Malware Analysis Report

2025-01-19 06:50

Sample ID 241127-mq5scaznf1
Target 1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa.apk
SHA256 1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa
Tags
antidot banker collection credential_access evasion execution impact infostealer persistence trojan discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa

Threat Level: Known bad

The file 1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa.apk was found to be: Known bad.

Malicious Activity Summary

antidot banker collection credential_access evasion execution impact infostealer persistence trojan discovery

Antidot

Antidot payload

Antidot family

Reads the contacts stored on the device.

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Makes use of the framework's Accessibility service

Obtains sensitive information copied to the device clipboard

Reads the content of the SMS messages.

Performs UI accessibility actions on behalf of the user

Requests enabling of the accessibility settings.

Requests dangerous framework permissions

Requests allowing to install additional applications from unknown sources.

Queries information about active data network

Queries the mobile country code (MCC)

Checks the application is allowed to request package installs through the package installer

Declares services with permission to bind to the system

Requests uninstalling the application.

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

Checks memory information

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-27 10:41

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD N/A N/A
Required by autofill services to bind with the system. Allows apps to autofill information in forms. android.permission.BIND_AUTOFILL_SERVICE N/A N/A
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls. android.permission.BIND_SCREENING_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-33-x64-arm64-20240624-es

Max time kernel

149s

Max time network

156s

Command Line

com.kokevugopa.backup

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Requests uninstalling the application.

evasion
Description Indicator Process Target
Intent action android.intent.action.DELETE N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kokevugopa.backup

Network

Country Destination Domain Proto
GB 172.217.16.228:443 udp
GB 172.217.16.228:443 tcp
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.179.234:443 remoteprovisioning.googleapis.com tcp
US 162.159.61.3:443 tcp
US 162.159.61.3:443 tcp
GB 142.250.200.3:443 tcp
US 162.159.61.3:443 udp
GB 142.250.200.3:443 udp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp

Files

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 89d3aa39d5633f0cfa22b048a9634b87
SHA1 d970800618282248195d94f7c49ba78410aa8832
SHA256 5bd6add73e8898a8ab316357e6cc4a8cb98d05ef314f1576de0f3e227852045f
SHA512 7a7923f258e61c0c619b8731fe6d2bde5237b732cb09c28d8af9aa759f431c12e8207008bbeef72894df9222be044801c7b683ca4d266beab9915adc04767a28

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 6cfbb48353b6d9b96774e4f142d66d24
SHA1 dc296970a251a4fc9413c6f03f23e433bbcd6c23
SHA256 69b4eacd73f0fb5b52bd6ed6e8fa6bea4f20f3449c371e87330a504ba954b1f0
SHA512 651e5f569fbbf82fedcf7c7f4fa5ed20c5b133ac6bb710818c6dd0de0185142f8c1b1e914e4961ab55deec600da33a097a57290adcc61f7d1432715d872b1711

/data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 cc1b3bc580852eef88b69702c457cf00
SHA1 6f55e9bd7ff350de3539ad443f12e022f1380e1f
SHA256 50de312cc6850fe9cfc6d4ee6b85281b3441fa833be072cfce2d1d9aa4972784
SHA512 48684c11a5daafecaa274fe443a680a4c8d575c2dc6572e13273cec7aa7d41bce5882e99053cac0f42175258a4000f7edabb1140f589624c3ba8d7e19eacea33

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-journal

MD5 f82c156d3041f506629a4734bb94f328
SHA1 275ece352dea8764ab1f0bb3cd99033c696f3e22
SHA256 574a556643da87e6cc816f40cc32267f4d408c23d4d695a4fe2b3027de30e0ce
SHA512 ef5848eacc75ee37231a3eb53ece166ae8eeeef88a4e125fdbcab3ca49978a61b968ea85c38ac033a854308a695ad0a027097a06d6ea422be77936b9a9c17d8a

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb

MD5 55f9e3d4b69a6ea436bf2bb13c39677f
SHA1 0d1eac6c34ab64af5704f3174dbbd48926b9ac39
SHA256 0fcf97512edd96bca16d2628b3cc391413db271e59ffecd60b2f7dcf84e92880
SHA512 7761dd131feb29e93527d8eecff01235f6b06b711201400b9d576dd5af174da8587649e7d665234ae327ab431e031c6ca367ebc8dc5e1e3f250f4a7be7a51d61

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 bd6e783442c0d55a57d1885c93172495
SHA1 3b4fd7dac6ecee8b567c1b31e4b872860debb7e5
SHA256 4b248e0b7d5f25dca425f323961795fad34574fd1b0d0e9be2f14334b84984aa
SHA512 4f7b32f725b5db3ef95bfa33a90e86395a2ddc9f38210d9e88d9ac2d5422574b7e7087ef45d342c254f2c954d33275f0967dc7dee05fdc0af64d8927d36f8d42

/data/data/com.kokevugopa.backup/app_work/oat/x86_64/MSrQZQH.vdex

MD5 dd36f22178ad58514ced17eab7d8b8ab
SHA1 949f6d6947aabe22875613efd673fb761b5f112a
SHA256 4221756438d80081dfc6e8499fbd5c04e0ff7df3c787225cda1a8658e73a75c9
SHA512 6f14bfe1b7017baecf22dce9866266b640d08b1a53ff1ccb804e3c387fd4a48258f618f84f067021913bec59954fd0bac4ffa66e2df4f9be6753581e759b386a

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 4c833f9df24c4c1844fb7a2ef8d4785c
SHA1 2bcf9078670a5321f52c26744982c73d3d546c89
SHA256 5e7fe1f05f4caf337e984dbfa2063d5cbf64df8e082a19443e789a286bc615f0
SHA512 82ada0745df885dfc6ea39aa28f49360d4abfdd5100794ec6650c4d4298333305f94c39afbd476b7ab3d41be3712c18e82dcf60f4c71cf79855e631ae91cbb45

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 b1253a799c87ad7d56c868a54ed13f1f
SHA1 843e1491356a01dd7254fbf61e8f54271a32f6c1
SHA256 00c7b394ad7bda936ab75b5f9c0342f348e2510c538167ff9cf7842e89a605a5
SHA512 c276c4e6ee43c2f4a2a8590f56656ac68e8d818d7ed6661ade823f6d2ca5e3616a0688783c98fa6d2f037acd92ff3f78d15bca30a61aaae17a1ca127bbd81b10

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 2f8bf65aef04d57d6536d2b555e14296
SHA1 6d1ef93155bc6ce3f58608925c5c0b87e07ccd7a
SHA256 a72ca68014679e121f3e2edea4e9455ee198ba5519d4f8dd59512908e679ed2d
SHA512 81263766f0f377c49f413a02fba0b394d923b6d155eb0a1e0207bd8588316a9e72b7de779d4453887944b2d4f06606d39ae12284f5bc5960da1fefa81d5b5598

/data/data/com.kokevugopa.backup/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 1665355e97308f5332768fc9500ccf22
SHA1 31a0b88ca4e540fdb5a731d1779be52d742ef478
SHA256 fbdb6ec2b93d0cdf279d81354d056c3c88222f89d1303c445b896dfcb753d268
SHA512 dd8805388f0834b5eb36e36bfa61eec3ceeb5b57966e3738cc3dd5ad403df284121680108ce14b8f3b33946587ad12114935c02f39ec2d7da630dbd50cb3fc81

/data/data/com.kokevugopa.backup/files/profileInstalled

MD5 8fe0d823e33986d0b71d01088a1b52fe
SHA1 6ae0c1e0cb9f580f4f2edf056cc6702306984946
SHA256 00874d24bc2cff64f90af59256baf2d70a00227c4a3b6d14cba926a116d41d98
SHA512 0a2a031daa07e9394fbae4f995c95ef3070d4a24f1413e09702aaff13a32dedcc771018ae7237ac49cd27e5b149e4f886db92d84310fbb52a5d8e3acf0056078

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-x86-arm-20240624-es

Max time kernel

149s

Max time network

149s

Command Line

com.kokevugopa.backup

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json N/A N/A
N/A /data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Requests uninstalling the application.

evasion
Description Indicator Process Target
Intent action android.intent.action.DELETE N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kokevugopa.backup

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.kokevugopa.backup/app_work/oat/x86/MSrQZQH.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 216.58.212.202:443 semanticlocation-pa.googleapis.com tcp
US 216.230.233.144:6220 masupoltd.pro tcp

Files

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 89d3aa39d5633f0cfa22b048a9634b87
SHA1 d970800618282248195d94f7c49ba78410aa8832
SHA256 5bd6add73e8898a8ab316357e6cc4a8cb98d05ef314f1576de0f3e227852045f
SHA512 7a7923f258e61c0c619b8731fe6d2bde5237b732cb09c28d8af9aa759f431c12e8207008bbeef72894df9222be044801c7b683ca4d266beab9915adc04767a28

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 6cfbb48353b6d9b96774e4f142d66d24
SHA1 dc296970a251a4fc9413c6f03f23e433bbcd6c23
SHA256 69b4eacd73f0fb5b52bd6ed6e8fa6bea4f20f3449c371e87330a504ba954b1f0
SHA512 651e5f569fbbf82fedcf7c7f4fa5ed20c5b133ac6bb710818c6dd0de0185142f8c1b1e914e4961ab55deec600da33a097a57290adcc61f7d1432715d872b1711

/data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 cc1b3bc580852eef88b69702c457cf00
SHA1 6f55e9bd7ff350de3539ad443f12e022f1380e1f
SHA256 50de312cc6850fe9cfc6d4ee6b85281b3441fa833be072cfce2d1d9aa4972784
SHA512 48684c11a5daafecaa274fe443a680a4c8d575c2dc6572e13273cec7aa7d41bce5882e99053cac0f42175258a4000f7edabb1140f589624c3ba8d7e19eacea33

/data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 e7b8533f4790d9fa167afac04452da7c
SHA1 7a067dbf80f8d9a80862b6376940b04ff27ceb05
SHA256 ed7cd8bacd88207804d3382ce761f42b59e3dc4ba18cda57ebcd28375a183764
SHA512 3feeb3a35eef87160d123636aa2cf3ac820f716a3b9d7dd74b73d3c020368c75b44797fed3f15de30ec84cc0c832540ca873afff4ebde38717ab1524ab7c690d

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-journal

MD5 2066222dbf402259f62bed2ea32f0f2d
SHA1 88acc04aadab6cd45479476883ba3c9c7d2f5390
SHA256 4475a1694f4fbb6c3494bf42d199a2934c33d75b14685e0262405df25563d32f
SHA512 96a836ad024089a3dcb7b783634d7af2730d77b55a1dc672f26893e67f57f82b5bed3cf6dde94b5ae1544904164d9ccc2e1431f0a4601959ea1ebbe3a7873e6b

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb

MD5 54e3bcf7722564a20c85348595ea3da3
SHA1 ab3a193814d3aa2c40b4d78f7948760d53a7e19f
SHA256 872870eeb9027375f0eb2d24af45e8c65d1fdb6659856859ce86bfc60c396403
SHA512 79ff1aade8a2bdd0cbc171a2224752b43477e084f3b9895fc9ddc2e94f2fabc4049b5d6d2e3e5dcb95d4e96a129a81c0913df12076dcde7df680b0f2d18ea336

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 58eaf3bb153777bc0934e98b6706fd0a
SHA1 b096b6720c221ae020d5275d5d1303fe539b54f9
SHA256 984a3c399d8236ce9c838ed3da62f0a59086011e73f4258fbd3ccd4949f49813
SHA512 1a2c3d722453523bca319da2edd7813204d8d956ce9fdebccf9d625e10e7a44dde4c066e8043e03a94f3128595d8e41a8634067b3b325b49f1591eec3fc47c12

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 fac8e50dacd1a40cd7a28ac178be970e
SHA1 5eebb626b4bbc118a45f9f7a4fd0230476ee245c
SHA256 2c7a5c7fffcd562025c9382d83fd0b997369f0670e5805028918aefe77393798
SHA512 0b246dc043bb30a62787745b724ecc9ab28df4ed7f141a141985490076d5eafb989343ed9959712dfcb61696e692866276dd74ae5ae5d1ec802e846d386e17e1

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 d00e54f090c170f896a02b691187c90a
SHA1 233459d89432aa9946edb2af37c9de6ab09a9ab0
SHA256 cdebc2377525acc3e1eabc68b986acd6526d90721ba04baf649920ba8676c2e0
SHA512 a3698b304ec0ed32582fc4160e601313ec54a94d692c2df3bc0a91679c190234deaab714edf1fb61e89418aac618ef9a7daf647c8eda20a2d1a151988a89ec78

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 7b6f2ad56e47077a0afa331b208da3bb
SHA1 9ced7c791fee3f19a6405a6b31d0ea3e6cce3826
SHA256 8d290c1341eb12a456a8c73462b52a634d0dd59aa9bcc433b57b2c2fe2553bb8
SHA512 9118957aacda3d68a938a2f99181591c84403dd6107a0399f34948f8a812ecde5d13c5224b74ad0f17d233d23fcd237c7dd28aafe71dc690f41cc833d3e6994a

/data/data/com.kokevugopa.backup/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 693151679c573bf949dd6fd3a29147b3
SHA1 8d237830f0679f71784b1f67cbcc179611d45d05
SHA256 e4a413ad9963aebeff23507482a85fe23b670c59efa96689f1874d78b80d2b37
SHA512 ae2b03edeb47062a3cee8fdf40398372e9baadfb9672bfedc95926c3edca6b6fe4521cc3a3b1b1a57de3cc541d93f4df4ba1182d8af233909411761094131b6b

/data/data/com.kokevugopa.backup/files/profileInstalled

MD5 477283bf214c558d96d46a8dd6e02a34
SHA1 73b8f0147282bfe5c9539313f2549d562e088069
SHA256 05a7855b86b9238fc9679e847f5ed969faffa5a37f1327cf5211a4504e070dce
SHA512 ccc16664ba9f3a1e6135c63abbbc822f3bd394453a1399743a9d90c655f8f0b4aa13c424ac9f22100b7d7fb10a251c8d541fcf2255824518b4e4dac3505813ac

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 2e1c524bda4b8c6592f9f96e69837496
SHA1 35d950beddb281b51259ee256cb868a3ee6719a7
SHA256 617487b5e97e226dd556f72cb843db400a6a19ea68e46daed0000ff3020c60b2
SHA512 96d7bf7ffbbcf3126476a7d3e88dbf5888137d2af819fdfbedb4bf4d1618a283e39c59e43210b970748ce9bd51c73277ac7859ba7966fe36291702d360c201d6

/data/data/com.kokevugopa.backup/app_work/oat/MSrQZQH.json.cur.prof

MD5 0084685c133961a5107198e95437dc1b
SHA1 07ccc9828e49555605920933be65266069f2deea
SHA256 8892d71fd9d501228b7012615b8b8f41d71748e287b3f06b9bed720723efff6f
SHA512 cb275eae3fcd749a73bbd3bfd24512054b46f174e5b784465bbafa60209d6b29af8471cbb5d4d77f519453308e3dd3382a612dbaf38c7439f885a12f40c08a8a

/data/data/com.kokevugopa.backup/app_work/oat/MSrQZQH.json.cur.prof

MD5 1cd6cdd2e05d92c67f65f9ca2aa4bf8f
SHA1 72a181f98b8eecbc3e9b18c50bbc1ef6d98175c4
SHA256 9d7d5734772aae7171bcdd2922fb60969fa8cc0ab32022613e8c9b809baae7ef
SHA512 438e3d3430908d1ce60572fa6f4c51110b0b543618c48231d4a3d414cbc30d5f5151b540f2e3719508b95c9b2f797a327040d38dc48983ba84a99bf894d0864e

/data/data/com.kokevugopa.backup/app_work/oat/MSrQZQH.json.cur.prof

MD5 b6b2884819e30103c32dfafc50ffb620
SHA1 04cc86fb8821683a391445268ebc18b13f9771be
SHA256 ce8b30122028bbafa3a576f22a7d5f9b65d9a9f566a5a11bac0fd32068b6dc7b
SHA512 260bcb20bc22447372fa46c43e3edc903b22377f987561d63a4e2540e2ec5811030168a5c08793007c0d9c2d48e7a74dce917d915e549528c16197ec6fc1f750

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-x64-arm64-20240624-es

Max time kernel

55s

Max time network

135s

Command Line

com.redewabobo.ASCII

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks the application is allowed to request package installs through the package installer

evasion
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls N/A N/A

Requests allowing to install additional applications from unknown sources.

evasion
Description Indicator Process Target
Intent action android.settings.MANAGE_UNKNOWN_APP_SOURCES N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.redewabobo.ASCII

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.178.4:443 tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp

Files

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 6d4147d5dc237d47e6047e7c9e143a1f
SHA1 88a3ca6e99ed83b181ac91925ce79a2bf64e29d3
SHA256 a6127a9f0f4f6b4b8e926a67ed03fa06223a5244c1429e71ff4b600d761f89aa
SHA512 f2c4ef369841d60d92e3030c64c495712bd0300d1a82f4d86af44e4f888b216fbea5ac6d082d61413798094ed4fed6ad3e802f2d06b388d7e3fe1753c7d0b469

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 d29ff5767cac5e17ea2ad5110aa71597
SHA1 62ad19dbe39d41afae9f78e423eb182da8a89c85
SHA256 70a1ede06d781289b40d4980a35041d9e58504e5a4d55209360469ba70491cf3
SHA512 f8dd1eb911e8f591131d162d38dc2a29b24f87f0e052de2005abfb43a2560c0641ee48c2b587739a4a469322847ecf6c7ec8e2a88aa3af8ec654868443e1b1f1

/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 c32af470fb777428515b5c01369fd81f
SHA1 72e65e062280b2a13b4792630119392bfd451860
SHA256 8c110fecd6d2f3d6b22ec6885d03199e64bba8e79d6d0acc8ad16f6cfb4a05a5
SHA512 bb40e7eac8d0861a060a37632ce6d679503972309cf510267ede98e7d9e0b14b252bd222300db3ed1e696e69d6f47c852129f8d52eff29fb34319cefc1dbb500

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-journal

MD5 147b1a3f59b465d4cf899fe84062c33c
SHA1 119fc1a6b9b404370bafbb0874a2250e76dfca0a
SHA256 4611e636600f5ec00a9501881e45887de0e7ca2225558899922df42f8eddfabc
SHA512 9e1762aa9869ae975e420aa583f54a2d6813bdabd066d6f5ff66e4264aadaa7278f48bbada1a50f1a6aaf6fcc10554d472bc8b53d15b5998777669544e6dc41d

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb

MD5 e1997a5626854c7b22198bc8b3f46b5d
SHA1 f4c6a4242c8dc657a35744e6d3940323ac8b7b53
SHA256 8cf53abc9310146899195164430438890f03ad56047be0e1a74c5e661940aa0d
SHA512 119c493e224a4c8b0131fe0435147af24d2a567aae233485bdfccbdcbc211cf7f0d5965d03f8c01e779d4a199cd5e448067769d38114eb69759ee7cb49783c9d

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 b562bdc675e066227bf97a7ade45c2b2
SHA1 9ae92f55f0a3adf6a4e88b9212a586f795157e90
SHA256 cc8ec29969fb6a608926b9e2ac394e49ce97dc5a0907ae395628c95c25df6a33
SHA512 9ecd83f3d8d04fb9d9f739be262a3a81f3b1bb91ef871affb7724030104c61a907f0efa6cc7d20a2aad8960fbd8745c4f8b5e60b367a7cddd404ab1e9d0c60c1

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 2621a48f72ac9854e79ad4602470692e
SHA1 207d70ff3e6f8b81424876435519deac1e25305e
SHA256 381e300236ecfe0f973500b3f0a6c5e8f336c775539cc6c1ff83e18cbee53205
SHA512 a7efb19a99aad9c4d30d37fbde683874aeef805f10e798fcadda602eaf963ba5f47162b4d7922b4f6ff44070cfc23b9b4cdb9fdad333ea7b64efcb24f0718e03

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 3536fe1b6dd3ca42ea0e97024dcb490d
SHA1 c913de36c0d222da16b3ff0047b7eb9356e83a3c
SHA256 377ddeba5339800ebf876b2342f9c60cec94c6a3f0e5c8e26e173b660225f59d
SHA512 0e2d3fa15afc54e886c351a4a4a0cbb18ebb5dead002a38267a5f6368ecad23f02cd3ac834c8b1bc6e61184fda3be0e5fe6596be8e0bda0faef9861524f846af

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 f9fb0ef0764e987c965397688b5e58ad
SHA1 5b2c1dad6b5f1a301948924fcdf8b574dae57a4c
SHA256 531ba96667421fe63883c0f7cba6ccb49ff301192bc9467224f7be0fcee74181
SHA512 2a6e6637e2cbd978314f773a91613779bfdccd3b7bfd270f6eadd3b698969ac6cd8ea553d8eb7d3df4cbe905fdf61f5f745602173023cdf9795b10edb32e31e0

/data/data/com.redewabobo.ASCII/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 a172cf2fffa310f2adeda3ef06fad18b
SHA1 ab8c649b0fb4a82fd5e4143bcb7d31c35aeb1763
SHA256 5857d2745dd1a77c70aa6cd5916d62c2a05ade35e6e447ddf61142a0d5401a0a
SHA512 d60d076efb08fb025c959841a57b13f3f21c98aa15f42603d326c91c08157143f5ed7b9629dd8cf55ac93eb113eaa8bfea339b0e274da14184c234fba27222e9

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-33-x64-arm64-20240624-es

Max time kernel

149s

Max time network

134s

Command Line

com.redewabobo.ASCII

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks the application is allowed to request package installs through the package installer

evasion
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls N/A N/A

Requests allowing to install additional applications from unknown sources.

evasion
Description Indicator Process Target
Intent action android.settings.MANAGE_UNKNOWN_APP_SOURCES N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.redewabobo.ASCII

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.4:443 udp
GB 142.250.178.4:443 tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.178.4:443 tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.187.195:443 tcp
US 172.64.41.3:443 udp
GB 142.250.187.195:443 udp
GB 142.250.178.4:443 udp

Files

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 6d4147d5dc237d47e6047e7c9e143a1f
SHA1 88a3ca6e99ed83b181ac91925ce79a2bf64e29d3
SHA256 a6127a9f0f4f6b4b8e926a67ed03fa06223a5244c1429e71ff4b600d761f89aa
SHA512 f2c4ef369841d60d92e3030c64c495712bd0300d1a82f4d86af44e4f888b216fbea5ac6d082d61413798094ed4fed6ad3e802f2d06b388d7e3fe1753c7d0b469

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 d29ff5767cac5e17ea2ad5110aa71597
SHA1 62ad19dbe39d41afae9f78e423eb182da8a89c85
SHA256 70a1ede06d781289b40d4980a35041d9e58504e5a4d55209360469ba70491cf3
SHA512 f8dd1eb911e8f591131d162d38dc2a29b24f87f0e052de2005abfb43a2560c0641ee48c2b587739a4a469322847ecf6c7ec8e2a88aa3af8ec654868443e1b1f1

/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 c32af470fb777428515b5c01369fd81f
SHA1 72e65e062280b2a13b4792630119392bfd451860
SHA256 8c110fecd6d2f3d6b22ec6885d03199e64bba8e79d6d0acc8ad16f6cfb4a05a5
SHA512 bb40e7eac8d0861a060a37632ce6d679503972309cf510267ede98e7d9e0b14b252bd222300db3ed1e696e69d6f47c852129f8d52eff29fb34319cefc1dbb500

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-journal

MD5 94e01475b57c6424bf3f5a3927030e0a
SHA1 37ac304cd12fbe4ed4ab6610beb52ba07f72f417
SHA256 fd4e96760ba090dff1a74d4f4a68874b28b82b884b91a36972b5f25c2b437627
SHA512 6c37e6b17abeb6acb6ec335611cd7e52af90947a16d02828064f85a18d9afa2f2b06c0a9a99c9d4657812522ceaae712dced145c25036ec5968c8b89ac1e7274

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb

MD5 a4f723510611cd77795d39d6b92d501c
SHA1 7fd776a4414606ab5878b9a0063a0a8ba6bf6e4a
SHA256 3f8deb913b19b8a53846a37f5e21c18139b3fa9070b6e4aade5aa545299c66ac
SHA512 0c2266c4e464dd5fae01b8e8729109545002019bcd5724a2f61f1f582ac36a5c58313da8d8b7a56b9f87e39b341009c8281a87084ea2ce51d411fa42a28cceba

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 0586d8d382187a161b948914d7855da0
SHA1 6bdfad1965756fc3d26085850a13602e2666e268
SHA256 44e4eb2a3647b9e3d06d3e419d812937017276cfb92f60fec4afd7d06a6637d1
SHA512 c8f2d70494eafe3f923caa7db7be74ffb20550f5f2cd5d4278135ee7fbbf529fb6b0c35b74dc81e679bda5a3e277c9d688aa88bb965ab76ede70482a312a1d62

/data/data/com.redewabobo.ASCII/app_afraid/oat/x86_64/YHfPRq.vdex

MD5 d47966f3b79344a2b9f4b60115cbd3a6
SHA1 aeecc867505f6004ddbc5eca2f2ff0c62041c7c6
SHA256 ebf69da3e21acbab50aa2fcde26832fd2730440a47b0be5cdca928c913fd32fc
SHA512 a6f13580b35a43d32b58e233592b33df11436dcfae3f5d60225defbc0462583bfc18f4f599b67cd330a07ae6b3c2bf24e4b1a3922fbfa966755852f727337e17

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 b9a65d0cd5c9f46e51a51eb5211ac010
SHA1 a5c5b39d7ddeac77b428f3bf4f6402ba6831e1a7
SHA256 023601c3b5304649c1c98a13736844152fa55c082f0a2a50862188a4a6b20b4b
SHA512 9d4c730cd3cd8020bf082201d821208c5016c4fea09f0c2da35e087b0fec9d852c62d3066b9cb9455431658d9d2b450568f49638e484b9b3d59c47bfddf8acd5

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 35b0da6f7831058c5e489b4fd8201555
SHA1 ac29cc57dd0c11bda2f96dcb29f845a654cd3d77
SHA256 4bad6ad55b19beda10818dc66f48aab29e06140378c6be2d0b3ead1b04b9e224
SHA512 0903078bd5f823d6d0603c53459890379341c7709abdf82a47b9c4db803854f74583c829df67c70efaa99f4681619fb90c50f4628fb066627a2941b33268ce37

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 6633686c3903e16ea18e7cc0a548f3a7
SHA1 4af8ea2210880c30629ac173faf058f92c619d56
SHA256 01f8cc5151a31665eb2955efacef6840dfeb4dba468bab1884427bef17570584
SHA512 c513321678a761973798a4327740b892f2d3763e6d076373ecc44876e401fa1fbafc44747bab5113a3ae793e8ccc0fe1cecf4540874729211c0f08b96fe835f1

/data/data/com.redewabobo.ASCII/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 ceb581e33645cf15b3ff8939bc18531a
SHA1 4095483c7320aed417a3f87f2be6bfb8886faf0e
SHA256 ba5387eb316351f1a23e0f966d75c4c64f896ea55923818b2320ab3facdacd72
SHA512 7a3ea9cba5405575c802ec90c950bb5a98f44e80d4d9a158b88176c5e1f8edecf0c9c7c1cbde5a4401abe7a056a669e088a5dc13bf0d65263cdd2eab3bf4270c

/data/data/com.redewabobo.ASCII/files/profileInstalled

MD5 d1397676cf2dbbaf864116e778c1077a
SHA1 d7ffe90413ae9ce271bd7169901fc85cf5316c0f
SHA256 73c71083da243755d2283cf75e98dabf9d42f2e5a144b8c6ee6d48f2ef343ef1
SHA512 550d2c6082d019b7acd7ec02587542f6ad5c923fe411d912cff494de3d42ad695dd6aac5fdf0a52741856b8330b2c5d511092412aeb1c9e4a1c41879c8ffeb3a

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 dd9b633aa6bc26fcf66462babdb73c23
SHA1 1ee7bca64de691fe490818a39b930a35fa9ac2ca
SHA256 52bef6a472ccc637a45a6fe1e52d83acac52bcd743cfba72d1fb790ac21b638f
SHA512 9ed5fb60dc518c720271e521544be7b2e3e1bce56e37ac9ffafca2944b21253c9d1db166497a4d07b929fdad9cb5ea2e01ab006ec048ad81f195f2f35403f3ea

/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

MD5 0366aa19192ce59fa3159ac1774b4331
SHA1 70eb54479f13d16e1057a1c58ec4ba76d0337ab6
SHA256 6313f3c979520a267925f3b589593e172906dd06238f17c6e4f52407fbc28a7c
SHA512 b73eafe07a51dcfb806f357fea3af299d8fe36ce89d9398f1ddfe479a54b82dbcc6c2fa51b6038ed3fd429cdb418218850a57638fdad7d430daa78161f496408

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-x86-arm-20240624-es

Max time kernel

149s

Max time network

133s

Command Line

com.redewabobo.ASCII

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json N/A N/A
N/A /data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Requests allowing to install additional applications from unknown sources.

evasion
Description Indicator Process Target
Intent action android.settings.MANAGE_UNKNOWN_APP_SOURCES N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.redewabobo.ASCII

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.redewabobo.ASCII/app_afraid/oat/x86/YHfPRq.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp

Files

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 6d4147d5dc237d47e6047e7c9e143a1f
SHA1 88a3ca6e99ed83b181ac91925ce79a2bf64e29d3
SHA256 a6127a9f0f4f6b4b8e926a67ed03fa06223a5244c1429e71ff4b600d761f89aa
SHA512 f2c4ef369841d60d92e3030c64c495712bd0300d1a82f4d86af44e4f888b216fbea5ac6d082d61413798094ed4fed6ad3e802f2d06b388d7e3fe1753c7d0b469

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 d29ff5767cac5e17ea2ad5110aa71597
SHA1 62ad19dbe39d41afae9f78e423eb182da8a89c85
SHA256 70a1ede06d781289b40d4980a35041d9e58504e5a4d55209360469ba70491cf3
SHA512 f8dd1eb911e8f591131d162d38dc2a29b24f87f0e052de2005abfb43a2560c0641ee48c2b587739a4a469322847ecf6c7ec8e2a88aa3af8ec654868443e1b1f1

/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 c32af470fb777428515b5c01369fd81f
SHA1 72e65e062280b2a13b4792630119392bfd451860
SHA256 8c110fecd6d2f3d6b22ec6885d03199e64bba8e79d6d0acc8ad16f6cfb4a05a5
SHA512 bb40e7eac8d0861a060a37632ce6d679503972309cf510267ede98e7d9e0b14b252bd222300db3ed1e696e69d6f47c852129f8d52eff29fb34319cefc1dbb500

/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 0c74ccdd2e952f1fc963e7469a366e59
SHA1 f5377407c4ae99dfbb943669badd1e881ba0ef1f
SHA256 c4983f0d13b7020d35e90e349428781d98a4375ede58742966b57643da5c60fc
SHA512 9dd1dfc44b7c389b5054ae76d80086f6f974cccdcb45ee16c99cae7c926c163654f851f88db41e55c96dd486429ab3044d75b28f71d11d5014cf289ad82e8ae1

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-journal

MD5 71effa245dd144b7e2efe71711122201
SHA1 8070250d3ed0550ff1f9934b45209e03355e9cf6
SHA256 aafb1e1b3631f4c714e019a11f96b4013d401a19ff8d272188ea174534f9c17f
SHA512 3d9c592d517aad6dfe8891107a044a7a5e60e8232582aac51ae793dced26b76764de9731e16864085e39279487adaf615581c5eae8fff3b699c1236f8053b2ec

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb

MD5 3a17bdaf1acf8fdf235924c34aac7934
SHA1 aa52a841524b228f1cb52b2a5b0c46bf651c9901
SHA256 ff4e8771260d6c3e2f129e84aa785b001ccf458ecc21a3023f546d6188588633
SHA512 ffd2074eac16bfe77d4001fd9b69dacdeb961394aebed74fb5434f05e48bcf69d0c182b1032e10bc4d22f926a70759c41d8f34aa3532d6ebc7ad9ce68f7cb1f0

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 983cf65ed98678bc7e69a17c012077e2
SHA1 209f26e021e95514aa5ff21ce89018ff21003283
SHA256 3b048397810b63e0265b1441a045c93a0eb3ece34f1776f965cbd4d591663871
SHA512 3b8d43447ad5b405cf7ae3e31226032fb3ff76b1e8b2be51ea87502744fdba1f2fbe959fd0842c10603e59cdf6102b9be8f15b9a2b5c1a550c6585da0bc86c3d

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 b18376dc30c8267533bfeff882cd1cc6
SHA1 65df620bd62e8b88b762698aebb256cde68e221e
SHA256 c36d02eefeda22c21fdc4b9dec334e72b69eca83f0f322267ec50499b22f34be
SHA512 775c6b28ef579d16f1b0eeae8ea9981d3a580c9c7635fa683e5d742a055f67f283ed43e7b2b39556ed448f44533b7323d813688ddde6d0700f6ffe978dbcbfab

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 a554edcec30549a86a6c9792b9011936
SHA1 038d282becb84792a3f3a03fc19eea8ef8805cf9
SHA256 22757319208c710f0219ebcfd2f4cb13d15269982dce7178aa479e899f02a393
SHA512 a3a944d24f40a0c0df7b6590c9482735496a73302d6081d290a2a33fcde430bf3e12ad9ecfb92ba985844c0248a20e2c7cf92c9a818a7f05487311d06643025c

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 f9fb0ef0764e987c965397688b5e58ad
SHA1 5b2c1dad6b5f1a301948924fcdf8b574dae57a4c
SHA256 531ba96667421fe63883c0f7cba6ccb49ff301192bc9467224f7be0fcee74181
SHA512 2a6e6637e2cbd978314f773a91613779bfdccd3b7bfd270f6eadd3b698969ac6cd8ea553d8eb7d3df4cbe905fdf61f5f745602173023cdf9795b10edb32e31e0

/data/data/com.redewabobo.ASCII/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 2cebf3f846b374f28176a323615cc929
SHA1 a6be105a506701cdf58aa10e97a7da4750537269
SHA256 dd6627d1c63418a549d1cecbff005af2a46970e26de6f1ca4cb13bf22933e357
SHA512 d4d839053408055d7c40bcf7271e8986a9fc5cc91f41e4f1cf2fb0569dd23c7b9ed81c9c4f1c26eec275696d959effe750c0d60a409c5365bbfd9ee96874a78f

/data/data/com.redewabobo.ASCII/files/profileInstalled

MD5 75faa8b509f11f72dad7df3fb590548e
SHA1 fe681e5c5025e987c97f0dc6d96e96672b364e75
SHA256 026f30599fd7aaf72e8fa55d6b6856ad11a0dae53cf0b12f03b4a995e6a12735
SHA512 840c927f37c49d8e1ac42f588f0d77fc232101dd6b79f2558f01f578ba621e5f0d471377c0cb4f2ef0cd7507c7e42dba911cb1f27815de958b9f5e0154046694

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 288124e55f183a7d8d93d81e350dbb15
SHA1 711653db9a47b45194991d3bc7489e4b8f06b5cb
SHA256 0245a9e5673e7b55c89d20083d1866d17728fd328f5998f3670042a0289a0063
SHA512 bca79a5b5c62fbd41a50cfd80fd70577586a55b728f6893bd4b17385a8f737985d15f8e56b231260a74860b4a43d578e54a41a19ac39738389a0ea20338eaeaf

/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

MD5 51c184e986395f479294c6530d194d49
SHA1 19243cd43aec16b1d04520cef94e7997884fa61f
SHA256 ea812f0f34e6a2d87614425896ba3155febc66e3c4a3fdb943a0061f27921e2e
SHA512 bfe53b1273480783c3cc24aaa669cff6883c2ff2fe66c911a3de2c14d383aed62dbcabba1bcafad98e8ca1d1d65e1cae537ec2d6e2379b233ff2058c755dfec3

/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

MD5 598eaa47b5842c09b7dbe9c8bdab7d83
SHA1 7927f13c9dbc010c7c9cdf71eda2351792cc229b
SHA256 0e213ccaa952547e0a83a9545f348f0a961941bf54218b4708fedd1193650a4c
SHA512 5a3a64d07541f73873abafd4ef7e30be0180f8734649c1235fe97be363dfe00c0acad75d78549b8357da0735268ffb121a5fc17353a87f56e115be4696952ceb

/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

MD5 87833da8cb7c9d13d09575008382996b
SHA1 e19cd8f3a25dbf4ad67fe2622441340343711e5b
SHA256 a68252ab85dc99370039ffdceeaa57616d8c3ba66c09d39dd8d348930917595a
SHA512 8091cea9f4f204710e5ca281c7689576e92e700c21ae932612f73c9e49473bf516be041046d0530f4cbe67fc4d6fe294ea659bbae76d4d8e3e4d3d1ed12a542a

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-x64-20240624-es

Max time kernel

149s

Max time network

161s

Command Line

com.kokevugopa.backup

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/data/phones N/A N/A

Reads the content of the SMS messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/ N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kokevugopa.backup

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.169.46:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 216.58.213.10:443 semanticlocation-pa.googleapis.com tcp
GB 172.217.16.228:443 tcp
GB 172.217.16.228:443 tcp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.213.10:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.212.238:443 tcp
GB 142.250.200.34:443 tcp

Files

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 89d3aa39d5633f0cfa22b048a9634b87
SHA1 d970800618282248195d94f7c49ba78410aa8832
SHA256 5bd6add73e8898a8ab316357e6cc4a8cb98d05ef314f1576de0f3e227852045f
SHA512 7a7923f258e61c0c619b8731fe6d2bde5237b732cb09c28d8af9aa759f431c12e8207008bbeef72894df9222be044801c7b683ca4d266beab9915adc04767a28

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 6cfbb48353b6d9b96774e4f142d66d24
SHA1 dc296970a251a4fc9413c6f03f23e433bbcd6c23
SHA256 69b4eacd73f0fb5b52bd6ed6e8fa6bea4f20f3449c371e87330a504ba954b1f0
SHA512 651e5f569fbbf82fedcf7c7f4fa5ed20c5b133ac6bb710818c6dd0de0185142f8c1b1e914e4961ab55deec600da33a097a57290adcc61f7d1432715d872b1711

/data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 cc1b3bc580852eef88b69702c457cf00
SHA1 6f55e9bd7ff350de3539ad443f12e022f1380e1f
SHA256 50de312cc6850fe9cfc6d4ee6b85281b3441fa833be072cfce2d1d9aa4972784
SHA512 48684c11a5daafecaa274fe443a680a4c8d575c2dc6572e13273cec7aa7d41bce5882e99053cac0f42175258a4000f7edabb1140f589624c3ba8d7e19eacea33

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-journal

MD5 5ec579b7b53bdea12d93ff365c5a525c
SHA1 634c6f518ff306e37eba58c37b74690633bd63e4
SHA256 25594d9c42ebd9b588e0a54c694ff30179262d444222e032dbe641ea08052284
SHA512 5556b49fc3caf2b6fd17994f226728db539dcc0dde869a8c6518fb2057bb537048bbef2138ed373b16cd296d061dcafa855d11ce1f991328b3e5adaf79419201

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb

MD5 f067f9eae6d55456e34efff29effc76b
SHA1 2b8be317e55f3c76985fd128087c81022dbfc24b
SHA256 b8470e8483ab006b78e8e3fe75d360765e4962ebea7e3e2664dd209add0ef966
SHA512 162a58c2e923770ef8b1e8aa0a5ca29c33b4fa800f787071497fe946fbe16364febbb09c29e1e74b11fdfc2a2e1b73a32a219322d51dbc85559ccf7d1f93a2e7

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 b36804795588479a0e25e541fab4638f
SHA1 ba6d3d8d78261bd904ea03255e02be36025536a9
SHA256 65d15def8436f63b15622e4d7ac9ad0281cd9ea070b2ed0ae04cd16842dc229c
SHA512 614d6948798a469be826bf1da46e0ab3ef7b71ce969c60a38334d4e3205096f4c48c649a195bf81637043e12249081a8d21888e720f455b60cbf124431cf0565

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 bc2cfca640e200fafd9f31d36579c2f9
SHA1 6ea96fb3004ba1752387ffb99d92b3929740165f
SHA256 152ab20f44a3736ecf60ef9ab0a1711040fa0cc968701af2f9ab5c411f2b6aee
SHA512 7933878f88aaa7fec2593e6af07eba714a23057934b3eeb9844d572ca6e7c6cadd1e838f596926a1e7599f841cd83002b07bb09b43d168971b79d891ff667b9e

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 497abfd8a39dddf737bd696a35403b67
SHA1 c24b97968be145bb64dc545af8358951f084cf4f
SHA256 9177f4938f2ccd7efa2724316d4b36339b451a353ba0880100ddcea3ef7fef69
SHA512 98ccc5d0a5fbb6236b187b14a2e4309299ec0ff066ff9465bacfc6e223f82fc0df0d455fa29c363a1c07783efbd5a1619ed19993116b1179ee1aa3570dafcb71

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 7b6f2ad56e47077a0afa331b208da3bb
SHA1 9ced7c791fee3f19a6405a6b31d0ea3e6cce3826
SHA256 8d290c1341eb12a456a8c73462b52a634d0dd59aa9bcc433b57b2c2fe2553bb8
SHA512 9118957aacda3d68a938a2f99181591c84403dd6107a0399f34948f8a812ecde5d13c5224b74ad0f17d233d23fcd237c7dd28aafe71dc690f41cc833d3e6994a

/data/data/com.kokevugopa.backup/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 aca8c977f6ee78e17f22ba56c333d548
SHA1 05f6da9d11f1c116ae1a359e4be2e48932e2894f
SHA256 4bb623084b7561e1c008af92a22144586e52ef94338add94887baa311f031f8e
SHA512 3415882c0568e9bc30564fed7e7b4048b6a2e06e491412a77f6a1f651a802afe132c8139a93b7bf68da155bcfb2563c961dc776d1b0ba9f96a9a886176ddb177

/data/data/com.kokevugopa.backup/files/profileInstalled

MD5 2f7cdb826807c72516c1104a0f0453a3
SHA1 e9a0b28c740856837db678634ff6f3525fe14c71
SHA256 b2fcaba3b98e1d53d75cb8e7cc970893b258f65957007fac4296099f25176926
SHA512 aa328be40f6302e35908b39a3e1763b68ad476fe4f08d3d63370211a6cfd31f9cc8df1b443ccf2a0cb05effba709999b86fcaef9c57219fdb234b9f4b683a7a6

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 2e1c524bda4b8c6592f9f96e69837496
SHA1 35d950beddb281b51259ee256cb868a3ee6719a7
SHA256 617487b5e97e226dd556f72cb843db400a6a19ea68e46daed0000ff3020c60b2
SHA512 96d7bf7ffbbcf3126476a7d3e88dbf5888137d2af819fdfbedb4bf4d1618a283e39c59e43210b970748ce9bd51c73277ac7859ba7966fe36291702d360c201d6

/data/data/com.kokevugopa.backup/app_work/oat/MSrQZQH.json.cur.prof

MD5 a2ab5a46d25944401c9cd508dd7b1c7f
SHA1 7056109cdd2d01816d76490768c23adf8f151c89
SHA256 13bd071718c1bdcf7c1320d13e44e8e482e6cf97d601ce4da324215cd4c72d41
SHA512 c862a8cc8102352daf123690b7f7b58e5caab9ee32aa2a575018e81b07625471f150bdeb8aea0acd0d2c7b538dbb180cc142a233b2c9dae1cd11fc36f48e91e5

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/HWrTNVydyLKvy

MD5 7c6be5a6c5ed525860f9728a8b5b29df
SHA1 a44979c983f7995104942aeb5c1aae4ff1660302
SHA256 b6f929e168284900fe7145d5c269296fe59420c6dab446b33660c84c8df49538
SHA512 655bfa49a3586fedbf7864d6b946876f3305fd506d33fa3a074b7c4be076efdfd6480f78aef98ad50400ba8bd59dc6f7a3d22c39e09763484a413612a742b5b3

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/account.svg

MD5 d1b68e2cd423aba52d74f02573df2d2d
SHA1 9faa2f472eeaa4b61be00b1a0ae2e1de3082e407
SHA256 2041bf4f141ac095abe365c86bb814509ef11dc741ba3b7e70fe60766432110e
SHA512 b1b798397d00943958e8e00cb73243cf40129921efff9db852891b47711f0b32cb616ec1d24a8ccaff939ced0f24399649fcf9c7614d8f880899c7152d9d525e

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/address.svg

MD5 02698a3383765bd3c250471c53a86c5a
SHA1 cf1bb1e4f5dae0c3bb0605b77565bda2c12d75e5
SHA256 a1f675a555609fc86e744fa9d86b35f0924803c10d8d3da2ca01d4171188552e
SHA512 bff93c586263eeb0e70cf8fee862da65d5b28b5590685fae05197f8f13c1567c3d8533c4c7e6c15620f8461b432e9a5ec223d98fe598a52030079375613484b6

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/amex.svg

MD5 4ef2cc1c19c4101a2796ce594e0e7535
SHA1 834159a45ec0f6214a69c989ebcad2b38d35d2fc
SHA256 a8b64f1d1c20dde5f1083f6d97adec85871f517a8515c8541997716edf998f57
SHA512 960e0f4dc9d71f2d25171699ac78fecdafde5e1af0ff46f33b8788d3cac37914fa9f52a8bced580fc9a428cb8c3cf066dae0a57cfa57d674c6cad67ccb260a8f

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/contact.svg

MD5 e28714c71f217892f72b2698ea5cefef
SHA1 e4257063db9df43dcde90920cc3f34978baea51d
SHA256 65845e7cecbf4e88691bff290f72b427b70887e23879f523bbc5b2b032c7609f
SHA512 c693b70d3edcb32daea8bec867bdf34ac2ed491f9cbc4a57a5433f462dc6ef2d0f01a0c17d7dfd457064d13d45207659abf116b09191dfddf38e706fc72a59bd

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/diners.svg

MD5 01e7bd9695ba96d721e4783c6ba4e1a3
SHA1 ac8106708ce31f7c84af48bff2a55e89b67cc47c
SHA256 e5701891ba7b56fa0c339e1f2a4924b1a0fa1ed316221978a050199b03c1a7b0
SHA512 bacc2ee9f69da95153fee3731be0654197f0b737e2b55a6b05c645b9b7f644efa50767526ddbf53d18fbd58618b567092aa7fd1dacaa5682f4e9d5f7cc52ec50

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/discover.svg

MD5 2416e9bff05f99da2ed704ba7a756095
SHA1 a47376b86a8101bfeecd9c8764b83e4940656ab7
SHA256 93464ac55e072d69ca52da614e7cb9409020a548c67100aaec0b1e0b02a285d7
SHA512 1ec32113bd47d6385796acbdfcdb9a859a82fa2494f9405fc48ecd7f0dedee7e250f1d6ee4dc1b2bc03a59ec239349c8b35d7eec788752580e7a37447af6ac94

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/gpay.png

MD5 11b23369789ebe1f42808e05a32229c8
SHA1 dfe8a3828154d7e7f95c4f463402c291ddfeaf9f
SHA256 8f5a52f2f4795d761728c7d65f8ca6c2d6019e9c35a212f8c99a1624c1e9a024
SHA512 94a179d4715f788edbb9461f2556337f6c5164ba4fc94a94af3f90cf2de07ce477aebafb03d5f34437349f9dbeab02a9228564345d4bc3a3ff5256cba87491f0

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/info.svg

MD5 c1b97d74dace7e43a9ccb26841a7cae4
SHA1 83f78c8d77bf9499b7e839345bb94c22a89616af
SHA256 d9de9633583a448cad1268d42ffdf48d0b3c60d2693600b843a7ebe43ad06908
SHA512 b3986af15a3ffb3ab35b8e3c120bc9ba8becd5892cb7c1de0ba5ad08a83499acec288b20708ee834ea43bfe446fd01ada8ca55e0893eebe766241913db11a88b

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/jcb.svg

MD5 3d18424d24a7b251227e9b6987f1bbd3
SHA1 10ed0873d1184efd246c0e3228b55b476a21f9ea
SHA256 b54883a82a539a3cacd87542b555b077c6412948e63618d110f9ae9df448fce1
SHA512 776650b3fcac0ba0537f0f63ee06d68dca3ae78081afa39400b5733f1d1ec8db2d2dc56e4626af9aa7aed243d1dc56180dfe20ab3eca6036bee6481c56c7d559

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/logo.svg

MD5 554640f465eb3ed903b543dae0a1bcac
SHA1 e0e6e2c8939008217eb76a3b3282ca75f3dc401a
SHA256 99bf4aa403643a6d41c028e5db29c79c17cbc815b3e10cd5c6b8f90567a03e52
SHA512 462198e2b69f72f1dc9743d0ea5eed7974a035f24600aa1c2de0211d978ff0795370560cbf274ccc82c8ac97dc3706c753168d4b90b0b81ae84cc922c055cff0

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/maestro.svg

MD5 9e755d978a7472d65917ddb9cbce57a6
SHA1 3cbacaf6cbae4a562c44ac0f46204d085dfb9e9c
SHA256 a0767b76a0ae413400a92b19e02c9c21c1aef23d83b1e97acc7919cea93295fd
SHA512 47125c8d7477152dbc56e744884fa2592121895e76729ae2f1ed080de75039ae09f2f8489ebacd27721c47dceb809034a4cdbbd3d96ced270fdf97f404178886

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/mastercard.svg

MD5 2238ddcab98adf4503001c60167d4cbe
SHA1 8050fb7d63cd4460b926d7d8b3182ce90f8d54ec
SHA256 e50cdea249957d9b947ade44c9df472fabfbc774f2c016e154f897e0f1479e23
SHA512 61bcf239cb5f3fa27839e0c8b89ebb0420dbf856146d95d9455935b8f2e1ef120e41e970bc4c22736a2f08e9db7870d9fcbf5ede64164f5f3253ff316bfc8749

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/monetize.svg

MD5 22cbda60db0d04d1391937f3de1287cf
SHA1 41d34b57971f264e67a14bfe60b37f14caf33c16
SHA256 53608fb0322ebd2eeeabb249123dd295828593ed3fc22cf37b2b3c17afaca64d
SHA512 0c2aec116caee46e1734023e98c02fea908d54e832baa6ef2c2c05d41defd9df8e49f58204c8b479446cf8ca0224f961ea5ea7c26a1a89bb8b08af79a0108aab

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/payment.png

MD5 4561b3bcd407d2c1c8e4f20608345bfa
SHA1 a7064cd1a377091976b32a0c99cd582a80359e3c
SHA256 4a99877468793bce4905da0b7d2ad150e1174c4c994a7c13acba0648346751cd
SHA512 d3c615a1cf83e8cc6ace7ef3b53582c7752ac5d007b66923ceb4260e1150829ee28d33091b67c382dcccbf9fcb88efddafb4976dba2f338f236d6be29f5ec3fd

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/profile.svg

MD5 4f19891c43001db11efc8048f9bc7cdb
SHA1 fb001afc35e6b79d7771dd3893102c14718a58cd
SHA256 4f0d0becd3f8a0496fa98581492b85f53aafdf0cd51e5626b5fd0b6ab2db9379
SHA512 a59528bab7a538e4f221bca27440eb88c873950d1595aa7718ff9613d7ce14ce40cbd29d209b0bcc3c8029360e2bc3740ab723802492e75d13c91a153d7df457

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/repair.svg

MD5 900a793eae04f4bddd675f8d95c4a794
SHA1 d79fe87cc4b220245ab72251dcf3ae4c71108544
SHA256 166eab00b3516b5aeb1bb114fa70d57e0f4e021d4c06735c6969b08c5b7e1fdb
SHA512 e18fc18597424e69987e13e8f4e6e174a56b46c2d1616e203ac9c02efbefb47ccabb39ed999b0df1784cefc0d7444c19e2ddaca30022f45864554f999587de13

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/unionpay.svg

MD5 a65652162457a764a7527f2d0089e534
SHA1 07ab0ceb6d78c27e666277423086111bfb18fc22
SHA256 7c9c351d2a9aa28d60407da1d489d464bea1a42ec154bc76a8f30f6d5057c716
SHA512 700b5600a6daa994f7fe4ff2e5c2ece8c8d7afdd96811f9241e8ae061678f6fb35a66d26a8d0735cbeb1e910ab8572340bd62772aae6b2d4fe5cda334d89bcbf

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/visa.svg

MD5 a7570a902e11170c8cbeb81cc9312db0
SHA1 45df5296f0bf2218fba648ccc21ef1621cd3fc7c
SHA256 44f3387c399f770bed7ba717c63c62f81821a18a1b64cf127d3af0641cf11ff1
SHA512 6905a8e4d35e78d5aa29bb9bd0f7988eabc5bc6c2bb2d92b7dcd5f52ee5232c6f9e9e7fb29c3432233bf2e230c8246f33aa9c778c945d5af64bcd749eaaff097

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/img/wait.png

MD5 5de67c83bd759733af1ab30c6eb198f5
SHA1 5cad48a2fec1a3af6c61b56e9ea2af7cbf289430
SHA256 aec504d9ac9e65022fc800da981f724050e7920af6b31208ccc3a425d11a8fa6
SHA512 41a960f498aa9ced4b64157129d1a9a809a56ff435d249dcfb5b45ccbf7a7834216861081d4ecde09a2f8f579813f13758d107220a8b781023d9b3dde2cd0c86

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/angular.min.js

MD5 57d5ec9bb2a88256b2a8e6e30f6d82ae
SHA1 89a0d3b6f64239119866905507e9bbfe54ccb4a1
SHA256 566f18cb8bc23558701c2cc4f934fe50bcc85629d1aaf5d589f835f2b3e57a9f
SHA512 8e21be2f0241d1b997767e1bc8acd61fac213e99cbcb5a67180fe9dd509714b938209fc5b5f71bdb691ab4f4daa6ddf943a930ae59d185e2ba50f3887498584c

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/bootstrap.bundle.min.js

MD5 0aa8d64e726c4a57adb5c88f9115996b
SHA1 901169527507ff9e662cf64d8e361f359308970d
SHA256 7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
SHA512 ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/bootstrap.min.js

MD5 a08792f518b51f0f1422b5c96df9eb8a
SHA1 3f094f010bfb0c022a51b62778d4361d1cad3fd6
SHA256 5c36e28c9a7bd864b673e223db7e1934923227536ffbdf871f58b6f09b9ac8c9
SHA512 6ba72d23ac35920dc9e1d4a39271e3dda58b11b8e2b405c08cb0d1531a36c326260c545ccf6449b90af93372adf0efd3b544a9f27dab032697632d6c8e82a6ad

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/card.js

MD5 6968ba8317f89df6bfcc7e4e8be3c6ad
SHA1 e06a97939b4beba77db9e6b573b9f2837439bffb
SHA256 01f0dd06c9e07e352899f449d22f628a8467c1c21c896aace6b5401e8be984e2
SHA512 6a40cf2ae16850c82254e3c05a701537d925d393b8ddc04d8a1fd348a3b0a8ed6f5175cd7dd2f680a38a96b50bbb9b1705cf923db9b6377a6d8700a129c38cdf

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/cc.js

MD5 01125b91acc77ff11fc966d10da9e2a2
SHA1 c02cc36611d1a7da149e26939e0c256f2061b178
SHA256 967ae1bc5642f6b9eb1b5a8dd790f307006c9e86bd8deeb98313369682bc4112
SHA512 7d904599ac635e45b93e5ef25c31814a91e3a1278bbe66c7eaa7de0cbcaac6d514af0dc93924664226169b64982b3441f601e44289a60e3ac1f6c3fd63e68d8e

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/cc_ln.js

MD5 cf02f00a504f7fdc9a450d866c39adc1
SHA1 3a021e78cdd1b398a422050dac37fa33513db1b4
SHA256 c853fa31a686cdf22ed1281946b1889d89705a0ca063b7e5998ab1f6f1786ee3
SHA512 fd63c9abed8e2555cbcf3739ed36264fe9d546aa7585f64dd8bd005f61b06373b12acccba83813c68911e4a56bfbd0d27312b704b59b47936f309cc4649d8f48

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/jquery.mask.js

MD5 7764eebd3ba64867b2bf91125a52def0
SHA1 9ba23da39ed04c90b294d8ff05cf44800f9e8e19
SHA256 a3f740178522c4412d76e80c3dfcf7571c67f76ddd61d8215f1d8c7a0e3fce9a
SHA512 fcd89569c27ab28a0f59d34b720dc168e048aaf89438bdec5cab5e2ca971e191304ee9fb1b4ee89d2d953384ed2acd4d48e3b379e4e22d87868b2c11f365ccb6

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/jquery.maskedinput.min.js

MD5 7ca9553c56805a72add283b3d73c19ae
SHA1 32729eefa597eddfabe9217e271697d9a0b1b023
SHA256 deb84e22b3cef4ede9c0b7761c41757132def0ec85fe9dba516187fe4fcf9fc5
SHA512 d73990c1a72a1af22b522e6dc6ced2806d8563266b66dc79976ef99b4a7fa5f4a1835f36f6469a698e09dfb06191f408940669182be08232a62da9b667ad8997

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/jquery.min.js

MD5 12108007906290015100837a6a61e9f4
SHA1 1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3
SHA256 c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
SHA512 93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/js/tabsSlider.js

MD5 6e5dc919c9e261a0cc439e5d3df8f5e8
SHA1 716e8e8d8462765f97088153e74a7d95c6e21585
SHA256 a4acf4863fa3d04a0be7fbecaaccbc5606027771bdb870668dad4bae30011fa2
SHA512 ec62de28a77b1a6747d5c1d0cdab4a02fdb1c6e558fed9332145ca7af5fa5f6427448130a9aa481ce7af807e028cfc313ce6a1c182422996c88621d05ba49097

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/animated.less

MD5 08baef05e05301cabc91599a54921081
SHA1 421f2c4e10191f148c13b8a34e5ff3f484d4c393
SHA256 c7035423d5a1e03d36bcfd6465481e4c4d5c91f316fa878a6e5103afe1b0bbf6
SHA512 285de8b339ae691c8c95230462b8760949850ecbd1a4f8b98b0f85347f1187ca7727507a50ba7ee362b57b1ccc94efe57fa99bb501bbea93561ca3104f73084c

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/bordered-pulled.less

MD5 898f90e40876883214bbd121b0c20e9f
SHA1 a2c292137b17406183ad0fdbf4880fd648b9a5ca
SHA256 e3d168a292ba33d4e3215919963a304dc25732a73cebdde6e7ebe4d47ab43eb6
SHA512 666a33697b525aa25d773c94360b96dd6ff833dedf99178af931b040aa93239c5814bfdd433a841d77c2a3addcc444d7ec95c83073b9d30e48ed5fff4e82a111

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/core.less

MD5 fb4efe4ae63737706875bbbfc7b7e9af
SHA1 1a37352286619b789d151a06eb4b7551e4c1aaa2
SHA256 a4a93d598134f656ac6c7a0a5f375afa941e71e348e68ecf3cd6feb7616acf9e
SHA512 88b310200bdd13129f343e8f9b581e3a376fd5aec4c7a604815101774d31ca3fb469d345321aee80303842309b10273885195545f69fb81ea13215e751ef5187

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/fixed-width.less

MD5 5e07ec001f8d21bd279c12ee542813f7
SHA1 ec0c24b97184dab86177660f486b8d08cd636c42
SHA256 0ef853a3192742d207ea0e793dc8bcc6322dcb9e50d41f4b981c4ebac2dac7ac
SHA512 b7bf0de65815043012e95e8b1bac895e85c9a07c047c99ba4f5c132a00ace5aeb3e838f2aac26d8451b38d193fde8199c45d58a2a79931e5bdbda47f15c8822d

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/font-awesome.less

MD5 15cb7faa02437c2f9719351c157fe7e7
SHA1 9ffe7422dc235450a21f019f410ed359ed151f4b
SHA256 2df62305a8a14e09ecad58a155a478f1c8c11318f405360be683219f62b3ea24
SHA512 f5cf809023468a015234142efd754543054f9fabcf06ecb58db792537b8526c5d73098cb059e6e37ddf295895e92ace9005e9c4e5eaab19d33f06ac478c69acf

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/icons.less

MD5 bf95b901c36b646ff457379bdcda94b7
SHA1 0285a999eb1adad868366678c2d9365b77186a45
SHA256 4d585eeee98f4826c547e030a690690ea56a4dede806fc8176342abecd06fea1
SHA512 8735bbdc8c7c9d082c2a1f261c74bed575fa096ba8775ad48ada6894f03a8319414db099395e80f16f6e89d802c988c1a2bbf73252c65acb040c35d40b9ed0f5

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/larger.less

MD5 8cb65280c0f889daf72626c21a7c8628
SHA1 e7119e82dc50540dbc3472bba7d74282815a7ecc
SHA256 dfc79d4325804e9ade21ab65145b23b1c4193d24a893690bc47b5c0739ca3c0a
SHA512 5ba01d3b3c917dfcc0bf20a283397e677d420addb83c74d29f81d77658105c8d9e48784d2e8f5214919877141056a74f06d3081fa291269f92c4506ac089a745

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/list.less

MD5 975571323cf880a4a30601998236b027
SHA1 f53bc20884a1410d950b4a36a330c5181a8b55ab
SHA256 024abb930e6669f215ddee19f58077571f1cabb7aee1274bf96b226c296b73d3
SHA512 a13c48c3ab87469b5e720287f5f1720f0588bb45a0700968879cbba7ba008d070cdcd69b41d374cb504311c0a20bc4e727872855ae5e90fc76b1589104acc07f

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/mixins.less

MD5 fbb1f2f1ab96ba020c7f14208aac72b8
SHA1 3c5b36b0069372b525ed8bbbcf6b3d4d2bed4e78
SHA256 65c4bb7138772043fafd2167b74c0fd7ac15e57ba7877adecde4b0992950670c
SHA512 9fba58dc30953169340a57fcda1b3dcccbe69cb9ee5ad3e29e53719fb185f4b49f9571be248675d5cf5d82f86482086df022283b31b1766090f9954755f7a47f

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/path.less

MD5 a8c41460c42a4fe9e98550f00c8b3f19
SHA1 1afb4a849059631f76ed2a519d7fb1bd0af14802
SHA256 a0dcbbcd3976f59116268c109767c3b98fe358872f6e9fc1a0d26a337d272b8f
SHA512 2214dadd8025d0da912ee4e0366a25b6d521f61ad04cd61c0b13140a9465d7711db8a80e3c83bc5410624eeef8bb2dbd1aba48cc3fa39b75d5eb5e91afbb7ba7

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/rotated-flipped.less

MD5 a8476cdc50c264abd11ff59d6a9dd025
SHA1 95de5de9009714692430b04f9cd4388be8fba8f3
SHA256 d67df95488eec84d2d0caf79727825a8ff4b2df90c604151783e3ec2388dad38
SHA512 a906cde529bac0abc118201866c6e81ceed53ea5859795ebe87e52e1d04f1c32b0ae1dc2a9297e2d6a2cc44a7bbfcdccd01ead571198027430b98190ce5efa67

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/screen-reader.less

MD5 0f881617264587bef0df6ce92253ecea
SHA1 71139132f170ebe7712836210f4d2c4905151899
SHA256 b32ff7821a7b0a649f9202a02eeb8ce88fe671eb52d61ece50aabdbce21110c6
SHA512 7d5c0d28b78b9c24b6af0181f8bf72d1b7bf20c45edbf1594da8b4c8391dd24920b9d0ad186ada7217755cbbabb9bf6ea52acd8ed39f7c9abf4659339eb70504

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/stacked.less

MD5 518e2b2d263982d2caa1e6514b4b4eac
SHA1 f044077bc8be1a989c245254e81eb084d52d29a7
SHA256 3f9de6c3e0f1a2bc71579a417d7c415f82f2a3d3f4792161a8588bb8bdd75450
SHA512 0f07e1507d430c8ade9cbf2460c8148d69fdce6b5b7c659247953e0e0235c5128cec1cd1a329790b9bfa42967cbafd36776d81f6e4ff80520149f8ff4a6ba629

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/less/variables.less

MD5 be3f6eed38aa909483e1bd9ee0876e80
SHA1 8a5c800747705df16117cc598c1b9f512e873bfe
SHA256 e3717422976292d8fdc4b2a9ed02b8d0be55ad50b86e9bff74761e5ccf94b839
SHA512 1691b468571a87081a892621941b3f0f954a3c5a4c588811b329e092bae28a8946f4e0ed5c440c7bd4248d3aa31c3be26867d28771703cbca41cedf5f3f3fc72

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/font-awesome.scss

MD5 8c015559216d1654630a839b61c6b83d
SHA1 dd83648ea5bc832f87c3c1bf956c54dec065a9bd
SHA256 4cb4a00ca08b6e456e09f2fbeecdc5ab13f7c91bcbea263300c814aef3ffcf43
SHA512 e5cd637954db11cc3e86af92ec127847c7476c22dd1e165c56a2816733368f02edff7fb54679ca77574f8fd86778528b6ff51ae0a39701e09b310a84b877580a

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_animated.scss

MD5 39ff4f359a7b81d6585075715f41e5dc
SHA1 8daf189b2f8a404495b8424b6fd1ba630dd1c2dc
SHA256 900e2531ca7544fa8f6e0db9996bd28d3970185ed810717a0a4879da135e5478
SHA512 5d8be64ce5136d02dcc2dc38341491c2cafca5633a8bbcf6bc6931da2ec95e2e29ffddd8a058842da4764620824914f7c7c7048a6c9e54d3e97bd7ab995834f5

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_bordered-pulled.scss

MD5 4cad0df17bf40327feae33fa9a6c6ba2
SHA1 164b6a0a2b307cd293f4a914ab0fcdf643950374
SHA256 d1d28d405b9328313c843f7c1a40951ee1a738d632081beb76a0e072b407f549
SHA512 01095953afd37d399f8715168a67a2e60c23623f3ead4eb4360f8800e30cb9572ee5d90b48ab4d0e07271f75b11da2d4a4cc39115a872e2f001000cfb46a8bea

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_core.scss

MD5 ef059a98cf9de6ca5b77ee6850771cf0
SHA1 55a14a34267edc401b82e5ee41d8bd84fbb5da3f
SHA256 e6e81949b0ac466839c5239a1450967ec32af30eb7c25d1845569621e8a1c8fc
SHA512 78b807ddc8ac17eebfd4f59eb923a7f8bac8e7b76bc83985d593382b1964f1d98539af83c95c4aaf99e3e492304e08d452980879213fc13d9b9f69539f1f74c6

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_fixed-width.scss

MD5 9277ab6964a434d499873687b00be906
SHA1 224417ca266c657849afb2bbcb6dc455894ff387
SHA256 b8b0b3478e04e868ef0cd5fa3fb291524f1932144d1bd3427d156afe369194e9
SHA512 27392694f9bd1a671cd21517721a86c24725c51fcad4acaf09cb75a9e36bea34176af900c82e061eb0ee6b60a1bd0d9e99213119c5175c2f48b6800258ba840d

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_icons.scss

MD5 de9fa842ad0b619a95ac4f42ac6ba930
SHA1 830e0183337d16c07b1c63838f7593a33ee87b15
SHA256 a8f1b5d6a1a1992748ab95412443fb28afc0ab711d86fbdfa7d8a0b00cee3a48
SHA512 b7f5aa12eb8cab73fd506d499f9c871b54d5939058b9ac27b858499f051d9af74a6374b2bc32eb2aecc169f9c2332cb2abd6b56b150d864df1d19ae153f16301

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_larger.scss

MD5 e95931566f6fc6ad5685c4fa9802e206
SHA1 940e1c5ebc690283bfaee92560cf15fabedbf6a9
SHA256 fb4e8e7d5d03074da402f544d36bd6adb6adaed7ad816c4bcb3f53fe03273c17
SHA512 ed6e63e7cdc9bae34810146c3dfd52b912f7b20219555994249f6f3dbd528673af58b69deecd9819f28f71713076c6694f6db0e31148e8e726f714312f404a73

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_list.scss

MD5 7107e80b053928271d5fcf422dc29490
SHA1 4b53ee01513df8b9ce76442b2d8f1851613a435c
SHA256 d5430a6695febcd9e7f5898041aed2b62060d1b8d7b782e0f4975210a0ddf38e
SHA512 d8b110a513c41ba8a00620143aa01b2bca59f21306b64e96cb82e4739ea88beddc0d3ba2679f277a34c89fa5cfa3d4b0f8ac5b16d9beccccae36b2f8450ef75b

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_mixins.scss

MD5 aa2b8f32b403733713d8885f14ab86cc
SHA1 4f3881034a4c11cae8cc915f288477b498a357a2
SHA256 2efe3c665c5fecc6fb3f6acdf185fdc0b1871ad074381fa39b581cafc5fa82ce
SHA512 da84a310d9322e8a4b5e0c739e93a5c66418930930eed7e4a14351b61aa6073465302552642c75553819fe2ea7903ece21b20494761a94daada05bd6fb2e48fe

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_path.scss

MD5 ab5a9e8388563e097b5ce835601f01d2
SHA1 080158aeb1bf6df59ec98b2bbed44da61d9c9ca3
SHA256 0e035e21bbdf7f14f1453fa126aaf39f0b62479471f3cba649a64dd2daa54e26
SHA512 9eaa7d29bb402c790bf1ad40ee849e26743d198bff3cfce0182c2320afd9d47f4377b2bfb147999a057604dcfed33e408065577a516be0f3623fc0df75120912

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_rotated-flipped.scss

MD5 9f5d4bc6fadea89328d2aac26574a9d8
SHA1 ca08a0af3da63c2f2a7d3c27a8747637744cc785
SHA256 ff0686d76acde3581d679be874fbf73a8bcae4110fa7b6c7aa08ab204a7f3b7a
SHA512 89a2a4009628540c88c9375c7f04bade6bb9b901575c12fe22d0031c10011f4c5c3b7834d4caf6b1cfb84501a5a77d5c4e6cebc9a8ff92c8bc6c82ec6bfed40f

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_screen-reader.scss

MD5 8907bd7dbf4799e8120bda5568d76fea
SHA1 2d8563c488f68e75a28d540dd89301ee4ee08c97
SHA256 1c964c84d5ec33fd35918f260ea3503aaaa4b3f1090b342a6e98db6d047d5e38
SHA512 5e3c8df5f64a9ddd9c7dad6f939156090e832a43c4352f7f470169ba22133267931f53100da2a4f4ec5e5528734c5d60c42ebc64fae6a5ee1dbc2e920dc343c9

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_stacked.scss

MD5 5594237226aedfbca2fa1c7f4604c214
SHA1 cf6752ee609af36eb293a7197c88d31ecacbbc74
SHA256 70f33fd079ab708587c63b5884e04b31a3f46fd33923cb046621ff18b1bd99d2
SHA512 25492b5ff68a6d2c8f9ddcebbea75b1f14a7f47d599bea5d75e1f5fabdb5e3d43147e6df2c435c7ea639c094811872e53941ccb79f204026b6fe2cae172df7ac

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/scss/_variables.scss

MD5 dc5261f37a8a01feeb52a746d16c0459
SHA1 0d6d70535104b42e60d7f44ae6ccf9de023a7b8b
SHA256 f2d069a3236338883bc10b68280e0a2c966dad414e26843fea7a35149f95f64f
SHA512 77079c62eb1459ecc6e763e863f02f5faf9289b333cb43b2402bbf822837dba4d6af22d97fcdac68e252cba9758a91386483733ccf690c3d4eb5f1d109794f29

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/css/bootstrap.min.css

MD5 abe91756d18b7cd60871a2f47c1e8192
SHA1 7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d
SHA256 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
SHA512 bac54101debafcda5535f0607b5f60c2cda3e896629e771ad76ac07b697e77e4242d4f5f886d363b55fc43a85ea48a6bfc460a66f2b1fc8f56b27ba326e3a604

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/css/cc.css

MD5 d3e8446038c505ae76c852f361d8b562
SHA1 6a23fbd698e72474c6875d88051b800242dbc46f
SHA256 450b3b007ecab3ad5459f46b114b193d3c090eca27d7340aad98ee1aca969c81
SHA512 d62fa41c5fd29d38f2827dd751371e90ba5e5efddfef3f6d1efc77784021abb55999a353bc22554cc2f0354bfb9172639de2738962a85dbea935719e024fce33

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/css/font-awesome.min.css

MD5 269550530cc127b6aa5a35925a7de6ce
SHA1 512c7d79033e3028a9be61b540cf1a6870c896f8
SHA256 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
SHA512 49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/css/fonts.css

MD5 e6929145e4124d3ad81c97b492b6c389
SHA1 bb75fd8b57a6299a1e763092123f7d203e08a50a
SHA256 eba0085017077c5185d33e6d58a43bafb6451377fd75382fc8cf2407ee511ea5
SHA512 da3281e11958b3c7153c77bc1dc4412cb546ebf2964ced9c2ea87a3f3243954bda30d6f922bca6fd127367774fa7f004d4b2fc17897f4a9e43e257623ad4ef63

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/css/tabs.css

MD5 a66f65e9561d14c80544f0818c2ee6a6
SHA1 4c75f03058cb9d6f30d2026cc9b14ab4333d2484
SHA256 9b25ec0e1809299ef4a0c2c1ffeb5aadb673712c283860710c4545e8fb6d14df
SHA512 5749fa2b197eca5a2efbdb7a2ef3537187899973b732486d53ac911ea13afd77103930aae79df409fe50cd5f93dab3025370cdc397a4317c93deda359652e4f2

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/fontawesome-webfont.eot

MD5 674f50d287a8c48dc19ba404d20fe713
SHA1 d980c2ce873dc43af460d4d572d441304499f400
SHA256 7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979
SHA512 c160d3d77e67eff986043461693b2a831e1175f579490d7f0b411005ea81bd4f5850ff534f6721b727c002973f3f9027ea960fac4317d37db1d4cb53ec9d343a

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/fontawesome-webfont.svg

MD5 912ec66d7572ff821749319396470bde
SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/fontawesome-webfont.ttf

MD5 b06871f281fee6b241d60582ae9369b9
SHA1 13b1eab65a983c7a73bc7997c479d66943f7c6cb
SHA256 aa58f33f239a0fb02f5c7a6c45c043d7a9ac9a093335806694ecd6d4edc0d6a8
SHA512 9ffb91e68c975172848b4bba25284678cc2c6eb4fb2d42000aa871c36656c4cebc28bf83c94df9afdfbf2407c01fe6b554c660b9b5c11af27c35acadfe6136ac

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/fontawesome-webfont.woff

MD5 fee66e712a8a08eef5805a46892932ad
SHA1 28b782240b3e76db824e12c02754a9731a167527
SHA256 ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07
SHA512 9c776dea55a01fd854ea23b3463d9ac716077d406ecbe8ed0c9b6120ff7e60357f0521ab3e3bf9d4e17ca2c44a5d63ee58a4e7a37a3d3f26415a98d11c99e04f

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/fontawesome-webfont.woff2

MD5 af7ae505a9eed503f8b8e6982036873e
SHA1 d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
SHA256 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
SHA512 838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/FontAwesome.otf

MD5 0d2717cd5d853e5c765ca032dfd41a4d
SHA1 048707bc52ac4b6563aaa383bfe8660a0ddc908c
SHA256 444dd4366615ffc4a16d012b2fa90137065d3ccb410fa6fd5e4ddd7b5e4ffcd5
SHA512 a3acaaac3a9861ac7a4ba23e52b9115d39b674cb685b45454fb4b80329a4f7370b5ea7dd8b41d630798f8a54082b62411fd63332752296dbf5f2b3b96abb8874

/data/data/com.kokevugopa.backup/app_szZlVFcOHgqqoZw/fonts/open-sans.woff2

MD5 67c2e5e2c5009f6da0ef6b64731731e4
SHA1 5588a9085e554563adf6cc6e7797ff5e550f5703
SHA256 1928af2c2c55522fca08cf7a379948f49fd23927419e463134851996ad4ef5ba
SHA512 7158074f506b2c972bc24860edf410c7a55c87e218251ca2d1a9ead545738b075ec14682742ca7dfcfc1322e710cd0a241840e8775a9f8d41d1d59d6b3fcc3d0

/data/data/com.kokevugopa.backup/app_work/oat/MSrQZQH.json.cur.prof

MD5 5586b05acd60d295801b08d14105971c
SHA1 68103591a134f97cbd9c635cea445a4ad5350561
SHA256 f8e7c96a220b9663778b41619e1196d47b47ef4eea93d1381c305726a8e57e29
SHA512 5fd2d38b5b7108123dc645c0ef9b06e4eebbaa402c9a0077704fbc7de2b18b51f6021c52fdb142222aa979a31be64e1bd4dcbaeaa1f42eb324cdb54fd2a0b4e1

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-x64-arm64-20240624-es

Max time kernel

149s

Max time network

141s

Command Line

com.kokevugopa.backup

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Requests uninstalling the application.

evasion
Description Indicator Process Target
Intent action android.intent.action.DELETE N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.kokevugopa.backup

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 172.217.16.238:443 tcp
US 216.230.233.144:6220 masupoltd.pro tcp

Files

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 89d3aa39d5633f0cfa22b048a9634b87
SHA1 d970800618282248195d94f7c49ba78410aa8832
SHA256 5bd6add73e8898a8ab316357e6cc4a8cb98d05ef314f1576de0f3e227852045f
SHA512 7a7923f258e61c0c619b8731fe6d2bde5237b732cb09c28d8af9aa759f431c12e8207008bbeef72894df9222be044801c7b683ca4d266beab9915adc04767a28

/data/data/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 6cfbb48353b6d9b96774e4f142d66d24
SHA1 dc296970a251a4fc9413c6f03f23e433bbcd6c23
SHA256 69b4eacd73f0fb5b52bd6ed6e8fa6bea4f20f3449c371e87330a504ba954b1f0
SHA512 651e5f569fbbf82fedcf7c7f4fa5ed20c5b133ac6bb710818c6dd0de0185142f8c1b1e914e4961ab55deec600da33a097a57290adcc61f7d1432715d872b1711

/data/user/0/com.kokevugopa.backup/app_work/MSrQZQH.json

MD5 cc1b3bc580852eef88b69702c457cf00
SHA1 6f55e9bd7ff350de3539ad443f12e022f1380e1f
SHA256 50de312cc6850fe9cfc6d4ee6b85281b3441fa833be072cfce2d1d9aa4972784
SHA512 48684c11a5daafecaa274fe443a680a4c8d575c2dc6572e13273cec7aa7d41bce5882e99053cac0f42175258a4000f7edabb1140f589624c3ba8d7e19eacea33

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-journal

MD5 87f647ae3cd170e2063e7e7a0fc50f53
SHA1 672955b52d4786990eb80455781b3bdf678e9339
SHA256 73b8978f0f45ab83dfe4475316b5ff8d726cc0931c1c0d7feda4a979dd89237b
SHA512 f7dbd3d94238ce8f5a46a77599360d506663f22f2cc8e2977cdb9cf8a1a3656c4ee934d0c5af32118ad2426dd15c02b98f25877e7c2c79352e5bffd5b9e0d657

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 bec8cf85ee2e27c10187ffe2a2955df8
SHA1 83694afb793e7e08f7b01bac310e60f5e1a7886c
SHA256 fa4a061f9abde160057c5ef73ac3a938dc00853c3c15ef047f7399f5856d48a1
SHA512 46cc93c633b358f7552664fcc43390d8a400f803b46f21db7222236171034eed2e4f06ec2d88d5360fcf29cb2e9e1f129e79564b9e817c2ee8548fa49c246053

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 b4f29d4e2ea231b8cce2b860b101c337
SHA1 773061b5877e82ceb239c4fed7707aad375f1fe6
SHA256 eec46abd06a7e6d93b5b6f5de2dfbe1b2482a417a3018be5e051eefe6597511a
SHA512 d8b1cdf5ffc7f0a7201e4687a2e66e59c0f8025cf0f19b0363f4cc1d928c6d57509abfb17de816db453501715e3aa24d509438adbc69a4be21f17738a62b393f

/data/data/com.kokevugopa.backup/no_backup/androidx.work.workdb-wal

MD5 503f268be384a0cdb15587dd4bc51bdc
SHA1 48dbda0ce2b801d7cb0d7a495da64a4aa4639360
SHA256 b0458a5bfeb1cbf21e144c7ddd6cc1b464a1d32b6b82f65460cd2f002a13b683
SHA512 9fbc9f348e8691f11b050d4418984a861fb0f96e71d5f31b6f53288eb76c75a98817959810801df3648cc1f273d109abd7b38db2d7433b0b04b04d97f5d069bf

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 7b6f2ad56e47077a0afa331b208da3bb
SHA1 9ced7c791fee3f19a6405a6b31d0ea3e6cce3826
SHA256 8d290c1341eb12a456a8c73462b52a634d0dd59aa9bcc433b57b2c2fe2553bb8
SHA512 9118957aacda3d68a938a2f99181591c84403dd6107a0399f34948f8a812ecde5d13c5224b74ad0f17d233d23fcd237c7dd28aafe71dc690f41cc833d3e6994a

/data/data/com.kokevugopa.backup/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 419deac2ade4e2ae55920c3e5e7e3917
SHA1 98e4e3a497293cbbad952317dae4e35784caa333
SHA256 4964335ec31f24d10d448ff6d5a863c9fa66820198d414199d6a88106770dcec
SHA512 d05cf950941e631b19dc32ec14e6d3bf3515a2706dc2fd17df8aa4ef0b46dbf60f0a3c97fbf26bcf08c7c179c56822851769f59b6fbac0c2754c7e38edd00814

/data/misc/profiles/cur/0/com.kokevugopa.backup/primary.prof

MD5 72d08e075878b78477dc7c0a4c528b55
SHA1 448e438195abc64d65792affecf7bb17ab512666
SHA256 e40332c0cef05184700833be70dcedb3d53cc4bb16a898a7e3e4def274206d76
SHA512 f378c6cab2566ab49afc26a9670b579f19396bcebe2643d71eae7ea76ef09f34affd2155777a416203385b586c9429b7e34b3643e88d8914067fd202454ecc77

/data/data/com.kokevugopa.backup/app_work/oat/MSrQZQH.json.cur.prof

MD5 dda7558c3c5a61842e7e31c3701138d9
SHA1 30207012dc61fbff7d967b346da05b0be1723be3
SHA256 96deeac31f5b0effdcd6515c0a03337322408a70250de8959f5e413bb1238ea0
SHA512 cc16d5e79a9eb8eb29ed9c9b1383d96a23a733d4673e624acb1084c35ee620d6b8b74b281ff26d2cf67d7b88f5c1fe505c7ddca75471061d745f6711dcb0b8dd

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-27 10:41

Reported

2024-11-27 10:44

Platform

android-x64-20240624-es

Max time kernel

149s

Max time network

155s

Command Line

com.redewabobo.ASCII

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks the application is allowed to request package installs through the package installer

evasion
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.redewabobo.ASCII

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 smartworkcrm.com udp
US 172.67.176.210:443 smartworkcrm.com tcp
US 1.1.1.1:53 fonts.bunny.net udp
GB 79.127.237.132:443 fonts.bunny.net tcp
US 1.1.1.1:53 masupoltd.pro udp
US 216.230.233.144:6220 masupoltd.pro tcp
US 216.230.233.144:6220 masupoltd.pro tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
GB 172.217.16.238:443 tcp
GB 142.250.200.34:443 tcp
US 216.230.233.144:6220 masupoltd.pro tcp

Files

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 6d4147d5dc237d47e6047e7c9e143a1f
SHA1 88a3ca6e99ed83b181ac91925ce79a2bf64e29d3
SHA256 a6127a9f0f4f6b4b8e926a67ed03fa06223a5244c1429e71ff4b600d761f89aa
SHA512 f2c4ef369841d60d92e3030c64c495712bd0300d1a82f4d86af44e4f888b216fbea5ac6d082d61413798094ed4fed6ad3e802f2d06b388d7e3fe1753c7d0b469

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 d29ff5767cac5e17ea2ad5110aa71597
SHA1 62ad19dbe39d41afae9f78e423eb182da8a89c85
SHA256 70a1ede06d781289b40d4980a35041d9e58504e5a4d55209360469ba70491cf3
SHA512 f8dd1eb911e8f591131d162d38dc2a29b24f87f0e052de2005abfb43a2560c0641ee48c2b587739a4a469322847ecf6c7ec8e2a88aa3af8ec654868443e1b1f1

/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

MD5 c32af470fb777428515b5c01369fd81f
SHA1 72e65e062280b2a13b4792630119392bfd451860
SHA256 8c110fecd6d2f3d6b22ec6885d03199e64bba8e79d6d0acc8ad16f6cfb4a05a5
SHA512 bb40e7eac8d0861a060a37632ce6d679503972309cf510267ede98e7d9e0b14b252bd222300db3ed1e696e69d6f47c852129f8d52eff29fb34319cefc1dbb500

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-journal

MD5 f564437a2469247ac17f396807e97295
SHA1 cb0f2291d77e9cce87123cf7b6ff0ac703ab8c3f
SHA256 e2b809ac8e9363cd23be9c149d147fe5a94f5ea294063cd17b8bb652c15f9b67
SHA512 da54ba813785bcacda53555203ba440ab21f4f99278cb281364b168ea96e3a7e35f6c54cb3d627ff7ac3c3227ddd6ccd360a45c75591538cd2a944b8bc44acbb

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb

MD5 44316924e4e74d4c8d21e7e1af1e6f49
SHA1 cd0ce22aef5fae86b7b26017d5fd26da0eac6e9e
SHA256 9fe158f035c24a62642bc3f61802f9284a400f7f02a46500a5ba2df67c747412
SHA512 bc4ca101cfbfccb65adf7f8451f28049f1a2f0d5423191ac9d6753045c9c6eef5eb35bbff7a94da78b9f6412577fa24f868e1c4d10f94b06d92a09763593c88e

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 55bc00548bd57059993543bc1b9a6bd5
SHA1 7a1beabc2aa0505ddcfde84eba0b505bf83c59d2
SHA256 2d4ba302bc4841331115987df5fc25c55e9adc06c0e4bd9c8061e5ccc5fac40e
SHA512 a404923715413423a6faf9adf1a77fc05cc8ac78997fd00d8e3312a11f6ec048f76e9659b88d8c7130d9496f9aca79b843e2c1cc248a7c540c8569631b64f182

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 8176db2ced8fa404380595a7b0a07ab3
SHA1 61a5522636b7d829d0ae2d7eb10bf7fd482d3697
SHA256 4636e4f7c5672cd025a87e9fceaaed59320c0fd098874f831f289c8315a60658
SHA512 522eef467d85f2ada051df7c69bbb61a3c764f4ac348062587cc719665dd43f79eb441e65d2b609a6166c6001fee3e458dcef54e319e11912dc5e4c331ec3919

/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

MD5 4fe1ea8a9d733122952827d01db959b4
SHA1 b6322f316c5ac52bed516c99f530905b7750e146
SHA256 46120d91e8880e031b255083ef8c4fabd4cb94a64715a256ecfa5de79e3b8c5a
SHA512 e7f6f72b826c2a83d25f4446e284054f3a23133f9c056cc2492fdcb8ec96b3b84b0a6f0688af119a961ff3dd77997214edd4e9691299b7f5bca69d3b8911d526

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 f9fb0ef0764e987c965397688b5e58ad
SHA1 5b2c1dad6b5f1a301948924fcdf8b574dae57a4c
SHA256 531ba96667421fe63883c0f7cba6ccb49ff301192bc9467224f7be0fcee74181
SHA512 2a6e6637e2cbd978314f773a91613779bfdccd3b7bfd270f6eadd3b698969ac6cd8ea553d8eb7d3df4cbe905fdf61f5f745602173023cdf9795b10edb32e31e0

/data/data/com.redewabobo.ASCII/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 b73e28883737c6276a3e37b2cc614c93
SHA1 572603272776793d57a46631eef649cfa9b7f93e
SHA256 5d4ddf13f53f1237eab25ba97866de38c472de4726f90ff3a0c7938032f0d5f0
SHA512 5a8e5d2a48de6164d55bf0311ee14ebf52ff7339c84e658df833f40aee0e6e6b70629bfa9ef4205cf68297bc82ec9e604b4aab36ca0f363dcc79010248da2401

/data/data/com.redewabobo.ASCII/files/profileInstalled

MD5 fc252b2cc126dd980b0777a80ec40a14
SHA1 f34b62113697d95c0d4b44adf2237eb4c4acf4ed
SHA256 eb37f4292c80e4087111234314ac1b96ad324429d0456928f504dac61b8938f7
SHA512 76aa0fa5424cb5654a1d14fe3a85a543f6824656d72a07ac351aa7615e857ce16beb4ae45452a44fc422968472ef0445635b3b61e437c5942b81b29287db01c7

/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

MD5 288124e55f183a7d8d93d81e350dbb15
SHA1 711653db9a47b45194991d3bc7489e4b8f06b5cb
SHA256 0245a9e5673e7b55c89d20083d1866d17728fd328f5998f3670042a0289a0063
SHA512 bca79a5b5c62fbd41a50cfd80fd70577586a55b728f6893bd4b17385a8f737985d15f8e56b231260a74860b4a43d578e54a41a19ac39738389a0ea20338eaeaf

/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

MD5 2205d720cd5300dfb894ac027da38a42
SHA1 ae6ccccf831dd7b77ba73ede391a4cade20c4704
SHA256 b3ccc1dc5092e6d68335a8e1365e5fa905832b2b16ab8ee63b0993d0b4e722a3
SHA512 8f3471b69447ac3f8e3642994ab91f5671c31c23fc54a1a91e82645e0b7b574352e46bb068f2feedfbee1207d5ae269156c0c8a79530a922075b845f913b3bc7

/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

MD5 cbfc3da2e715248f42300761b43cd258
SHA1 66e710d774afc0f470c87287892e1dff4c8ed8e7
SHA256 c09ab4d51d7982dc865aff43c638d047be7ef989d9b8816ba469b4b9edf2e130
SHA512 605ae96b0c9d604674232918fb6eb09ce88bf9adabceb118a0dc920f9461c6ae99e007290c202f4c5dbed074a34cfd21c8e70eb2ec5662030758a90048a06f71