Analysis

  • user interaction
    yes
  • max time kernel
    897s
  • max time network
    799s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    20/10/2026, 15:16

General

  • Target
    e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
  • Size 28.3MB
  • Sample261020-snretsbt4x
  • SHA256 82bf3b9ce7dcc73e74ce638240a42a2f1a395570161194340bd86cc79179cdab
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 17 IoCs
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.hunter.net
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4875
  • com.hunter.net:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4983

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 dfc9eef0c3076ae659c4a99512d85b39096cd3a327bef5926a6ca48e0220aeb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 e8eca6dc0a947dd0902b4079c49c1b6f737f01e9243c1ef5ebce514191b303e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 379d6edcae80c2b6071dd4ab359a2c1d48636a1524c7e818c1590d8939e3499c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 12df705d3a230bb4512da2312f285d4bcee0032bd753b6cdb6d2aec4a34229a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 11bda9a6c1728fd0bf917fb8cfd84c5bf4c9cbb725b96725aabdc2a6acd9bcf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 beb34151c0074b71a68413f4e26b217c0128a225a0463517e2530515a9da6d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 86cce0bdb5ca2e7c4728dee1835a92fb9934801cb9847e19807ecee9b7b37b70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8cd092bbc6605a66fcefd28cd473acdfd918d949df11c9a1a9f0199498337de1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db-journal
        • Size 12KB
        • SHA256 1c9a9eb95cd6a9a63100137c4f5e3ced9a3a54c32711f207e23ac4edac48c828
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 24b978baa67d4b054efcba267d168367eea4329d1da2222b86095570072abde1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 f68144ec77406bf3fe9c30d2779aab42ba12e7e21d21657f3519110824f3849b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 bdffd3a0b3fe5b764fafc40fa0cab524416482ee756fbfdfad1240bd1dee8a80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 5997527cd42dc728382b61d84af40daac0fb192099d52cbc434c06cd32290612
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.hunter.net/databases/google_app_measurement_local.db-journal
        • Size 36KB
        • SHA256 b51226dcfe385a43821a4e133c3e7b97c78e440d44791b96e318ce168cff6df7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation491727162896785172tmp

        • Path /data/data/com.hunter.net/files/PersistedInstallation491727162896785172tmp
        • Size 20KB
        • SHA256 ea9efc1b007b5a6d709c57fed4b05de0ca5fe3122b63085f72a55d477e64767d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation6513119864567644743tmp

        • Path /data/data/com.hunter.net/files/PersistedInstallation6513119864567644743tmp
        • Size 567B
        • SHA256 a840d8f209780917fed130182c2f41069a8d6f167ee81b56b8e21e529d6ec688
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb
        • Size 12KB
        • SHA256 71f92b05bdc4b8b3f3a4ac27f1179ac6405a0e95518a1b36083bd150deee10a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 79059505c378dac1d2f16439962581a738202b61970b135ac4f7c5aea7ae3f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-shm

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 ed4a154cd0874edaf3259079bc3cd939a7726fa38f588ff2ce80f24334e80355
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-wal
        • Size 20KB
        • SHA256 2a94cfabb56634fb1f6b70039d0698e87010dcae9aefd67fe027a39b7688cac0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 5a430f64371e39f38d6424f79381c37b1ab1197dc577fe5417a7ab98455ba478
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appmetrica_vital.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital.dat
        • Size 178B
        • SHA256 fba84159ddf4fee142c41e446d7687e856998494b2ba36e9613d5e326eb6d7f0
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital.dat
        • Size 110B
        • SHA256 403fe1ca2ec44b1625a9488d0014ad149a91c2cb77a14d6840b04e258165c940
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
        • Size 71B
        • SHA256 b880b3735f98c3912746b94e8a66757a97357e393cfac8ce0f4a6efea28ef431
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 20KB
        • SHA256 6be7b7592e6db2764ad1047eee2900874e05e96596fc834759d59f03e017d4e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 16KB
        • SHA256 28373538ce907f5e9ebacadc84f6d1c76f94211088183dce2253b0d7fd1dba39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 203B
        • SHA256 16cb02abfa14d6df8ed308c257f917dd78da492cf750b85f472bb7421f6a15df
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 249B
        • SHA256 97b75e4af55c7ffb5255fc06b88c0d0c253926a6e4e2b97a83a64401757e9799
        • MD5 SHA1 SHA512 TLSH

        db_metrica_com.hunter.net_478cb909-6ad1-4e12-84cc-b3629a789f93-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_478cb909-6ad1-4e12-84cc-b3629a789f93-journal
        • Size 20KB
        • SHA256 225bbec444e64ea60b2d16ccfac49e26558a7bf6f3b5c1461603d94af8df5fda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_478cb909-6ad1-4e12-84cc-b3629a789f93-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_478cb909-6ad1-4e12-84cc-b3629a789f93-journal
        • Size 58KB
        • SHA256 e860577b3c531d114d370a224df4f9763eaac550ea9ea6576b1e2470a16ef022
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_478cb909-6ad1-4e12-84cc-b3629a789f93-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_478cb909-6ad1-4e12-84cc-b3629a789f93-journal
        • Size 16KB
        • SHA256 cb78a1d94f21c5b53aa7a20f2d478e1ab6cee63d01526127e33d2bf230fe1e09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 77695f00d99f403255d9ad785cb2211f899079dcefec00ce88b12dc1303d69b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 ae793994abd28718aea21e883101ae7cdfa336032a64fb5bf6016a21f8b58361
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 385c720d47b911771ee9694f36acc4c645949bdba46222dac3a12de00f3ba449
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 62ce03879247048fb0cf7a0c47c1ffa4215ef7f3fba6f94a43284e79bc903d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 8KB
        • SHA256 6e306aaa44bb2d3b46b40b19f2b9eb1bcb5a43e93fd619a5879ad0de1ac2d60f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 3b695de4e5bc6c4276e1e5f18898c9b97b60cb8145ed88a70848fb3ed2c5a29e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 162fa04cf22ebd0c0ce912aaa4e1c0b2ec462059c00a3fb0b2931c61e838c8dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 d1ca625b8c9004a6bea710c06932cfb978345c457027ec7425b54c9d93312e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 491bf06f3471412d9adc3d348de63328ebdf40c093835573a660de621cfc7013
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 db9deb3b21afc04171cd0876a5f834449b4ea0a05028686e9fda0f46a87fc353
        • MD5 SHA1 SHA512

        metrica_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_data.db
        • Size 44KB
        • SHA256 b76b165878ea6a9fa37defc33391e0a130465935eafbcbef11f82d96ff1053e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_data.db-journal
        • Size 12KB
        • SHA256 2324eac91ffa08a0357307143941f1859788a11498371b1e1032a218160aa136
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uuid.dat

        • Path /data/data/com.hunter.net/no_backup/uuid.dat
        • Size 36KB
        • SHA256 39a6478b078e151f56a455c72d07875675bbff1aab22f70fd272bf74fb7dc431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/data/com.hunter.net/oat/x86_64/[email protected]
        • Size 12KB
        • SHA256 cef838427427592cce64c57cdd4aad421835a3dad05a9fe9902289a872d801fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path /data/user/0/com.hunter.net/[email protected]
        • Size 3.2MB
        • SHA256 7aae06433cff5967ac254484d784c2c348380891d0914c56de64e7e006668cd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH