Analysis
-
max time kernel
134s -
max time network
147s -
platform
android_x64 -
resource
android-33-x64-arm64-20240514-en -
resource tags
androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system -
submitted
22-05-2024 12:24
Static task
static1
Behavioral task
behavioral1
Sample
Ewano.apk
Resource
android-x86-arm-20240514-en
General
-
Target
Ewano.apk
-
Size
6.9MB
-
MD5
386620284bdcd6a8eb6086e35eeece70
-
SHA1
32e6cb44be35ad44537559925d39677e4c232125
-
SHA256
2fef1a446aca4cf2916a2e4a504b273939192d47e271e05f0b47ecb86ba9f1f3
-
SHA512
6d20f741548d10e3cedccdde05bad56aedf9648bf635e30fb30d88e6f33ddce9a8ac0b04bae1b262edb3dc5741ec79da51ed8bdead4efa798cfe6b69d9473239
-
SSDEEP
98304:AWiQTgAfDvDRg/4NErvCdJ/7Cv4zXQGMEUP0r8hEjqa7BzrPiXrU9+7EfriQkmD:3iQTRfbDQyWvgMxWT7BybUxZD
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 9 IoCs
Processes:
com.ebcom.ewanoioc process /sbin/su com.ebcom.ewano /system/bin/failsafe/su com.ebcom.ewano /system/sd/xbin/su com.ebcom.ewano /system/app/Superuser.apk com.ebcom.ewano /system/xbin/su com.ebcom.ewano /data/local/su com.ebcom.ewano /data/local/bin/su com.ebcom.ewano /data/local/xbin/su com.ebcom.ewano /system/bin/su com.ebcom.ewano -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.ebcom.ewanodescription ioc process File opened for read /proc/meminfo com.ebcom.ewano -
Acquires the wake lock 1 IoCs
Processes:
com.ebcom.ewanodescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.ebcom.ewano -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.ebcom.ewanodescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ebcom.ewano -
Checks the presence of a debugger
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.ebcom.ewanodescription ioc process Framework API call javax.crypto.Cipher.doFinal com.ebcom.ewano
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.eventsFilesize
40KB
MD5571112758fefc013ca64f73bc959a009
SHA164b3e995d49a74c647cb467f54fc72c28c5af3bf
SHA256632907b2357e6d3e99c86012795c6a2eebd1e8c1ee0a64c64878c5c1201413a2
SHA512ce75b2bf73c4fd98b5391cf39610260fc90a91a7e85388c6074fe7b21f8b54eb88a0d0ce83a3403b496bcaf885deceab36daaae18976dc1f18fa4dd0605e2e34
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journalFilesize
8KB
MD5fbcdd2976f7332380e04c10a8f0e6a51
SHA1a8665e051ac649d281e5ffce34b9266595132713
SHA256936f4fc7baa516001b657d561e02bcb440b5324646c20ceff6e92081a4d4e58b
SHA5125b3d48284671186cbd7a4b9ed921788ae5f6a5f931f2ea753ca349474256f6abadfe57375f01b693c172bc7a1aea21359f6f5e45d94e0e00196bb82eb1747312
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journalFilesize
512B
MD5e43572f24a9409f186263dc212db905f
SHA1b4e23b884d97dbc3244e96e988b46e9e1145d964
SHA256a99ad594e3117d9110f88c836a83b6329f5658568883294c8e342add8047744b
SHA512167780e8193444afcdbfd0468fcadc7fe5b8a94ee934cf65199e4fe243e19ea29386f5df55e0ba34baf0d64679a9ad2e1d36e2fb3492ce7010fae9839e310d57
-
/data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journalFilesize
8KB
MD5856206dd2d85ced774a7246018fe6155
SHA1da8e85780bafc88ff795df3f14750a682bbffa53
SHA256d2447c15efa87bfafeb7e8cfa86a82a40512a4cc3b022b8ebc95b28d5dfbd9bb
SHA512815bf6356442a31befd86d9e0a6efe7548e638054e9294f17b151caef387a997b1a2b6db80d4ecf024d79a5e5aeb1c03e2b5be7e2a0f57a98e5a3c7ad3a712d6
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD562ad4a05cbdca7f47b3206b7dbda487f
SHA14f4044cef7b7b1e5c6184ed9025267fc92bf0cd3
SHA25618b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6
SHA5120936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD5db375c27b67aa942978f5ca27ddc3a2e
SHA1b59deea83f62ff5f40b8e0766cbcd6e7d32ed153
SHA256c080dd6f78e63749b852313c734918821734405223cd75ece8a92312bfb7450e
SHA512cf5f6ed7cfb4fe46478825f482ceb6d9721b9cf2c9500a62608f03a919f9c15d0ee4799735145f492a238d599f489e499949e180a8a8a4f87916b6b469f0537f
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD5dc1f18ba7c4ad6a0c891349cad8e944a
SHA16debdb7d185a9b104736ab34b74a606a8c6487a9
SHA256a1e0b62df55f3a87b554a7a565d744545f4584ccc413e4f52b9c37ff01b3a879
SHA512562a0ec7c312bf5ac3dfd6c55795f0ebb674631df3b0a9fc43111d24d2a4e7df89e027f8fe234a37d3ea6c97323c3d54bf136d5de2788d3c3f458595e4535b1f
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD53ebb13eae661bc9fb403d77bb7f4962b
SHA1525a34a5a4da5c37537a72405d8548dfd4be13c4
SHA2567925d522c215159ddec647225d7c9e6b11abac68a1b171766a1364ac51293d42
SHA5126f0d79056477e5832182872027c9f8bee66b1eab0d1f82cd8e20ea6ac56e643bbfc49e56140ac21cfa294d64a4d95991cb59bbb3342da3887772e9a739a2b2a4
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD586051d64bd6f4582a76054516d1130c6
SHA111c33caf0e5f95c43aa359deb6cbe621c14cf99b
SHA2560f79e13af56269b9996928c7bf96e8adba84576fb1b3695f9efe9ec245daeec7
SHA5127d983f023c36f02b534763e492f232eb90786e3081e80e72df2b3fd6241f7ce8307f918a394244f9ef24aabb455fdd6fdf7af450f6a221fadc3d849dbd71a53e
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.dbFilesize
16KB
MD5706cbc6462c5a525f8bfa507b657c3a4
SHA16e1650954a638671a94158881d55728a50b8cb10
SHA2565defa41b5cd20d1585f32da1680e1c7335b3c53ef67eff60ddc64c515e1b5a01
SHA512ca33230912b1bd45e9272709b3d756a572824dd806b5e99bc5388dd0e13d4658651f737844eb24effac97f46f980b75c86548c7b615138867acfa0f40825c067
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
512B
MD5e8ff4d933a94ac166bd30a98c652405a
SHA138a2b014e6da8ea8c528d67c962525fcdc842f6b
SHA2567fe59c68cb82b0c9f1bdb8ebba7768286048b2e3a7ce69084976500fd89db23e
SHA5129177a9ca34b27bbbf1b3345c5e21d6b469d4b25f094d951f739f7043dd4a1053d4401dc26a6f9ffa5428091fef7e4411776b6850411e6739d3ed3df986fe2c8b
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
8KB
MD58de7cd1e5badb250a29f132cd54d5fba
SHA1fe7138f871cb82cb26149ad3a852b8f3f25cbce4
SHA256a6e7969a30e33881a5faff99093944a483d2809cfe42917484ccf1b13dc1bf4b
SHA51231397fd8f19add40eb3cf30ff5663164e0b215667e0107e41c57c8db972b8b545de505bcba7cc749196fb84a5e15d21bfd7b06022392497bf4d793f0bc181ebc
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
4KB
MD5a210d515f6ed153c89ece8b98125b8b3
SHA1ec1880ef9a51c4d0eb601eae9de46281bcfd2435
SHA256a36fb98bc2b8e1a4e512c66165d40da8cfb0cbf6ed4a2e9bc4926463e8baee94
SHA5125641268d17485fbbbe7d6f55e2edaccfb52f55e89ac3fd0d901fdeb31c407ca5c99c1d2d6ed7e26a7854dc803c9841b36f8a1dc53c4a85b021c5ac91b415b882
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5072fc83a96226f5641af2d5b4cb32a8b
SHA1aa2eb9592dce882cf6619201a0e263dda51e8c78
SHA256c2ff3ef2059414cc86940a20492c94e12bcaebff3662fd22577d48f3e11ed823
SHA512dbc073d97ca46bee65d2d4b535ead077b1e6d194298595f45c4da4bd57e63753bd3ad16641e2c8f18daccffd10e6397f67fd1be07fbe8feca126d0be3c37b7be
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5687b3e0f4be0e2ad86261c5fa8fc8a11
SHA166af746686528c8a5535e25b9c033212eeaad74d
SHA256a56bc89bdc5a9c3b74a1bd638a5a18ae6e1fa98035dbec9ca5bd6c31ae7215fb
SHA512905b210c19b9f8a7a5dfed9fa247a8697f2118e43075bc90f7e7c4f50e5f315ffc41325f7abc7d7e29791628fbb8a1ae11bef1502150d403f18cb6730b8ab9d7
-
/data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journalFilesize
8KB
MD5b0c71b2f1ffa2886f1eedfda74ccb9b9
SHA1f0347d3ddfe57dcb5c84d6826a86b414c10d36f2
SHA2565d9caabad8d8118a6225576cb44cbb66c568c114bbb33f4eb76fc6448299fe05
SHA5120ef7f73d4923be28ea2e6265ef4f8f274259efe94617e1efbd4dac6efb9417ebcd7405363f50623264c4c2a63b24dfdb1a8ca3c25b827db29918d1904fd0d964
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0BeginSession.cls_tempFilesize
75B
MD5efb6c7e7988409e8cdd318a3cdab65b3
SHA165e46bc73f85282f2c7241b74ce15d93672dd6ea
SHA2567ef30cbf52494f8b8be3b1a37b3e92b21b434219aa669961b7e09e18dc006a5b
SHA512a1440fe1ecfdf1cb95541b36421e9f913cb1559f6e2019ed3cbb0635b5ff3a5eef00828bcc2b5530b2f25432af8108a9791470818af76c4a4f4a1c3764bffd44
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0SessionApp.cls_tempFilesize
67B
MD5c506c7446c62a1cfbd7c33107838e13d
SHA170c0cd2053f32e6e356e9a3e3627d5c686c744c5
SHA2565053ae263ef8ae6b37e86e86edff70e99ac4e05a38df63fcc4f3cca56a0c79f6
SHA512a86474dcaf314a482688bd3490c42036ccc29e7bedd985b03a03b8f917aefbcbc8a759f5ca9119c16fa5363e96b936af46da2b437764b89cc38f171d07d1a1f9
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0SessionDevice.cls_tempFilesize
48B
MD5565c6ee401c88ff45333d76d9a45b41e
SHA166d1d4970e2504ca80eeb12108deaee208d7beb5
SHA25674d24661d5bbd395690ee059fb9886184ae12d3ac9306b805c0a106c9ba97ca1
SHA51279430461bfe8d08f8f92882daaf59251a7ba36dd47c2020bc8b471b7d07170aba1da9de935a8074c38a1aacc7fa898bda74814365be1a4c570bb88dd37ca3d6a
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0SessionOS.cls_tempFilesize
15B
MD5f8b3ebea29c91d82f009e5a9c6d11060
SHA199d88c4b39d9143084e777b93d9692a59a3d087d
SHA256b7869422f5dcf3f24ae91560cec05ebb39852ed45baf3a31176f9b90de87aafe
SHA5126f89bfe6bc1c0a68bca73ef92c53e1a308fd63f2228a25a6e34d117fc5cd253209eed56fe08f51d5643343a152acfdbfbb1c5dcea224e2750aed46074af369de
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/com.crashlytics.settings.jsonFilesize
711B
MD599eba7dbaf37be0f0f79f15bb8b9b80f
SHA18af511a58a93335b30e0f094c366bc4179a684cb
SHA2564bf3f78b0928948cc909f853e174f67498e46c33b8278f6a947cb5180b2bd9a5
SHA512a2438991d03531eecb56ffc3b81ebf58501b2c215b0e45ce9c76b301bc6da7b145a227b380b4faf46de88f7d45e381ab884056d64ec3982e475d65c9c5cb0248
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DF1C302EC-0001-10C4-8773AD481DC0.tempFilesize
254B
MD5bf77e0de1e708660ec8e7fb60db1abfc
SHA122e0cbb3380060928a440bcb83830e579ad6db09
SHA25600eadef4d36e988834264c8763293ee38f5e195ef357e32415e30d9f75773923
SHA512bba1c4dc3e4be083d1a008edf6751170e9690d748cf9a8c016c28bdbd1cbc41ef1ec37756bccea6c233173fe32426e1d7e3d05c682402da9a30a0df2030b97d4
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DF1C302EC-0001-10C4-8773AD481DC0.temp.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/report-persistence/sessions/664DF1C302EC000110C48773AD481DC0/reportFilesize
742B
MD5f336a795466f6d9ed2588aecdbfc563a
SHA13ae3e4ce8fb3cbc327d8253a6830d91719342078
SHA25655499d2c1bd70ef93b51b08f94ecffae16943a8b1545d4ff4392644aa4bbba96
SHA5123a156b087cab54cd6a69d8537165ab9417fa61b190e92655628333583c21ea0ff42ca2bc189f53792852826b5336432d444ef0dc96a72fc87f51a5034065cae6
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
469B
MD56d9298a06501e5059394adc3e09e1461
SHA187f2e0ac526519a6d657d6af3aec86248799f2da
SHA25640e598ab7185dae9758056bb19f21b5c98e8596562a936c971f49a7c99cfb7f7
SHA512d8b83830b060abb471fdcf55346b0817edc191bc1ec73ef92c18ae2dd440b96964861a5b1a94e02743969f299701369b252317002f0c5eecccac48e9f726e539
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
469B
MD50b04ec62e3dd42fb92faa9a4fbac4875
SHA1f2c3dac43f5c8c236aff6863473612785845036b
SHA256e23ce4b3ed0f3d935c25c380ddf57c2479d11b4f93e1161f6e459674a11f82e2
SHA5124d3d6ab2c1d941920d117ef69555b70d8285410b72cc2862cf38d46907a69423fe8b4c88ce4e39c07602039c39f58a230a8705f7aead713bbb6ed60760e1a3e9
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
469B
MD53a5b7a3d804872fd77b6083d556c7920
SHA113af3c8817a0654089418298e564149601d76a88
SHA256eb8b8ea5f2624c5a4abfb5acce6440068d60d0e2cd27f21c669a2a259c82dd80
SHA512867b3bd3fc59d9de68c89b7c3567bb261a04b0abff138e115e975e7bcc73a5a45098d36ecc37be5be100471967adaa5d93b16066045ce3a2b6f6403f219950b7
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
634B
MD540e4ea64062209aa5aceee0088465f9c
SHA1009b85230cbfa7972da579eb6dbde87f200f4b2a
SHA2560988b9e57d0cb4ce18b579f4198726ab9c978c6bb0fd899bde8d6cb7bd12dee0
SHA512df2daa1be4ada37815d5e71f3424bd75ca142e7b33e7df7e2fe0af61814ed5a65c5d81eedbb1364165b9d89c81dcf281beceaca9e84c2f569ee4f6ede03dd202
-
/data/data/com.ebcom.ewano/files/AdTraceIoActivityStateFilesize
634B
MD55028250efa7c27e4a1d59e72ecbb05be
SHA1395c41a04b4c47879869fa64a3d51da9bab08f27
SHA2561c5ad7a48c4b5227222245d3a1b74cdb200ec0ffaee5b0de24455266544fecab
SHA512d14eb1ac1a13555deaf510a784ff65f43a21a3d3fe0e074a7143ba1d70836c106f14a04899f8e27bb3c422b0e79c37ad7cfaa15c3d2dc4949b575490e78c7e5e
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1KB
MD548f9b26842d65985ec29edf711208a8a
SHA12c70600da314a2f3efb6747a3b16e4e60722f372
SHA25640a9dcb5a5533de81114dbfa62ebdaab03ad87d0808619e4a41b63fbf022982d
SHA5124ef59470773c7f4723a17d743510e1a7d0ab2fa4dd512d165d62072f0c5531199818ae9a19454e05e1c8f1b256252305671699e6a1aec26cce3ed33c50fd4743
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1KB
MD56bcae904ded5c0b38b4ede0fa0da1135
SHA12523fbd2cd72cd92fc8c8dedccaa98a1531b0555
SHA2568820207ed355a5ddee959874fc898e02114164c5d2542a18a5ae6f573327a8a1
SHA512f632879abf8d11699a0543fd5e6ac9978eece96f9fbef3ed26fe9cea9a7ab8a4b6d1b60f3e43cc9edfe0739374b773573d1ba0c83bb8d78bfc1b0417ca1a4bc0
-
/data/data/com.ebcom.ewano/files/AdTraceIoPackageQueueFilesize
1016B
MD5a4bb2adadb8700b1e3c5cb5665c6aa95
SHA1aadd5e7e255d08419bbc5ca4e8e75474db464416
SHA256ed05b9962936c150f30ebe517ef682aa5f4364b861ef93a3c8d2b982be0c51f8
SHA5124c99be459b6d26c305211bfc83530316a7fbfd2e4748acce24021aa6f1af404a7bd90c07feb969a6226cce9ca946867d4710823b9ea9764d8f3da0db4f2e8e4c
-
/data/data/com.ebcom.ewano/files/PersistedInstallation6147461547342815878tmpFilesize
567B
MD5a56f6b154f745b5cc92158fb13b1e377
SHA157c3473eca7a716f699aa26431120ef0a69fa75b
SHA2569751d2f23d1dceff01c88acc4f825b1a91f980a46378d71e924137138cedad6a
SHA512c3d8024837390b7e71ee5c9ce80b1c509ed3d9ab38f5f5a72c18da032697edbf976531979ae7b6ea28e28e7ab14c9f1a0a30fd5c7132f707cac88b2cf2775115
-
/data/data/com.ebcom.ewano/files/PersistedInstallation9183856615333555878tmpFilesize
90B
MD59a576bd160b02d456013afc56082ff2d
SHA139a40104976b96e8dcdb3744fa9906ec578761a1
SHA256dedea181ebbf50b97093bb9b86d51a9d8f9d12f0c122a401ef462ad4b3c355b3
SHA512dc7530a583c67cf870a871dc491abc9f7dbd80362ecc43a0d3dc9b93b415d4f90bad4015a7a6003f787b69aef8269e11eb7a29488e0447ff35038114b705a12e