d97ebc51cb8a80ebda109e00bb869f5f1d0f4bb52cde6170241740ff0cc941e92b9e01500ad4c36c573d286fae65704d22e61d088570ad9ed54f8

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
271B

MD5
e72e350c1ece2c1849c3c735bc98d527

SHA1
168a9b1f4e2c4ecf86042088cdfaf19cbfaf35c5

SHA256
796343a423ce421d49911b1d3ac65c32cf5c57030835c8d66c0d7ac74d64b1c2

SHA512
d554d0a81064d68182a4fabea2f83a052d67128961495c6ea858915d7563d075060ce06b9ca50c86266eb7c1f6530185bfa9a3bc6f03a628e656311b66dd4fd9

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/appmetrica_vital_59e53daa-636e-41ac-bcf5-45bced6b4fcc.dat

Filesize
300B

MD5
16d507e1f46612c178f0a83388ac2375

SHA1
1a4642e2849ce2bc8bb84f564c69556137cb7aa2

SHA256
6c5733d6600c6b1d017c96ed009b1a598913009a1b4964f1704d6b6108b20071

SHA512
5d286124d618e2b5e297aeee614850c03c949802a5ed5631babad57bc8c3e7f14b60e2b2bc1d508263265daba5739c4104ec75e1189e65037abcdd357ee5692f

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/auto_inapp.db

Filesize
20KB

MD5
6b9b90946bbddc5245495daaf01fb5dc

SHA1
149eb809466eb856f41d17fd40ff09c20b5601ca

SHA256
4dc9329b08cbb1ec1841231cb6e911e64c93072cc332bd4966f5bb23cc797d44

SHA512
d99d8506ee152c97988107421ffb2cfe5e18baa6c0d65f3b6d25c457edce1a0b8b906d5bfd27ee99e5ee8b5718a3fb885dca6bd72fe5e853cee492aa4a5944de

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
512B

MD5
8d380f31df906dfac3d2d2ff929857c0

SHA1
132f93f632dd91a1bf801cd5f1e191d9cd16d2b8

SHA256
70e9bc42eb61652f3170569c868cb4d6748617535753280213a3a3fdc58c40f8

SHA512
aeab9198a50b8cd71bdb20b076dd8ed0d6bd09057e3436e68d7cdabd8b3b8db53813e9b9dbe039dcc7e54abab4aead055deb3cdb1170cf1521aa09256196dde1

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
cc0339c2264aacc096ba1b37bed6ffe8

SHA1
9c38d1eba38bccfadc95535457c30d23172bacbb

SHA256
e487de8b80777c97c621a354620b57099ecfe5a040a62d28605163846c59e6ce

SHA512
68c309d625532b852fd853493e6346e1e3ebe113a31e9e9eb94ca02c7f95476ba78d532b0351dd29892c3a36bdf6f4d10e5989e22357d829204448dc242d5496

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/auto_inapp.db-journal

Filesize
8KB

MD5
fefcdb7d953a7464c148fd85ad900a2b

SHA1
abe88872d92669b484fc023b7124d6468fdff557

SHA256
76b1a80f38f9f722032ab6354803be2983bb60a46319bb7d9ed8dba6c4db730c

SHA512
6dd127a2a8e15f77a31c2f305b63582388ba3b55e4fb1233c389e2f861ff711099bbe291987ba03101d5a0e16aede58d6434da649a0ba5fb566ded86b4d3ca0b

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
9aaa5905053228ab79bb47c65562219f

SHA1
dbfdf9aa55cbf6eee97f0c5e07ca9eed0db15939

SHA256
a28dcca96d123d255f481c6c92fc766a8982c4184a353faa2c26b6d1e62284d8

SHA512
4add5baf99855c7a1d51ea84540de58824fd7c4f2d367acfce26ac533e0670693f154f0aca03b3d8f8f66627d7d7448fac35e3d8156fed627b8c6e1db3ebbdf8

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
1085d169c59f84cea39503d0c7c83aa3

SHA1
7f61e0154efd6f86d7df4b9bc89cc87c92e60cb9

SHA256
1e87ed35ef2aa9b0c298bbb2d37a605728fc7b3e7e6f434c15c017c2b8684c08

SHA512
f6d817f4bf900f0fae527b084b5fd402bc81e45de72476863a40269c56369f968aad79cbef63c4ce7030df7a57d92d66f489790751532205d056957464385acd

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
08eeac813986172900ffbe9d7cc5545d

SHA1
877bf4b52012c6237968125e769a5b281fac935d

SHA256
d3d44674b4c32f4ad40c719b7975e4d4a47c8b1e97dd951c486142dd5775c618

SHA512
2a9341b1a21ec7f94dd1cc996addb6663f4c7a7f003957afea374b048ed51888981ac5f61fda129e56c2757ef3aec2bb666154561476c25ad461a6361535f3cb

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
1f61af85e66c4fb13dc15a403d5a4df7

SHA1
28994d33b14135c34ab05b7bb2c0799e6ea0bc93

SHA256
c2d4ccff8503307919f35e1d8616973511c481d1db396de7f12c7f2841160ef3

SHA512
373f8b91c662a856e7969ea582d09e400596466761a3efd2a163d02d260d5e9284723aa7d333969c6906a6b43b17a3614468ec74c656915501581e512c8c14db

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db

Filesize
36KB

MD5
247893e69b5cccbda5f39ed074a3b3d0

SHA1
dee9c220052335649a4b11eda6f568473ce28a1e

SHA256
c76f7302ff9f1ed69f8194f28a539fbb0331b04c9dba23f4796e4613680bb1ed

SHA512
82270151b1b7ee3389416c535d851e236d21a600262d4a988b177ac193cc5344207cd2cd35a001fe57b12ec3cc8522372f8fd1ee06730a3093ea172fb7ec8056

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db

Filesize
20KB

MD5
67cd2b81f1e54777858a3236696ee931

SHA1
a32fd830edd28fe718d385abaa516ecc86a69fda

SHA256
354d9454f36f2c5bd9243b716a6646b4b27bd6edefc9abd7f64a42f3324d4c12

SHA512
572ad4cc31833e932758675b36d53a4bd34e81aacb83ab389a8f6ac3ed844d1f92e783d76b1e53a47f768b8d1230acd04fb3d8b470e146ccd9c95902aa01baaa

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
512B

MD5
82c8166ba55c9b887236f645a5871734

SHA1
5b58377f1a14e44e352d043f11f25246ae318f35

SHA256
353e99556f68611d8bbcad06f4b984020222bf44d6ccd9a3936ea9a46c25d57a

SHA512
d7f331dea730a52ccd751d0e46a015834e8164e39d7ed1d3f6f2405425e09031f0b0b0ede28f6780855912731ec7551b8c0f3211739b1d374cf13c9b02e4e212

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
66d18372c1b1b85b8aca3496cc0c83f2

SHA1
efc6e46cbd0ef6238c45d79515bdc37ea5b265d0

SHA256
3ae33b8542761c5f051ad81a960e00dfab1e261653b9deb397e4dd92c30df559

SHA512
18bcee876be5f1fd052099cec3a2d00c9a61a25747533fa556eac952715f33c92562087191039bd6bf95c9b8ef1be216f52af687c73206d821c9d73ba3819206

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
8KB

MD5
100b029f9dfa0a0f0d3bd058a28717e9

SHA1
476e353c53e011fa75a3b157895aaf0d7b022188

SHA256
b13884975413ebae535c494f3ed541f7db70259413bf4c2403aed8338950178b

SHA512
22be0a20d816f66a28b71c3fe440dbbd7f20fda70911e526effc34cb82e80d29bd2257f6ad4e085dfea4fa87492e0085d84f7ae70d675d00420fbc4f5eb07f00

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
12KB

MD5
effb8bb86f0294175494dcfcb0f8a549

SHA1
c33ec2e07ac76cc087f142031217572ed25e9e63

SHA256
03257eb23425cec237f70ee3723885cbb62a4752e637a2512c10f34cfb861a5f

SHA512
3f87a260f80b42e16550f45775b0aef73ad5d293545f0943b0a0a1a098ce47c4cc33f47e7b63e96e6c6553bf6555ca7e43d18824eacfab3ca307adec414827c1

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
340966a67ad68d53f222e1679e167de1

SHA1
58c1ba16dbb8b28d678ed9379a0b98815fd79586

SHA256
9c0955940982b8940c91900957a3c7729919f8ed35e93ef88746320dd8daa6c3

SHA512
0674b4948aac0172caf0a89307a5d8b4e872e30e33321f7fbc476c4f2e4a5205979aca8418e1d7be9233cdf4e56a082b2a04fecb1c68252b5fbc6d33548e7132

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/client.db-journal

Filesize
20KB

MD5
632409aa94cb3cd0a553a9d910317912

SHA1
8bc8142316c2ccdbeebc5d81e6c0b2f74bd63e77

SHA256
5de07e09f839fcea3769d44e76a9cfd054f0b3b25e0f325018e0ba8e5f456a30

SHA512
acd97355fd3bdfbd22ded744b5c37fb6734749fbca578a137a80b5f49c14dc0aaa28e0235c1867a4e0740801e3d4e41d06eecd1898e8bd6c348061d6d16eb6cd

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db

Filesize
36KB

MD5
a8ca96ac0f3be40f249ede41e4d1a518

SHA1
08d790b028dc81b78cc34a9734c36c86a7fafbf7

SHA256
6d4be828e8f3f9ee99a484b94fe917e65efc2ef1c0cab30a872b546f247ae71f

SHA512
01ad81560fced8e712a99bcc8bf79c4af0f6d196c72f5e17d1480e6eef4dfb4a8d8e6e5c64bde52bd1bcf2e55185dc79e6b03ca9bf2c30e9b6bb8beb1d9e685c

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
512B

MD5
26da1cbd0884efb857711a040e0dd0cb

SHA1
003ebc0a5405d077876024f4ea1e204fc8551c67

SHA256
25550e4c9e37326914f8e80a98afabc28197aef37685c37c7c606531717309ff

SHA512
0a110fd2c7b820c97bfc5f0398fa55541e177b318bfef15e6f6edefd325f1f5096b3f2ca3e2095372830ccbf56c0cad20594e28bd800df38783a7ce28896ed4e

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
5621604c8a555a817c1ca15e3c195022

SHA1
6c0a1cbaa85eb28bcbb4cdcb71ea1a6a353e83b6

SHA256
1f141f008f672fcde94e8017384ab612678175edbd63abc685d841ce8ee04f21

SHA512
d602c45b28cc991a184cf699c38fdcda66f5c3b95577c1eff62fea237518cf275c1e7ea7e3cb2187d05873edf816eb4617bf7921af7ba28181f71adb26684455

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
8KB

MD5
c2d1fcc56ad9da9be9a8fe8295509858

SHA1
5b80ce4dd7055e8586ca86c2585a800f6d6a4bc7

SHA256
6d94e0a414ba759c2b7362b4d3513f4b643de26ccc6346aec2f88eae72aff097

SHA512
e08c4116282ce407895674fdeb15c67527225a41f612c0fa0c47a83383dd5ba2dbcae857ebab7427d5fd7c684cd0a6fe46bfa5c4e2d15563dd3d2f6443881979

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
159da2e40aec58c1b57f39ec06b67aeb

SHA1
880b6eb7add14b6baa3927d3bdfc60e98cac7153

SHA256
c60222c1e310bcda28e5c521b4e93f1c5f75496ee8413c8d7039c70bbf9b4ffa

SHA512
1ae3f36578c32f2e4e96eacf3a263b4ab5203a4a6c9020a3c7ec2f2cd13fc925bac370041d292c65f816099e9d707b514e4af1bbcdeb0243c54d9c2e88f39df2

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
e5e048925cd5955adb413d9bdab69138

SHA1
7ca30e7fa5f74510736a083b6d6b976bf1e4d1c7

SHA256
d966b7ba3babc323887d80ab6a84462f614dbd6e487b520ff831bc607a3461d6

SHA512
de626d950cfb1a756bbea9571b10137d021102342ce7881f6116ea329e3961076dfd96dbfc9c1b3c999689142157b2b8e0e265f0536a8865322700084d2655b2

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_20799a27-fa80-4b36-b2db-0f8141f24180.db-journal

Filesize
12KB

MD5
96e88a634eb0dbf55d6e13c8dc97adbd

SHA1
2fe6ce70c9417e7e78a0912bd4ea5a9eb268443f

SHA256
332215eb8cf28f8d4a5364de1e5e1040d6afe73c2fac331d23501774750bf252

SHA512
4e756d8bad9e1d558d3787e9b9fa1e1b28d9b1bda60fd9a3bf7335d0f734418834bed1877923d24a815c44131b65264f8a4d66c247aabce5428a92a0f81f42c3

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
0836d957a6abb695cadea935272132e0

SHA1
2c9a7760261678f8cb70cb6e5a1d160d05ad1799

SHA256
778773d3cc7b4e864b1db0e7e1ca6068020deace4306b37f0e512ac6f3b8a11b

SHA512
387cca30c99b119d51213a1908782baaf9c82a32a7895c0bd3ce24993a883a7dda6d42d0e82393b6a06bd88e210c39560fc0469bb38a869fa5408c509e95cd6e

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
8KB

MD5
5289ad74f3b757717f517e422728a56c

SHA1
a8167180452b7aa249219bc1396ec0480ec6dff2

SHA256
1f5bd117a3c02f4fb553e6218e9b427e25b0bd90725e1e36f674b151bb270628

SHA512
4dc4a5d9b6894ce1108fb4304051705cf4ac0bb9db6416c8915fab0044594af84a35e44f271e9f5e388767dcf17e258dd85b9ffccc73b811b0cb7fac6b35d99d

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
305d703e2cbd80250e062235bd214b2f

SHA1
c39bcba0da350435a6f4ada85d858a3238a57b5f

SHA256
ff46c96640890cfaa754bbb0e4f040f8939936218e380e857454d864154cbf04

SHA512
278e330a34e6db034f826a0d7192c8a971042bf443a1a51fbdfb20b4a1156a3a24f143144d6cec6ccd8bdcda0778d058cb44f699ad448f22bc6b8e976042d98d

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
964b3c8739bd4f5573d2f4d87be4c250

SHA1
bf17a820ed05872311225905c21ef4e2ce3a4e38

SHA256
742eac045e762eef6b086320ab20e70411e3368c31227d360b0c03bdd026acd2

SHA512
b20655ea5c8cd12378af6c28e880dbb0d35b3d76dc2a62ca244683fd5e06d522e879158f4ad6c0dbccc5e87f73fa20c3841cd89f6f6e4754f94b5afc9112cfb0

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/component_main.db-journal

Filesize
12KB

MD5
72ad8fbb6725bb009a9f6bbf5cd5badc

SHA1
005fac7cc25d0e744f7062306b951274ee180ca7

SHA256
d8e2f71ed7e31449ddd2dc138aa55aaec6e4887441dc4efe1f0ed3f8abccb80d

SHA512
e72405cceb2bd811fadcda9d4247f9bdbc7319fc1f42d686e60c9ca3093ecc74f14ffb4310b5e1cff551323dd647cab9c1e62878147d11bb8f183dbee4bdf6e3

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/db/service_main.db

Filesize
28KB

MD5
a5dfdfb1c377539454d9bafb78108957

SHA1
7c52d1e078ed739add0fbff3658927f79624c116

SHA256
3281a34fca9a98df775c06b57cc7fe7a9ae88592b3772ad844e23834ba22e61e

SHA512
577acceed721d2293a30c5066603560d86db98d573ae7ef9fb095092e64f38b89bc96bb0f2e513d9e56458258c3a234de0f4f5235b9eabf24de191fb9b021f96

Download Submit
/data/data/com.dagterjias.matreyqaser/no_backup/appmetrica/analytics/uuid.dat

Filesize
57B

MD5
12c96a1fb5ecde9dc099d8882fafabaa

SHA1
7b2458d53f180303be4818d55790e0f42af3fb91

SHA256
a16727143ebb79c47ed6934b02bd442fa0df3092e4eb55d48628f51926957977

SHA512
6101240a40e5bcfbd97444405f3382274a7d06178f3cdceeb6ef959cfa08a6507d597751497e55a984a79700bb8743caa13f7441082fd6625ee39d72e73ed02b

Download Submit
/data/user/0/com.dagterjias.matreyqaser/app_van/lf.json

Filesize
2.6MB

MD5
0c4f55a0aea0687aa04f097cabd75e84

SHA1
0b29f7ffc114a63f7c9146ae67dbda76d7f12faf

SHA256
90e0cc833139874f4f78b1364feb6e56a71ed2819c74580db6e1da12d8a34a34

SHA512
1230587adce6dedad093ffdad99c0b0a4ef4c2fb3d1d618a9e9e2703eb5131c8efe3960e6d52d1a30159b5926096eb6f40ffa09fd9b5399dbfdfe11889863c7d

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads