Analysis
-
max time kernel
128s -
max time network
138s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
22-05-2024 12:24
Static task
static1
Behavioral task
behavioral1
Sample
Ewano.apk
Resource
android-x86-arm-20240514-en
General
-
Target
Ewano.apk
-
Size
6.9MB
-
MD5
386620284bdcd6a8eb6086e35eeece70
-
SHA1
32e6cb44be35ad44537559925d39677e4c232125
-
SHA256
2fef1a446aca4cf2916a2e4a504b273939192d47e271e05f0b47ecb86ba9f1f3
-
SHA512
6d20f741548d10e3cedccdde05bad56aedf9648bf635e30fb30d88e6f33ddce9a8ac0b04bae1b262edb3dc5741ec79da51ed8bdead4efa798cfe6b69d9473239
-
SSDEEP
98304:AWiQTgAfDvDRg/4NErvCdJ/7Cv4zXQGMEUP0r8hEjqa7BzrPiXrU9+7EfriQkmD:3iQTRfbDQyWvgMxWT7BybUxZD
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 9 IoCs
Processes:
com.ebcom.ewanoioc process /system/app/Superuser.apk com.ebcom.ewano /data/local/su com.ebcom.ewano /data/local/bin/su com.ebcom.ewano /sbin/su com.ebcom.ewano /system/bin/failsafe/su com.ebcom.ewano /system/xbin/su com.ebcom.ewano /data/local/xbin/su com.ebcom.ewano /system/bin/su com.ebcom.ewano /system/sd/xbin/su com.ebcom.ewano -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.ebcom.ewanodescription ioc process File opened for read /proc/meminfo com.ebcom.ewano -
Acquires the wake lock 1 IoCs
Processes:
com.ebcom.ewanodescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.ebcom.ewano -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.ebcom.ewanodescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ebcom.ewano -
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.ebcom.ewanodescription ioc process Framework API call javax.crypto.Cipher.doFinal com.ebcom.ewano
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.eventsFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journalFilesize
512B
MD5081a4ab0df75a86b39310f7dc34cf833
SHA1eff964eb9960bc9e919f8bf4f00211c4ba30d3d4
SHA2567be8a0b729c31f81265d322a9652fca2524e6d631f3d7b1f6bef1cfc0045f4c8
SHA51287f3a1c7ab0ba4cb265987ea8d7f3a1f6d74c1990b7fdc775e808c1dfb3493a8ed6da147893c8e8a08d015b739db317428ca173f6432ed3981a49a193014591b
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-walFilesize
52KB
MD506f3c2b5fcb04d57260ed57bb47b211a
SHA13d7b36922ecfd221a023eb5790a7be13aef8bd77
SHA256eeb2ad88217f241e98d9c60f44cfb494e2a2e5ea2f86e1bdae42d6c7e7733fcd
SHA51265191597dcc9643b5bcb9381cdacbf0c4ae39e93c65251df2240b014b8d6e2d05680769857e46dadba75940b0d8f21b042b2d6620dd6e498c3d84bf278e01797
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD54035ead3539e4d9f4b0c4db7e08aa7d8
SHA1c677af560ff9a74f0c9f5a9733e37a836cee75c8
SHA256c4923357b17e005b3688a89886cfa0c68ed11f49f347d1444b9eb3c22d431942
SHA5122bf997d06c8ca5caacd9a25c54d9f2d095c29b3bec099184547b2c6ce2fb64b679d757ec0fde3f27fd1285f21ca83ca58c0bbfb659fb654f43eafb68b449f001
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD578ae182254c5a82216780c78bbb8a2e6
SHA11e82c4ca06c1ed995d7762b478a706a0aa3b27c3
SHA2568e0071c67b33811e56190472911a5982a9312e8cf99020bab10a9dc0767d3b3a
SHA5121a34cd55349e5c4f8104238b8ee7e7f6c1f05240ee48f1bca2631b897eace66c894dd00266e48a2ca3649635861d7a8a07169d9402a410b1f2e0735d63e5fbff
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD5c4c2d746790f39c321012c6d254152b0
SHA1176b9270b1095a56c5c1164a752aec495476a0c3
SHA256633976e2690ffa3278281f5e3385094bc4b003f63564ab2a9c4a058e4806362f
SHA5120bc3d569be6ae0e31455dec04daf5202cc09bd18c9740729c239161034fa06690953f6608be78259f70fff53f9f68b9ff58b7dee7441f76226c351fe5cd05c80
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD5ca4a8251b3f348f236e032aea7eb44d9
SHA1640213fb4ab6f9b100a1cb9f3beb4d73c151d995
SHA256839c3124c485b71916c1f27b4309027871f2696a2ed61405ef478a7484af9a07
SHA51205de93e30d237a67ae800384a56f3abb3f0772e31d304fa92ad5effa269134de7b80a3b2b28deaae9f501fc91a2db31b6bdb9cb2ed563e90b2a30b6036e69a92
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD53f17486a05d6e4d80c9426fbcd5c93bb
SHA14cc8cb5e515dac866e5ddab686ee15c7b479817e
SHA25617e91d04cbba9e2bf4d4e6a09e282ced3dd079d4a16540cf27c8e181751513cf
SHA512638d28aab46779d48fb4de25561226e3dc9a39e1262311e4a3de29bdcc7826139dfb9a0a603e82dac32dbf79e1706e26c4616fcf9204df86416d425080ba8e55
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
512B
MD5be82648015ea997f362d67d918869e23
SHA13e06af96b0074c9b94be1984614a3a41bd701d9c
SHA256b9a2f356a2c4c5498f535a61ff842b3f1607b9239e3e4a941793ead655d41951
SHA51263eb12ea26b925c14fc2215e36dd3e0cba4320de33a05ecfb07c2987d35aac8838a780191870d5ff328ba4f0eeb6afa790391c332576fcfe22ebae6da83e2a62
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-walFilesize
36KB
MD5c3b53bb7230a52bcbea56461f16a86e9
SHA152cc89fa98acd2efca6202e59b7482a447c7d894
SHA2566f877538c87ed77d34cd714e3a008713e33537c9930b733a796eded4442ce791
SHA5125446a3a2053c497fb7acccd4cc43eaaa5d3b0727baee5e93426bc571d894c4f7d37a952b9bb144772e118df0d94076392dbf6c5e461cf15f872ac751d4d51a9d
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-walFilesize
4KB
MD516c237079e3eee92f1553ff0cdecce72
SHA1858660ea69deb5b9c110b17b2376f1cc9d97e822
SHA256026451349ca24627e7d150d102e7b2ed5980927cfe531b2f8ce4668bad2cb106
SHA51207048f9c76801b6eb5d25bcef1960ca1c28b5b89d12e9f885dbd01a036673cdf69af6c5476e7dc0efb71be10d269290250a913109b8bbf920caaa0c179abdd5c
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-walFilesize
4KB
MD5e4b9b3768edb0f3057d1a188e539a1e0
SHA1aac518b25be33e94dab8465b61e9cc1212a38cbd
SHA2563a73bc6a1a0da214dff81309ea0f9a4886ec0a5136ac07f30770b8341344c5fc
SHA512b67280077e44c47f10ea5850f04a26deeaa7435670c1dfc7ea0fae1bd1400b928a13d03e81bdf80e8e8159ca2bdfd183025ef530bb5d79dd47f494701551b3b8
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-walFilesize
4KB
MD59e25d82f275b23e376ff1b72e7b6a1ca
SHA1542a7a62d5bc4c46fe23afc5d0e876b9c4f64ace
SHA256487661efc410b2b81790def2232e063b5996791472db52635ca5e9aa7a085267
SHA512939117ca955106f759a147a995ed297e2a819ab18aec20a5ff5891fcb0b6341fa3195a172c7ec041434db96a384daa8210d9cbe36f9a2dbef08942118b1bbf01
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-walFilesize
4KB
MD53305a233bbf3c68ebc65ba1796622cb3
SHA1bb63543b594b74fb8bd611d5afbc3608326b9868
SHA25641b3a15f190b00e516f5bb3495cabf6b5b07f1bf7d741bf2bd58343f534394e7
SHA512b235c765eee8e4708f04dcab702a981fa188123674b2bb389647632b32cbe4cd35f1c8f3eee57ea21e2b46196c91c5926997a1a59c0877c3024f13e86e092a14
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-walFilesize
4KB
MD52532b94991140f98e8e3e9b5cc4798de
SHA11664b61f98946a16b3d301b8b097479e407f1f0f
SHA256665ad777fe731edd2203d1e0e6c379f78dc8b62cfcdf08c69024dc04f11edfd5
SHA512d2996e2cc4ac831a9390c825854a0c8578330a654b155f186873b2dee77b4bac650d0220d9af02206536281027f2de1be760cedbbbd28f071c8c68275fc39c95
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF21A01A4-0001-10F3-BCC946B30C5CBeginSession.cls_tempFilesize
75B
MD5977039539aa2b66af168fa81b794f304
SHA1655f8e18d330fc2cb4ea9a206049b5acf938df74
SHA256148eba5b5154c0747e908a25c986be3ef1d6cc6c2ca39487e13b029c5f24ec1b
SHA5123c7f8889f1db5add4128cb96fe185c82b7fc1ff1cee25199002a28b91f67fa2f2114cc5c45b288fd7567cb897a98e4cdd2d837023fa015158d96b1b53427e9bf
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF21A01A4-0001-10F3-BCC946B30C5CSessionApp.cls_tempFilesize
67B
MD5571d31e1327d4a22a7c3ba55a563af04
SHA1732391a485df63508783aaeb35e45cd724363d04
SHA256226e17522c92687ea40b04906ffb059494f4d1795165e4fd68f7ccede41378d9
SHA5129384805140b3a1a06dd61c1bcf47b0d46028339e9860dc281c7d42aec539e27442738918a49aa0a3d23106eb479a62d5300bccfa4ceca77d4b705a8f666d0b80
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF21A01A4-0001-10F3-BCC946B30C5CSessionDevice.cls_tempFilesize
48B
MD5cf9cb0612d588a1f71b63084cea67316
SHA13d035bb92fd3f8997160cf8025c40239af74d3ca
SHA2560d37c5a64baf86735501f9044eeb926b3d46548cdcf67c2cd1f773df36624ac9
SHA51270f000233e181e3b7c6fcf07aa04fdb570f970335837f8d1c4680a9f78af9f9e17c73a0a5646770f7a8787e338899edc4a5197b023865a4da894b1aca12bf600
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF21A01A4-0001-10F3-BCC946B30C5CSessionOS.cls_tempFilesize
14B
MD59b3d4522944ce6396563812bfdb92fa9
SHA16d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/com.crashlytics.settings.jsonFilesize
711B
MD58ac8010fcb4e57021c7678b30350449e
SHA152707985cd0e6b4fcff950f30c14b9f4c9e810a1
SHA2564d1b983ac56089cac7b2242a62f2981f1335cac8d3d1946f78ae9c9c051b34a6
SHA512e5f4105c832cf77a1f14edbb24fece4cb762e46b3333dc710008143ee983d98d6a4ff374541874fb7b4324dfccfe225e2394b024ed9670af2b2b520e304b8af5
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DF21A01A4-0001-10F3-BCC946B30C5C.tempFilesize
254B
MD525557dee1ec09325cf5a0e47c2ecd6b1
SHA1e0a48f085422fadc4a5a09bafcbf778d7540415e
SHA256e7056a3d78ad59df809a33a8091e6475441ec6d7d40940c28b62092529906cfa
SHA51208585b9880625800e9cbc9c3f66e979e4d308c29b45ea769d15524eda97a63f4bbb81e4aaaf7f10aa966e1a81beaa3bc1343f7ab862775e60d1f3115e8e68862
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DF21A01A4-0001-10F3-BCC946B30C5C.temp.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/report-persistence/sessions/664DF21A01A4000110F3BCC946B30C5C/reportFilesize
740B
MD5e2f7c305db51b05d7f08e5b1dbedd9b5
SHA1966063046b3bdfd371ac3a9be53561aeb40b3bb4
SHA25688bef3fb71f80ce48eab82b8681ae0f07c84c84ba0f62a807d433f324b5e6cf9
SHA51234d5b2188786d8528f45ad5a9284a302409fe7d2afb2a76fd5543f55e7b9a598ec1eb64c4b9a70efeedf201161fb8a7459db4a5bd22854909670e7c3d913bdad
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
469B
MD5a363d559a21638fb3d84d569f9264ccd
SHA17a23242a4a93530680cc54eba65afe72a68cadb9
SHA25624d5f4ee54866ca8114e0cecdea6ff447461207964988e5d943aaa51c588bf65
SHA5125f5eb48aa4c37512b40b194373c41213691881b2ec4e7568aa29bd315730c14f88995eaf864e65dc96329db4dee88ff4b4d75afff5845c9c7f89d06f4edf7140
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
469B
MD5b5bd2b59305086dd6f032873efd957fc
SHA1bd74577655f39cb03d076d9dd807ce993b55e2db
SHA2569df8a23ce7c254e48c815664e6b208b7f24e346b4200315384a86050321445f8
SHA51205c17ec85b5ff0c5c7218632442ca85631e9e9592d292cb152ee9d5f0d120de11dd08d9be863028eba24e648823e6067a54ed632d8c0f8af4aa668c1ce747016
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
634B
MD5fa3f8252b55e15d6c56bd81929f70be0
SHA19580402fcacc62a3bc84735a1dbf524e8c6a0a8a
SHA2562137cf4d2fe9487dbab3544730c7d6a1169bbda8d381a5e451a41487c5bc0c79
SHA5124a2cdf690c7ee2bdcf3627564469390991cf8a5d531c6908fba3a89faed0405fd485c57f52007e9963aa4a5aa57b6d14f91076bb52485f99fe43388ebb269cbb
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
634B
MD537acc5c3725060f8c44d55b6b29a13ff
SHA18ab3ccf9d46340396fb7a2d4b77922db2e06198b
SHA2560e0b5c3649f5dc130480e802c8f9f0db89dff0cb800663f60eb022af1e381c5d
SHA512c775b5545a2a5f9c87300881a255ea39fa39b8fec751af56187c4e3bd8ac0fc433ba6d3749abc697b738fb1e0a32610fa67356f0cda5d85a05b44accddfaaae9
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
634B
MD5b8ae17733fa7c2d27c0895e56f7eb354
SHA108fc48058cef17bb0fd6593f41d621dd9396b7af
SHA2568b50fc777fcaaf5f84426774331a9a784eca1b646d80792afb64c702c605c9a4
SHA5124e494ce976efcdd58e09b8331720a2b55e337bc7cac6b47f468d7d306dc952c6226a4eea2a11558503b64e80abb53d4c11541c775c3e586483edb913be0dfa76
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1KB
MD5b4b8f7b34528677bac51bbeae23a16c1
SHA1a2b38f449dc040093855273a1401ce9f911134cf
SHA25618630b0a3caa17839508594e241b0925e51aea030ac4c5b626a5d801e4537f15
SHA51235f13406e3a7e7c3c7d315db57a5e011703e4956fbdb050b11a73f85980e50a5ed45f0a39fe6b6b327547f1b13f20a2de81abd035d37752a7ef4a32c9ef1f5e5
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1KB
MD57f6af916c03b07794f8e0cff2309efde
SHA17a2b9514f6ff55c53324c8d3c902a8c8e96acfaa
SHA2565e1723e052e2fb71f31cd96207fccf3134fd5df26128f04ea7798279b24feb0b
SHA512f681716f21ca41347ea64c6738c75f1e8dc4421f2ba2fe0ad793e55deb0366d63cac67413fc1f6ef6ebbe8259ca3cadfed78c2bc39e60a2328cdd68a49505a97
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1KB
MD52e8ce3b44e2560ecd11a6a0995fcb747
SHA10cef5d68c932fa4ed132f3cdb5b4e183f75f8065
SHA25677baff70b03f57513e698db0e13dff1f441dff9c9efc635bf8eee194ea4677e7
SHA512d56c3f28b38e879201158fa790c77cd67de16c98735e65d3ff0781f91320ae984aea86133f5e07b80a04c313f4bfda0da6692e96d6107d00752fb3e265f81e74
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1016B
MD54d6ccf87da850eae3548e5b4f644ab8b
SHA1ff3b536ac108be4c515b1200364f79a8eb6147e7
SHA256ae36a39e457d1134719439b6d4154cdab19077a58107d21e488201206d2b3eff
SHA5123c242f7568cba9d8861cb57641a5fb205aa9a15a9eca21dcb790c0ea5a5a358f3faf7724606069388fb149068a1722d838dd4f2cf10ef4d0bad766533c1c2b00
-
/data/data/com.ebcom.ewano/files/PersistedInstallation8579413085366559256tmpFilesize
569B
MD53f19332167262f1758b0b1424faf65c2
SHA1cac53619e681875f8828147354d0e0f8fd8c33ba
SHA2565cf81fbda3c5c0978d7a385b7c670c444bc16bbbcf92bd9a848ac2b25d209c32
SHA51290aab747df272a031be66537b5011023f0472b2e558b3dcf0eb4ceeeadf1a819af6f2386fec73bf63b45b423883f1c71422055cb36490b81c2e03a71d8dcc275
-
/data/data/com.ebcom.ewano/files/PersistedInstallation979182901905321213tmpFilesize
90B
MD56db6428aeafba7e0c82102ef48cdcfa2
SHA1588f6bb43c553dbc49d242427869036680387fb2
SHA25619f7a8061778289815b11b06a586e64cd3ec6bd0fea7cbfbea4e3f914ba098f4
SHA512172134e19f2ddbd6b975c91c2fc534c0304c0d42a7cc8a053231a49df2b2058c222722e78943c5088b72145cec8612871b7b70822f41bed61940c911868c72dd