Analysis
- max time kernel
141s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
17/05/2026, 00:12
General
- Target manji.apk
- Size 110KB
- Sample260517-ahpd6set6m
- SHA256 5fa602bdd9f6156629e7b8ef4ac87b7c3f903a812ec63e7988fb343cfa36bc89
- MD5 91b9ef36703d674c56d28dc53b06b8a8
- SHA1 146a489133f8d55167dd789142b3b257c697d6c6
- SHA512 0437048559244e419ceda48d434142d3221db6ed9e738e83fc1b0894fb93b78df4699fde36a144267d56ac6d411231ada2e68a2e1be3d3a1da6617dbcb3417ec
- SSDEEP 3072:+s+2xqV2gOxnvfGK6EjS9LxZ2gaOl7xVjhCX699fJ0Q0g6mzkRf:+s+pSRveK6EjSlxQgaOl7xVIX6fH0iQR
- TLSH T134B30946A9429B12D5C631FAFBAF414933136FB8E3FA7111D9205F6023C69DB0EB7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 20 IoCs
Traces itself to prevent debugging attempts
pid Process 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk 816 manji.apk - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uhttpd 816 manji.apk Changes the process name, possibly in an attempt to hide itself ksoftirqd 816 manji.apk - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo manji.apk -
description ioc Process File opened for reading /proc/mounts manji.apk File opened for reading /proc/self/status manji.apk