Analysis

  • max time kernel
    49s
  • max time network
    149s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    27/03/2025, 22:16

General

  • Target

    haha.apk

  • Size

    2.1MB

  • MD5

    7513f1e7073f370baaeed7474834599a

  • SHA1

    68889c85521d10d27ca31c20b72c4bb3061ab6a0

  • SHA256

    baa6ffe5ca25c9d67b4944b8f0049a95adf79284236261ee0a6924def87c677c

  • SHA512

    e755a7c98b8753915cab5ae87eaba17f9909972ce20c9ce75de484b5d1cb19568e69aea35306566e149632c0c2d0722df96557cc2c37865590c1af40c29d0148

  • SSDEEP

    49152:C3g92A+0sJLNSCZs55W187bbJbG30TVkSD2YE:R+06NSus55WK73A034

Malware Config

Signatures

Processes

  • eri.etzs.wons
    1⤵
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4351

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/eri.etzs.wons/files/profileInstalled

    Filesize

    24B

    MD5

    1afd43064fe3d20f93cc3a493bc5b5ad

    SHA1

    2307f3693d1a9bec7a1667c1389d22281b294047

    SHA256

    103c76dc5bcec236b9601146eec1dfe1f617a5f72934b46a3f30ee82cc3d2e95

    SHA512

    1a5431c4af040dbc9d4269afbc7c7e6790c61ce63ca5b43193edc3ec4fa7197356641fc1f37b21131defa403acaef0e6ccbf4a7fd0b9607a30037633f1c2f263

  • /data/data/eri.etzs.wons/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    beed7e9345b100e157fe2c4c9f64d9ab

    SHA1

    0faa5f6e20951557b8cf330fbb83d27b18533165

    SHA256

    9b39e13a69239d3c9b1e549c14f69dc1ec2fa9f323cc11cfaf289d5e4ada07c7

    SHA512

    d70467ef62a27bade0c81f872f83b70abb2a564630f490df735f87a09ec9084cde41b1c28801c6560b7f5e1d87f7c95c7cabc636224e24533029a540638fc444

  • /data/misc/profiles/cur/0/eri.etzs.wons/primary.prof

    Filesize

    1KB

    MD5

    f161240cd045c531ecb44c32cee4f442

    SHA1

    d71bbc3aca53bd32acf65e3ca6100b8b719e2dc0

    SHA256

    137c0a1d7d809e36dc3b99d5d2ac2e9c76278092ba08c52a65eeea4ad860e11d

    SHA512

    0001b2c19d4c04a822484ae165ef5d3aeae6d1f823b8f2e9a41a709d57d4f399d0b879f2bde58fbb614bc77168ad4c404cdbe2a7808901a179024fec7db9c378

  • /data/misc/profiles/cur/0/eri.etzs.wons/primary.prof

    Filesize

    1KB

    MD5

    c261687592b8b8ed976e87b0c3e3643b

    SHA1

    6ea69b3da4ba88bbe59e2f15f9d46aff969fa4f5

    SHA256

    9367466843d264b0b0393a32e0086bd87cc4a3bb59afd78ff02b0e4d4e301749

    SHA512

    c02862ccd3d4f486805ad9cdf564686fd4a715732d21d0811c5d25a1739c13523d87f3a87fd3d4b35e5ad5e858363d53c9759f65750d495342eccf2a6c9bc2e2