I have provide a comment with a link that can help with this. Regarding hashcat though you may find success by grabbing the https://weakpass.com/wordlist . Though sadly it is quite large if you dont do cracking very often.
Ive been told by a number of users that they have had issues with the md5 portion of this challenge. As cracking it was not the focus point I have provided a link below to a website that will successfully decrypt it.
Java (the language android apps are built in) has the near unique property of being reversible to almost the exact code it was built from. As such a good place to begin on challenges like this one are to decompile the app into a human readable form. I prefer Jadx-gui on a Kali linux install but there are also some online decompilers like this one http://www.javadecompilers.com/apk