05ec45735db9d58d3991941cff56d25ba6ae26dd300b2c1250aca093e68843d1

Resubmissions

20-09-2023 15:26

230920-svpvksha9x 7

19-09-2023 21:51

230919-1qy7fscb8y 7

Analysis

max time kernel
2943293s
max time network
82s
platform
android_x86
resource
android-x86-arm-20230831-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230831-enlocale:en-usos:android-9-x86system
submitted
19-09-2023 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xManager.apk
Size

9.1MB
MD5

15e16125c1cd2e4eda8058dc1b957362
SHA1

4649e99fccb758e34be68ccaed63db1053c8337a
SHA256

05ec45735db9d58d3991941cff56d25ba6ae26dd300b2c1250aca093e68843d1
SHA512

e1cfcde3ef453045aa267cdf2ea48ffc6e80cfd054c9dfc5ed0edddfedae61d8bfb12389e248ae44ee4f6cbd408b97befcae368d8e23a0ea3ad2985e9bac219a
SSDEEP

98304:1g4OD3plY2bl11NHC77QE7j01xkgnk3Jx+V0L0QUllb/JGxBbSg64kA/32d2ZrC6:1cD3p5l1zC7D01xXnaxjLalmBR6yxrOm

Score

7^/10

evasion ransomware

Malware Config

Signatures

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.xc3fff0e.xmanager/cache/1613498354782.jar	4348	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xc3fff0e.xmanager/cache/1613498354782.jar --output-vdex-fd=118 --oat-fd=119 --oat-location=/data/user/0/com.xc3fff0e.xmanager/cache/oat/x86/1613498354782.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xc3fff0e.xmanager/cache/1613498354782.jar	4171	com.xc3fff0e.xmanager

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.xc3fff0e.xmanager

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xc3fff0e.xmanager

com.xc3fff0e.xmanager
1⤵
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4171
- logcat -c
  2⤵
  PID:4200
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xc3fff0e.xmanager/cache/1613498354782.jar --output-vdex-fd=118 --oat-fd=119 --oat-location=/data/user/0/com.xc3fff0e.xmanager/cache/oat/x86/1613498354782.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xc3fff0e.xmanager/cache/1613498354782.jar

Filesize
9KB

MD5
2c84bc0c28d4ac333d267f7a152b4039

SHA1
49e67f04004587ae351d5aba4da5f18644746864

SHA256
1eea5584eb2332554753b4beec7fe8e972bfb3eeadbe0c05dba33de267f25a00

SHA512
44ab6c390cac8b11bf43097293ef73bb620b1466fd671a945639198ea10dea425a0c9443b47752cc0a6689a6f5a7661b35f7a8a350ffcba30a72be60d5f18abd

Download Submit
/data/data/com.xc3fff0e.xmanager/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.xc3fff0e.xmanager/cache/oat/1613498354782.jar.cur.prof

Filesize
156B

MD5
c064af9c3111621a531c9aed816a83db

SHA1
d9cf4c8500c328bf40dfd196b1eaec1e4dfab526

SHA256
49f018e34ebf079675b1de71e802881bbd9971db7fa941fad1b12dd8abb604a9

SHA512
dd0d303d6b7ad280ff22a0fc1626228f7686c39e37e85ec69dec232b00c56088fa855fc4e66b4cc93f411b243462322e4fd6513c666981659ad774be793af89d

Download Submit
/data/data/com.xc3fff0e.xmanager/cache/volley/-1661412709-2019316947

Filesize
69KB

MD5
2d50bb8be28e5bb230213f8a1bb9d4f3

SHA1
68bd0b0966212a5d4ed99e7f9a11c2207fd23f03

SHA256
31fdaa7739acff9b2d0d33d725efac1778e5397476a06393eb257342164f8941

SHA512
4f9d1ac3cdd18e1b3a4a5464192b5a18155bd5bab9451266bf6caf49e322c1f68fc13d0075ee5d0ba43d0e41422eb98f66800757559aafffe4318e3c76089459

Download Submit
/data/user/0/com.xc3fff0e.xmanager/cache/1613498354782.jar

Filesize
21KB

MD5
e06dd4fe2e90d133b141da7b4ed16eca

SHA1
d3da2591d29fdc480cd998711e2abe67b5cf2ca8

SHA256
29777214e781973439fe2871490d1d40e84a75128a0ea9b6864ea1da6efe3496

SHA512
73f6d5feb7b72709e32292343673b00ac6131af883250fb044256526a5942fb70f30545bd275affc45a506347e7b0a1b571c914f90c46059f5401e4298b486f4

Download Submit
/data/user/0/com.xc3fff0e.xmanager/cache/1613498354782.jar

Filesize
21KB

MD5
86ce3683020b3f28f4110aac9c769ff7

SHA1
876e0686440524927639a4797b2f13b12a26ce4a

SHA256
be852340e03b169a28811d1ff41582d19638d9fc0540f237ecb960c45bd07071

SHA512
04d03a9963ba49adf5d0d26a21b57e85e21416fcc3d479ce7522149d45f5ab630ff78e590e724695fe29850b08b4dccfa5051daf5d4e4afd9384f7183f887ddc

Download Submit