82bf3b9ce7dcc73e74ce638240a42a2f1a395570161194340bd86cc79179cdab

Analysis

max time kernel
4s
max time network
885s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
20/10/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e802fc6d-a94b-4ce7-8dac-cc3c689e7e3a.apk
Size 28.3MB
Sample261020-snretsbt4x
SHA256 82bf3b9ce7dcc73e74ce638240a42a2f1a395570161194340bd86cc79179cdab
MD5 b8078650b7870d035e85109d70cc5afc
SHA1 2ee25a6c2ebe0651849ea2acb0e6bae4a6e557e2
SHA512 63e5055652b90bef7c6f4a2f277b8fa6a13c33decccf03deb4dfb2a91fcd44a11659ed12e03d7b9708e7ae2e872a34956042f2199d93e294ba6df18548561b25
SSDEEP 786432:EPSvhHQ4gZttU6ESjaykB8S+4OMzmMv2eK6mGazqhhKxEyU:EPS4tu6ES+yO8S+fMzmMvHkqhp
TLSH
T13A5723A7F36DA91FC8739032CA6A2273949D4F118A42E7572504B35D68F3AD08F69FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 9 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.hunter.net
/system/xbin/su	com.hunter.net
/data/local/xbin/su	com.hunter.net
/data/local/bin/su	com.hunter.net
/system/sd/xbin/su	com.hunter.net
/system/bin/su	com.hunter.net
/system/bin/failsafe/su	com.hunter.net
/data/local/su	com.hunter.net
/system/app/Superuser.apk	com.hunter.net

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hunter.net

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hunter.net

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hunter.net

com.hunter.net
1⤵
- Checks if the Android device is rooted.
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4326

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 ed0fd11c1c7096805af9b11258323b286584b955f2de56a98a088ed8d21572bf
MD5 b82008b149227acb36d031fa79d6ba58
SHA1 fcbef9dc6a97e99fa2a7af1c79f84e7e3ec74861
SHA512 8d4f6190b8da5ddb75b6ced4970a58dd6b04d1851c6492809d5b208e5d95c94fdfdeb74f2920a48f98bc277d7dcae19ebfc0b4e9025089d497bb84d952abcf35
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.hunter.net/databases/com.google.android.datatransport.events-wal
Size 68KB
SHA256 92cf04083b1110b27c267e8cba441f899a078a178c41bf5c30dfc195a593e045
MD5 7a44b73e354dda42b02a0ea9d7ebe60e
SHA1 1e490bb0a4b8a4911b3b2978c81734b59aeb30fb
SHA512 6988e0a839b3dda9ca868f8705492ff1bb5496c4b3ce700b0849e13d127f068924c77657f28ba6e612e8cd42a71576ebbba22e8b02ca97fc71e6aecd213abd7d
SSDEEP 48:mzNSP/E1g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSP/sBziTEcf:e0PNMEX0wIyNjaPkB1cf
TLSH
T12663315DAB381221D9AD383FD7E143532A7CA3CF571383623E906CFD8DC256AB025955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation7382358822051758221tmp

Path /data/data/com.hunter.net/files/PersistedInstallation7382358822051758221tmp
Size 90B
SHA256 19792c000e867a540be1009ced1cfbb22de2f6704699e2c68c9292a63bcbbb71
MD5 64ba272ba8b967aa7ee7f90fe697aeeb
SHA1 db8b8ef6f58ef1689ad5741759c70be01bb40aa3
SHA512 3d45ebf70dcc0fd3d5dd95c82dafd42f5f9a843ce01fbf5ad2857724a3e84ddffb1f03d87cd86dc36a77246a788fdc5ffecabcb3b09ea172c5166c14ecfa9647
TLSH
T155B012004AF183E184CDB3025CCD92402D501440440DCB580B0C904022821F1A1179F9
MD5 SHA1 SHA512 TLSH

Submit Download

audience_network.dex

Path /data/data/com.hunter.net/files/audience_network.dex
Size 597KB
SHA256 49d8ebe54f2b12a0de679cbbb5999e3efd22cb6ebdd18847481e8397735bfa9b
MD5 70914c2bbfb043169a018a2f1f1b2392
SHA1 ddf16ad035b425badc1a1c2b26d66185b5ceedf3
SHA512 fb030311273ef26a5f9babf007f16614d6b7203e3e4e9f64105075af9ca28aceba462f29cd44831b53fc287baaf9834a75e59a2e9412ff49a0037d316e14cf5a
SSDEEP 6144:2Xn1vwEyZbErzOt4Xz9izOeNZGyg5YYcZ0HOkjPSJnVTZ0FhlthMdBRRBbfyJ1pA:2314EmbErzCCRiDQyagTVEAc/n3rWEB2
TLSH
T1ACD4F6BDBD865B7AC44D89FE0DB7807AA77650ABFE424812312D6361BD2327017CB25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 0783fd0af1a948c2e0e4dc63afa999b763babaefda8a5431f358b7edd30f0380
MD5 e80f18c631bc08bcc1229cdda29b7e9b
SHA1 c39aea2d77319ddba7b2b980aa35700bd95d9d43
SHA512 bbf33e9d2828b2649db61f9502768134a33a75742ca36f76259ebf83dc06937f6a07ee86b7d440f3556ddcbf878d9221840bd7f0af138368ad1cae97560e2046
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 94cb3a266b6e10240beec1701ca350acb076541fefc26527def4cc24a92053ba
MD5 b6d8ba006ffc6cab656d0edf2cf7865c
SHA1 98e2c2410cbe1da6c759a11d1a72b7792b9c260c
SHA512 ec97d465ba2f159a9f5990444ff68c63f300dd14db43171b98e3e9713614174b1e51c89c02ae5214b89596126b7985e4e4612632ca379f0171a9aefe4df25486
SSDEEP 6:Kcd+/Xyg9FZdrlOERX4PBX4ogLugMBX4suuK+/Ioj3cSt+Ow2:KcUiqzdTRmBEyPbP/IoNt+Ow2
TLSH
T17F72C2D8F3810912C51B92B254D9CF49AF50AA086352CB8756A805D4BC0278C6590DFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.hunter.net/no_backup/androidx.work.workdb-wal
Size 56KB
SHA256 c9406d5c31c5688935383d996fb668dca2f9a97a115b80582cac6b1d831815b9
MD5 c8fbb978011c180cdf318cd1dcf44b68
SHA1 018e51c00f8ebd3d70e2de695f77acee0ce36289
SHA512 2f09f7834f7ebfb1dabf102fad3a3a1363e54dacba9007c1ebcea755e7f923f924490532a04579a750677b14003d6ba910a1df82683b31a84143812ee325a31e
SSDEEP 48:y9Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmchI9e:Y6+hdjnHtDRMpf8UzS6+BD8q0ExP
TLSH
T1F543F28E0F192540C49AA8F0A1D00FE1BE7E452ED793E3E6699140B5AED6920DE19CF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metrica_client_data.db

Path /data/data/com.hunter.net/no_backup/metrica_client_data.db
Size 20KB
SHA256 682b581784ef1991450516d9a9f744a1535a8dff323a3d96f8a18eb34cf9860f
MD5 d59f7192267e2ee7ea06a84784401189
SHA1 539848b83ddbdfc7e4ee36e781376be8ce3cbd34
SHA512 d765e0ccd18c0917d5410040af5f03cfa28b9b45db9db156cfb2b66dc3f60fd8bb26d93a89718a0f8c5499476c690d21ae478adbbc7cd957a77b9a89f5f08dab
SSDEEP 6:l9FwyNbwCACScuGsGFLuuQ7GjBU38wsGTV+GNERX4PBX4ogLugMBX4suuKfpqiOw:T5wfcGtSBw8w2RmBEyPbAVOw
TLSH
T14A9268E2DB010292C32853B1ACC6831A5CF2573F42F9C34345D0041C6D82F94AC62DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metrica_client_data.db-journal

Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-journal
Size 512B
SHA256 fa3eee5ff8a76757465062123daf48b4e81b2a760e652bba35e4e9aabec72e6e
MD5 dcbfc5879d77dbf5c0c0c191061ebc2a
SHA1 d66a35a2b54bd7152c80964290a15fe8cb0c49fc
SHA512 961c2b32f98e705934f2fb4073982cc12bd74042bac8a0eedf39f9e4ac8a2598968977ddfa54b8883655cf64bddffbf94e0a029d7a6681b16ce4b37a7b33b20a
MD5 SHA1 SHA512

Submit Download

metrica_client_data.db-wal

Path /data/data/com.hunter.net/no_backup/metrica_client_data.db-wal
Size 32KB
SHA256 a60fe1ed1b579e07aa21fb36dd38f882918f1e21eb4b657902a44dbbf68d5b68
MD5 90fc63f9f2f137ca042cb0d239af1f3f
SHA1 b5ea746317414eb45ed6125733111498164fcf11
SHA512 89ed07a48b1dc067279b5c38a5f4bdbc8ce04b4d6529868743187a4b20c58f41d3dc2be42092dd23a0f153d6147b77cc2a5cc78c4bf97237b5dfdd93ae24034d
SSDEEP 12:K8V/M1vqzdTRmBEyPbP/jYMxOwClE5wfcGtSBw8w2RmBEyPbP/zSy7b:KsU1yzyGSP/tfufcQlNGSP/zp
TLSH
T14CE268E1A3010392C21B92F2EAE543261DA1772F4AFAC78715D014197C03FC8A85AD4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevHunterLogError.txt

Path /storage/emulated/0/Android/data/com.hunter.net/files/erros/RevHunterLogError.txt
Size 1KB
SHA256 bbdaf160da0edfea6602a475c253e6935e5dcdf5b524a2f3d544828c214e5d83
MD5 87ef61a2ae74c8cb9082e6d9af039c1d
SHA1 657905c1b3c57c1c60665587352dd2103128b8ca
SHA512 a0d974c679b43dc82978b8fd8a3ba0354762baf6d637eaf76f4fe0d4938802238ffbbb6e8fcd43659650fd1b5a396c3ba9a10e68a92c5b004ad3eae1704681a1
TLSH
T1B3218E462D5D2D56026FD61B3198A062CBD781E7223800F0BF0847D72F5B60C109EBDD
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads