Analysis

  • max time kernel
    896s
  • max time network
    855s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    20/10/2026, 15:16

General

  • Target
    e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
  • Size 28.3MB
  • Sample261020-snretsbt4x
  • SHA256 82bf3b9ce7dcc73e74ce638240a42a2f1a395570161194340bd86cc79179cdab
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Acquires the wake lock 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.hunter.net
    1⤵
    • Checks if the Android device is rooted.
    • Checks Android system properties for emulator presence.
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:3264
  • com.hunter.net:Metrica
    1⤵
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:3350

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        base.3264.tmp

        • Path /data/data/com.hunter.net/cache/oat_primary/x86_64/base.3264.tmp
        • Size 883KB
        • SHA256 3ef7c01068de6cae5369ae7a07ddf12717772307a68a3ec1a1529eac71fd344a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base.3350.tmp

        • Path /data/data/com.hunter.net/cache/oat_primary/x86_64/base.3350.tmp
        • Size 342KB
        • SHA256 5c22075c3677875486048429af69380592bf4393ceb58e148a4d7678e435510b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 a07dd74c235c6f831920e4d2d430e947ee927fe380276c6d9ce3e9d710f83313
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 09c619e82aceecf5816297f3a376da874811653d9a41b5ac3fc62b9f4521d009
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 5e392074ef0ef918c68e0f2f527545a4c1e8144857cc24be26da0557bbde8f34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 4b0afce6da74164824413162fdbe8d17a45c465274e551385dbf5b3d5a7f35eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation2781593919551570579tmp

        • Path /data/data/com.hunter.net/files/PersistedInstallation2781593919551570579tmp
        • Size 12KB
        • SHA256 959e9cf72e8c6b36b20c07dcb38c686157f9459214c099171a968ebdcea02153
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PersistedInstallation3889007768678186871tmp

        • Path /data/data/com.hunter.net/files/PersistedInstallation3889007768678186871tmp
        • Size 111B
        • SHA256 c8d6bdcbe2f11a1532f7ac55e3c1bd3e99d9d4b2dd1fea9b4992b823fcefc0d8
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 42e50a8205f638f66d09428e7dc2bad06736592dd7044400981d8493e5b313c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-shm

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 813547dee92eb88366bfdeeb07f40d7d0d93e8e00301d3b8c9e01a0f8ffb0fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 1af8931a8d9e377eb1a9971ee70769ce98402d81d46747b52ec8fa1ce2ca6fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 b0964a7d8311edf49d10eeea033ecc848a85487bbe0c24a9f394001e7ed39ca3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
        • Size 71B
        • SHA256 b880b3735f98c3912746b94e8a66757a97357e393cfac8ce0f4a6efea28ef431
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
        • Size 194B
        • SHA256 55ad396d1ce1636f662815b290992a42bf9f4e373fe318fffefe1ec0da20e123
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
        • Size 203B
        • SHA256 52d77a0fa907b1d325ac2b8870f5be53661631d3044993558ff451cac2850de8
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
        • Size 203B
        • SHA256 16cb02abfa14d6df8ed308c257f917dd78da492cf750b85f472bb7421f6a15df
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_20799a27-fa80-4b36-b2db-0f8141f24180.dat
        • Size 286B
        • SHA256 87c4a7ebdb14e526c3c043c9adb5afd7552e12d39df224d437db06348cbff721
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 192B
        • SHA256 0db88089e3f969a41eb656ff377055f7807019ccd9904a974915a36fdf437d1b
        • MD5 SHA1 SHA512 TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 20KB
        • SHA256 3cada35edcc8bc75a5fa00d8c272ccb89ec22d96a5791a516ed8e2cecd37e137
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat

        • Path /data/data/com.hunter.net/no_backup/appmetrica_vital_478cb909-6ad1-4e12-84cc-b3629a789f93.dat
        • Size 58KB
        • SHA256 50cfef3ec60b4160fb68e864672d371fd035885efe4fd86a18c7234d42ac9379
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180
        • Size 36KB
        • SHA256 2265243c894441ffe6293657cc217e6231b06390c859d85a3f7ed0590c54008b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 512B
        • SHA256 26b04c27687e94ba1315b1b09b2172a6816c3d14d04a84ec6cb815d918a7b5e0
        • MD5 SHA1 SHA512

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 a5602adf102d071924a5dc568a5c023196679652637a79cc647ff27d20ddc438
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 394faafc200eecc58b06e773c661dcb2f43d6753e2bb68532006961c8f74d8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 7cbb559a126a4370dc550897f98bd7387a0f8f04846b32a0a7dfe516028974d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 76e668462775a0d393470496b1d8c54f0662a706677f0c0aeae38ea4c426a423
        • MD5 SHA1 SHA512 SSDEEP TLSH

        db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.hunter.net/no_backup/db_metrica_com.hunter.net_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 e7a4fe0a4f4a65799b34bfb1488c19173ae130e52d9c720c91a1424d56c41cbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 62ce03879247048fb0cf7a0c47c1ffa4215ef7f3fba6f94a43284e79bc903d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 3bc80401fab24946691f34420726493d39aa0219aa1a37967e2f890ea6e5420e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 2627844edc9e926d2c4f13559e3c0a6acfb207a4b78d51f0e9cad4ca2b21f1d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 ca16125304b3569beaa25dd3c33622f10f37cc33751d379c34e41f8cda37805a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 40a1f7f3a656842e1b6a48855c49a6b69f5c125bfdd0463d51af802ffe4ba1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 b324541d6fe0c26585a610ed48b94e59c679130b53e8725f2b30570a7d44c042
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 fa9ebfd9347b651de1fd21dad250ab3afd922fd11e50980c931272ec29f8fda3
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 8KB
        • SHA256 83ca4c3a2fefe90136a54be3b0bdd1583428bacaab3819eec6e7c4ee02c2fa4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 7704b1c64409b85fd3dfac0012643307f228f5c7f7f992166830d2e1fbf65fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 36KB
        • SHA256 461c1d4fe4aed9ae42c2cdc30b13b1dc8d3d97038d98a1756336fbe14cc794ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 b757d24921763a0d8af1143504b69c8401a9021a01a1eff5f1bbb222cb37beca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_client_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 721a5ad110b651fb4cc48f99e59250afadb97a3c0ba602dfddba00298b543c92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_data.db

        • Path /data/data/com.hunter.net/no_backup/metrica_data.db
        • Size 44KB
        • SHA256 f7c0e58017d162cef1e02f652796b981cf95174fc14ea15a46e2f120a7de2f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_data.db-journal
        • Size 12KB
        • SHA256 e36071ae33bb01fa7e1dcad689b7d674a813a415d4d966ef5a590c1dee96b607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_data.db-journal
        • Size 8KB
        • SHA256 a448ffa079a626c67519cd14c554a7cf1005e7b658a767a8d89f79de465a5a17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        metrica_data.db-journal

        • Path /data/data/com.hunter.net/no_backup/metrica_data.db-journal
        • Size 12KB
        • SHA256 1f8a97f34b8894a0fe6a3a363031d60b62c62ad5813b3968691afa204437ecd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uuid.dat

        • Path /data/data/com.hunter.net/no_backup/uuid.dat
        • Size 197B
        • SHA256 448aa7cfb185f1e3f3390dccbf974da6a28e5fb3ef9677ab9c351bea997c9a67
        • MD5 SHA1 SHA512 TLSH
        • Path /data/data/com.hunter.net/oat/x86_64/[email protected]
        • Size 59KB
        • SHA256 bc8615f38f2380beeb64bb192c20b80a6949bbaa32bfec826c259397555b2ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH