Analysis

  • max time kernel
    134s
  • max time network
    147s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240514-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
  • submitted
    22-05-2024 12:24

General

  • Target

    Ewano.apk

  • Size

    6.9MB

  • MD5

    386620284bdcd6a8eb6086e35eeece70

  • SHA1

    32e6cb44be35ad44537559925d39677e4c232125

  • SHA256

    2fef1a446aca4cf2916a2e4a504b273939192d47e271e05f0b47ecb86ba9f1f3

  • SHA512

    6d20f741548d10e3cedccdde05bad56aedf9648bf635e30fb30d88e6f33ddce9a8ac0b04bae1b262edb3dc5741ec79da51ed8bdead4efa798cfe6b69d9473239

  • SSDEEP

    98304:AWiQTgAfDvDRg/4NErvCdJ/7Cv4zXQGMEUP0r8hEjqa7BzrPiXrU9+7EfriQkmD:3iQTRfbDQyWvgMxWT7BybUxZD

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ebcom.ewano
    1⤵
    • Checks if the Android device is rooted.
    • Checks memory information
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4292

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events
    Filesize

    40KB

    MD5

    571112758fefc013ca64f73bc959a009

    SHA1

    64b3e995d49a74c647cb467f54fc72c28c5af3bf

    SHA256

    632907b2357e6d3e99c86012795c6a2eebd1e8c1ee0a64c64878c5c1201413a2

    SHA512

    ce75b2bf73c4fd98b5391cf39610260fc90a91a7e85388c6074fe7b21f8b54eb88a0d0ce83a3403b496bcaf885deceab36daaae18976dc1f18fa4dd0605e2e34

  • /data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    fbcdd2976f7332380e04c10a8f0e6a51

    SHA1

    a8665e051ac649d281e5ffce34b9266595132713

    SHA256

    936f4fc7baa516001b657d561e02bcb440b5324646c20ceff6e92081a4d4e58b

    SHA512

    5b3d48284671186cbd7a4b9ed921788ae5f6a5f931f2ea753ca349474256f6abadfe57375f01b693c172bc7a1aea21359f6f5e45d94e0e00196bb82eb1747312

  • /data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journal
    Filesize

    512B

    MD5

    e43572f24a9409f186263dc212db905f

    SHA1

    b4e23b884d97dbc3244e96e988b46e9e1145d964

    SHA256

    a99ad594e3117d9110f88c836a83b6329f5658568883294c8e342add8047744b

    SHA512

    167780e8193444afcdbfd0468fcadc7fe5b8a94ee934cf65199e4fe243e19ea29386f5df55e0ba34baf0d64679a9ad2e1d36e2fb3492ce7010fae9839e310d57

  • /data/data/com.ebcom.ewano/databases/com.google.android.datatransport.events-journal
    Filesize

    8KB

    MD5

    856206dd2d85ced774a7246018fe6155

    SHA1

    da8e85780bafc88ff795df3f14750a682bbffa53

    SHA256

    d2447c15efa87bfafeb7e8cfa86a82a40512a4cc3b022b8ebc95b28d5dfbd9bb

    SHA512

    815bf6356442a31befd86d9e0a6efe7548e638054e9294f17b151caef387a997b1a2b6db80d4ecf024d79a5e5aeb1c03e2b5be7e2a0f57a98e5a3c7ad3a712d6

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    62ad4a05cbdca7f47b3206b7dbda487f

    SHA1

    4f4044cef7b7b1e5c6184ed9025267fc92bf0cd3

    SHA256

    18b909096c7c61d51ab076ae8e562effb0d4ada28e2a4ecd0e6b88ef58f6b2a6

    SHA512

    0936531ed1b2b356a247123200739a43cfc765469ab47a424dcd6e3d1176092a212b0a28591d07f8c2d0cc9d2e0eeddfcea8dde314c2f9343783c61075b071a6

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    db375c27b67aa942978f5ca27ddc3a2e

    SHA1

    b59deea83f62ff5f40b8e0766cbcd6e7d32ed153

    SHA256

    c080dd6f78e63749b852313c734918821734405223cd75ece8a92312bfb7450e

    SHA512

    cf5f6ed7cfb4fe46478825f482ceb6d9721b9cf2c9500a62608f03a919f9c15d0ee4799735145f492a238d599f489e499949e180a8a8a4f87916b6b469f0537f

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    dc1f18ba7c4ad6a0c891349cad8e944a

    SHA1

    6debdb7d185a9b104736ab34b74a606a8c6487a9

    SHA256

    a1e0b62df55f3a87b554a7a565d744545f4584ccc413e4f52b9c37ff01b3a879

    SHA512

    562a0ec7c312bf5ac3dfd6c55795f0ebb674631df3b0a9fc43111d24d2a4e7df89e027f8fe234a37d3ea6c97323c3d54bf136d5de2788d3c3f458595e4535b1f

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    3ebb13eae661bc9fb403d77bb7f4962b

    SHA1

    525a34a5a4da5c37537a72405d8548dfd4be13c4

    SHA256

    7925d522c215159ddec647225d7c9e6b11abac68a1b171766a1364ac51293d42

    SHA512

    6f0d79056477e5832182872027c9f8bee66b1eab0d1f82cd8e20ea6ac56e643bbfc49e56140ac21cfa294d64a4d95991cb59bbb3342da3887772e9a739a2b2a4

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    86051d64bd6f4582a76054516d1130c6

    SHA1

    11c33caf0e5f95c43aa359deb6cbe621c14cf99b

    SHA256

    0f79e13af56269b9996928c7bf96e8adba84576fb1b3695f9efe9ec245daeec7

    SHA512

    7d983f023c36f02b534763e492f232eb90786e3081e80e72df2b3fd6241f7ce8307f918a394244f9ef24aabb455fdd6fdf7af450f6a221fadc3d849dbd71a53e

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db
    Filesize

    16KB

    MD5

    706cbc6462c5a525f8bfa507b657c3a4

    SHA1

    6e1650954a638671a94158881d55728a50b8cb10

    SHA256

    5defa41b5cd20d1585f32da1680e1c7335b3c53ef67eff60ddc64c515e1b5a01

    SHA512

    ca33230912b1bd45e9272709b3d756a572824dd806b5e99bc5388dd0e13d4658651f737844eb24effac97f46f980b75c86548c7b615138867acfa0f40825c067

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journal
    Filesize

    512B

    MD5

    e8ff4d933a94ac166bd30a98c652405a

    SHA1

    38a2b014e6da8ea8c528d67c962525fcdc842f6b

    SHA256

    7fe59c68cb82b0c9f1bdb8ebba7768286048b2e3a7ce69084976500fd89db23e

    SHA512

    9177a9ca34b27bbbf1b3345c5e21d6b469d4b25f094d951f739f7043dd4a1053d4401dc26a6f9ffa5428091fef7e4411776b6850411e6739d3ed3df986fe2c8b

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    8de7cd1e5badb250a29f132cd54d5fba

    SHA1

    fe7138f871cb82cb26149ad3a852b8f3f25cbce4

    SHA256

    a6e7969a30e33881a5faff99093944a483d2809cfe42917484ccf1b13dc1bf4b

    SHA512

    31397fd8f19add40eb3cf30ff5663164e0b215667e0107e41c57c8db972b8b545de505bcba7cc749196fb84a5e15d21bfd7b06022392497bf4d793f0bc181ebc

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journal
    Filesize

    4KB

    MD5

    a210d515f6ed153c89ece8b98125b8b3

    SHA1

    ec1880ef9a51c4d0eb601eae9de46281bcfd2435

    SHA256

    a36fb98bc2b8e1a4e512c66165d40da8cfb0cbf6ed4a2e9bc4926463e8baee94

    SHA512

    5641268d17485fbbbe7d6f55e2edaccfb52f55e89ac3fd0d901fdeb31c407ca5c99c1d2d6ed7e26a7854dc803c9841b36f8a1dc53c4a85b021c5ac91b415b882

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    072fc83a96226f5641af2d5b4cb32a8b

    SHA1

    aa2eb9592dce882cf6619201a0e263dda51e8c78

    SHA256

    c2ff3ef2059414cc86940a20492c94e12bcaebff3662fd22577d48f3e11ed823

    SHA512

    dbc073d97ca46bee65d2d4b535ead077b1e6d194298595f45c4da4bd57e63753bd3ad16641e2c8f18daccffd10e6397f67fd1be07fbe8feca126d0be3c37b7be

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    687b3e0f4be0e2ad86261c5fa8fc8a11

    SHA1

    66af746686528c8a5535e25b9c033212eeaad74d

    SHA256

    a56bc89bdc5a9c3b74a1bd638a5a18ae6e1fa98035dbec9ca5bd6c31ae7215fb

    SHA512

    905b210c19b9f8a7a5dfed9fa247a8697f2118e43075bc90f7e7c4f50e5f315ffc41325f7abc7d7e29791628fbb8a1ae11bef1502150d403f18cb6730b8ab9d7

  • /data/data/com.ebcom.ewano/databases/google_app_measurement_local.db-journal
    Filesize

    8KB

    MD5

    b0c71b2f1ffa2886f1eedfda74ccb9b9

    SHA1

    f0347d3ddfe57dcb5c84d6826a86b414c10d36f2

    SHA256

    5d9caabad8d8118a6225576cb44cbb66c568c114bbb33f4eb76fc6448299fe05

    SHA512

    0ef7f73d4923be28ea2e6265ef4f8f274259efe94617e1efbd4dac6efb9417ebcd7405363f50623264c4c2a63b24dfdb1a8ca3c25b827db29918d1904fd0d964

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0BeginSession.cls_temp
    Filesize

    75B

    MD5

    efb6c7e7988409e8cdd318a3cdab65b3

    SHA1

    65e46bc73f85282f2c7241b74ce15d93672dd6ea

    SHA256

    7ef30cbf52494f8b8be3b1a37b3e92b21b434219aa669961b7e09e18dc006a5b

    SHA512

    a1440fe1ecfdf1cb95541b36421e9f913cb1559f6e2019ed3cbb0635b5ff3a5eef00828bcc2b5530b2f25432af8108a9791470818af76c4a4f4a1c3764bffd44

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0SessionApp.cls_temp
    Filesize

    67B

    MD5

    c506c7446c62a1cfbd7c33107838e13d

    SHA1

    70c0cd2053f32e6e356e9a3e3627d5c686c744c5

    SHA256

    5053ae263ef8ae6b37e86e86edff70e99ac4e05a38df63fcc4f3cca56a0c79f6

    SHA512

    a86474dcaf314a482688bd3490c42036ccc29e7bedd985b03a03b8f917aefbcbc8a759f5ca9119c16fa5363e96b936af46da2b437764b89cc38f171d07d1a1f9

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0SessionDevice.cls_temp
    Filesize

    48B

    MD5

    565c6ee401c88ff45333d76d9a45b41e

    SHA1

    66d1d4970e2504ca80eeb12108deaee208d7beb5

    SHA256

    74d24661d5bbd395690ee059fb9886184ae12d3ac9306b805c0a106c9ba97ca1

    SHA512

    79430461bfe8d08f8f92882daaf59251a7ba36dd47c2020bc8b471b7d07170aba1da9de935a8074c38a1aacc7fa898bda74814365be1a4c570bb88dd37ca3d6a

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/664DF1C302EC-0001-10C4-8773AD481DC0SessionOS.cls_temp
    Filesize

    15B

    MD5

    f8b3ebea29c91d82f009e5a9c6d11060

    SHA1

    99d88c4b39d9143084e777b93d9692a59a3d087d

    SHA256

    b7869422f5dcf3f24ae91560cec05ebb39852ed45baf3a31176f9b90de87aafe

    SHA512

    6f89bfe6bc1c0a68bca73ef92c53e1a308fd63f2228a25a6e34d117fc5cd253209eed56fe08f51d5643343a152acfdbfbb1c5dcea224e2750aed46074af369de

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/com.crashlytics.settings.json
    Filesize

    711B

    MD5

    99eba7dbaf37be0f0f79f15bb8b9b80f

    SHA1

    8af511a58a93335b30e0f094c366bc4179a684cb

    SHA256

    4bf3f78b0928948cc909f853e174f67498e46c33b8278f6a947cb5180b2bd9a5

    SHA512

    a2438991d03531eecb56ffc3b81ebf58501b2c215b0e45ce9c76b301bc6da7b145a227b380b4faf46de88f7d45e381ab884056d64ec3982e475d65c9c5cb0248

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DF1C302EC-0001-10C4-8773AD481DC0.temp
    Filesize

    254B

    MD5

    bf77e0de1e708660ec8e7fb60db1abfc

    SHA1

    22e0cbb3380060928a440bcb83830e579ad6db09

    SHA256

    00eadef4d36e988834264c8763293ee38f5e195ef357e32415e30d9f75773923

    SHA512

    bba1c4dc3e4be083d1a008edf6751170e9690d748cf9a8c016c28bdbd1cbc41ef1ec37756bccea6c233173fe32426e1d7e3d05c682402da9a30a0df2030b97d4

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/log-files/crashlytics-userlog-664DF1C302EC-0001-10C4-8773AD481DC0.temp.tmp
    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/com.ebcom.ewano/files/.com.google.firebase.crashlytics/report-persistence/sessions/664DF1C302EC000110C48773AD481DC0/report
    Filesize

    742B

    MD5

    f336a795466f6d9ed2588aecdbfc563a

    SHA1

    3ae3e4ce8fb3cbc327d8253a6830d91719342078

    SHA256

    55499d2c1bd70ef93b51b08f94ecffae16943a8b1545d4ff4392644aa4bbba96

    SHA512

    3a156b087cab54cd6a69d8537165ab9417fa61b190e92655628333583c21ea0ff42ca2bc189f53792852826b5336432d444ef0dc96a72fc87f51a5034065cae6

  • /data/data/com.ebcom.ewano/files/AdTraceIoActivityState
    Filesize

    469B

    MD5

    6d9298a06501e5059394adc3e09e1461

    SHA1

    87f2e0ac526519a6d657d6af3aec86248799f2da

    SHA256

    40e598ab7185dae9758056bb19f21b5c98e8596562a936c971f49a7c99cfb7f7

    SHA512

    d8b83830b060abb471fdcf55346b0817edc191bc1ec73ef92c18ae2dd440b96964861a5b1a94e02743969f299701369b252317002f0c5eecccac48e9f726e539

  • /data/data/com.ebcom.ewano/files/AdTraceIoActivityState
    Filesize

    469B

    MD5

    0b04ec62e3dd42fb92faa9a4fbac4875

    SHA1

    f2c3dac43f5c8c236aff6863473612785845036b

    SHA256

    e23ce4b3ed0f3d935c25c380ddf57c2479d11b4f93e1161f6e459674a11f82e2

    SHA512

    4d3d6ab2c1d941920d117ef69555b70d8285410b72cc2862cf38d46907a69423fe8b4c88ce4e39c07602039c39f58a230a8705f7aead713bbb6ed60760e1a3e9

  • /data/data/com.ebcom.ewano/files/AdTraceIoActivityState
    Filesize

    469B

    MD5

    3a5b7a3d804872fd77b6083d556c7920

    SHA1

    13af3c8817a0654089418298e564149601d76a88

    SHA256

    eb8b8ea5f2624c5a4abfb5acce6440068d60d0e2cd27f21c669a2a259c82dd80

    SHA512

    867b3bd3fc59d9de68c89b7c3567bb261a04b0abff138e115e975e7bcc73a5a45098d36ecc37be5be100471967adaa5d93b16066045ce3a2b6f6403f219950b7

  • /data/data/com.ebcom.ewano/files/AdTraceIoActivityState
    Filesize

    634B

    MD5

    40e4ea64062209aa5aceee0088465f9c

    SHA1

    009b85230cbfa7972da579eb6dbde87f200f4b2a

    SHA256

    0988b9e57d0cb4ce18b579f4198726ab9c978c6bb0fd899bde8d6cb7bd12dee0

    SHA512

    df2daa1be4ada37815d5e71f3424bd75ca142e7b33e7df7e2fe0af61814ed5a65c5d81eedbb1364165b9d89c81dcf281beceaca9e84c2f569ee4f6ede03dd202

  • /data/data/com.ebcom.ewano/files/AdTraceIoActivityState
    Filesize

    634B

    MD5

    5028250efa7c27e4a1d59e72ecbb05be

    SHA1

    395c41a04b4c47879869fa64a3d51da9bab08f27

    SHA256

    1c5ad7a48c4b5227222245d3a1b74cdb200ec0ffaee5b0de24455266544fecab

    SHA512

    d14eb1ac1a13555deaf510a784ff65f43a21a3d3fe0e074a7143ba1d70836c106f14a04899f8e27bb3c422b0e79c37ad7cfaa15c3d2dc4949b575490e78c7e5e

  • /data/data/com.ebcom.ewano/files/AdTraceIoPackageQueue
    Filesize

    1KB

    MD5

    48f9b26842d65985ec29edf711208a8a

    SHA1

    2c70600da314a2f3efb6747a3b16e4e60722f372

    SHA256

    40a9dcb5a5533de81114dbfa62ebdaab03ad87d0808619e4a41b63fbf022982d

    SHA512

    4ef59470773c7f4723a17d743510e1a7d0ab2fa4dd512d165d62072f0c5531199818ae9a19454e05e1c8f1b256252305671699e6a1aec26cce3ed33c50fd4743

  • /data/data/com.ebcom.ewano/files/AdTraceIoPackageQueue
    Filesize

    58B

    MD5

    0d210bfb2a0e1f1b4c082a6a0f79de07

    SHA1

    bb8ed9e364db79d1d9f2fcde3f15091893222faa

    SHA256

    988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

    SHA512

    536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

  • /data/data/com.ebcom.ewano/files/AdTraceIoPackageQueue
    Filesize

    1KB

    MD5

    6bcae904ded5c0b38b4ede0fa0da1135

    SHA1

    2523fbd2cd72cd92fc8c8dedccaa98a1531b0555

    SHA256

    8820207ed355a5ddee959874fc898e02114164c5d2542a18a5ae6f573327a8a1

    SHA512

    f632879abf8d11699a0543fd5e6ac9978eece96f9fbef3ed26fe9cea9a7ab8a4b6d1b60f3e43cc9edfe0739374b773573d1ba0c83bb8d78bfc1b0417ca1a4bc0

  • /data/data/com.ebcom.ewano/files/AdTraceIoPackageQueue
    Filesize

    1016B

    MD5

    a4bb2adadb8700b1e3c5cb5665c6aa95

    SHA1

    aadd5e7e255d08419bbc5ca4e8e75474db464416

    SHA256

    ed05b9962936c150f30ebe517ef682aa5f4364b861ef93a3c8d2b982be0c51f8

    SHA512

    4c99be459b6d26c305211bfc83530316a7fbfd2e4748acce24021aa6f1af404a7bd90c07feb969a6226cce9ca946867d4710823b9ea9764d8f3da0db4f2e8e4c

  • /data/data/com.ebcom.ewano/files/PersistedInstallation6147461547342815878tmp
    Filesize

    567B

    MD5

    a56f6b154f745b5cc92158fb13b1e377

    SHA1

    57c3473eca7a716f699aa26431120ef0a69fa75b

    SHA256

    9751d2f23d1dceff01c88acc4f825b1a91f980a46378d71e924137138cedad6a

    SHA512

    c3d8024837390b7e71ee5c9ce80b1c509ed3d9ab38f5f5a72c18da032697edbf976531979ae7b6ea28e28e7ab14c9f1a0a30fd5c7132f707cac88b2cf2775115

  • /data/data/com.ebcom.ewano/files/PersistedInstallation9183856615333555878tmp
    Filesize

    90B

    MD5

    9a576bd160b02d456013afc56082ff2d

    SHA1

    39a40104976b96e8dcdb3744fa9906ec578761a1

    SHA256

    dedea181ebbf50b97093bb9b86d51a9d8f9d12f0c122a401ef462ad4b3c355b3

    SHA512

    dc7530a583c67cf870a871dc491abc9f7dbd80362ecc43a0d3dc9b93b415d4f90bad4015a7a6003f787b69aef8269e11eb7a29488e0447ff35038114b705a12e