Analysis
-
max time kernel
899s -
max time network
744s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system -
submitted
10-10-2024 12:59
Static task
static1
Behavioral task
behavioral1
Sample
xManager.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
xManager.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
xManager.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
xManager.apk
-
Size
9.6MB
-
MD5
b6a14a183748d5c5ea8f332ad7704265
-
SHA1
fdefb5e5f4d2de0fa6fe8583376d23d6fd7f8f9c
-
SHA256
901eae37c506484e432c8dd3d96b8cc52063cca98dfc65e7318545d0ac90369c
-
SHA512
b1621f7e37e8dbd7a8f834a86eac24f4224ea29a69c414c20752316889c4ac85d2e341833a648d24ed03c9c452125917cee58d8b2a8674cb8dab256af8d897e5
-
SSDEEP
196608:pI3O/AEIo/pBp7GKwMVztF7MwVUVMaC8X2Pf33:pJ/86bx7Vz77Mwnw2Pf33
Malware Config
Signatures
-
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xc3fff0e.xmanager -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.xc3fff0e.xmanager -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.xc3fff0e.xmanager -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.xc3fff0e.xmanager -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.xc3fff0e.xmanager -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.xc3fff0e.xmanager
Processes
-
com.xc3fff0e.xmanager1⤵
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4333
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD52c84bc0c28d4ac333d267f7a152b4039
SHA149e67f04004587ae351d5aba4da5f18644746864
SHA2561eea5584eb2332554753b4beec7fe8e972bfb3eeadbe0c05dba33de267f25a00
SHA51244ab6c390cac8b11bf43097293ef73bb620b1466fd671a945639198ea10dea425a0c9443b47752cc0a6689a6f5a7661b35f7a8a350ffcba30a72be60d5f18abd
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56