Analysis
- user interaction
yes - max time kernel
214s - max time network
899s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
- submitted
03/07/2026, 17:22
General
- Target MT Manager v2.26.7.apk
- Size 30.0MB
- Sample260703-vxnfmsc161
- SHA256 cc22b59fbd936bf998c538c722e1ea059a688e3cf7a2a383ddd3bfa4f3145b4c
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
Processes
-
bin.mt.plus1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
-
getprop ro.miui.ui.version.name2⤵
-
-
su -h2⤵
-
-
su --target 12⤵
-
-
magisk -v2⤵
-
-
getprop ro.build.display.id2⤵
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
conscrypt.jar
core-oj.jar
DEBUG.log
01413ad286728c1f4e1d69db17b07bf8488.0.tmp
0a32d879f5e54e50a174145717b07bf7cb8.0.tmp
0ce57feeccaa51fb7deed04b17b07bfb750.0.tmp
0ebf85f5b6f97f1db59c676217b07c018f8.0.tmp
159ebfe9c18a20cc6b6b11ba17b07be4820.0.tmp
176161be900e0e29934afca817b07bd7918.0.tmp
1796cc679753a7f348e8759617b07bed8a8.0.tmp
1c67afad61ff7f55c4b2da3b17b07bf78d0.0.tmp
2d50eba8bb6c1c877acb513e17b07bed8a8.0.tmp
2ea6547d394085da3a515f1c17b07bc1988.0.tmp
31f2d1fb8a9cb6537600cbf417b07bf9428.0.tmp
3481fdfaf807158df2e382fd17b07bf9810.0.tmp
3d04ad33479f53b610da97ff17b07bf7cb8.0.tmp
3d73e98b1ad3bd2575f7a56517b07bc3cb0.0.tmp
3d9111e2d3171bf4882369f417b07c00188.0.tmp
40deb401b9ffe8e1df2f1cc517b07bfbb38.0.tmp
41b3e14268bc8d0ef452b69d17b07bf7100.0.tmp
49b3d7ede8f829c04ca0dbc017b07c11ac8.0.tmp
52120842be753ad61fa0cb7b17b07b81630.0.tmp
55c7b68000043d751cf3e47817b07b86c20.0.tmp
577c8de17839d82220c906de17b07bf78d0.0.tmp
680d03679600f7af0b4c700c17b07c0a598.0.tmp
6a95515622bb664bd610fad617b07bf78d0.0.tmp
6ba589b35cca5ff8f234db6917b07bf78d0.0.tmp
6f17f2d87665322778c5ec0017b07bf7cb8.0.tmp
729f5fd1bce94da8617f218d17b07bf8c58.0.tmp
75c2ed791d51a07cd7b5f00517b07bf8488.0.tmp
76be430c0d7663ea4e6c915217b07b802a8.0.tmp
7a877250e9599c2457e62eb317b07bcc180.0.tmp
7b47e6f85a812b25cb54def917b07bf8870.0.tmp
7c2ff4a4dbaf133ec76a288117b07bfaf80.0.tmp
84402bfea081efe79c20104617b07bbfe30.0.tmp
8de6005c969af36543ed62cb17b07bc34e0.0.tmp
965bbf4d18d205f782c6b84017b07bfbf20.0.tmp
9b87c375505c8ec5bd9db88f17b07bf6d18.0.tmp
9e8df3d0c7c1f50248b6ee0419f2901012e.0.tmp
a6ef3d3be36e3bff34e5a5ac17b07bf6d18.0.tmp
a76a9277307989fc5532984217b07bf7cb8.0.tmp
ab1359306de43320f9557c7917b07bdc350.0.tmp
b56afc43168f7eb3372f773317b07bf7100.0.tmp
c043fc5fc3a78d6da3e1d18e17b07bf6930.0.tmp
c269bce7be08f98da964003917b07bed8a8.0.tmp
c31b32364ce19ca8fcd150a417b07b38638.0.tmp
c35d8c906ba092269db0945e17b07b79548.0.tmp
cad12a2e1fc8489d1d6a42a317b07bf78d0.0.tmp
cbe8c7c25be320d0c6f8847e17b07bce890.0.tmp
ce95eb024d52d10c0fef2b7117b07bcec78.0.tmp
d282cf8ae5517fc65fd3798c17b07bf9040.0.tmp
d6154e7027dfbe132272163717b07b848f8.0.tmp
d6646d1e43983f68f1ac72df17b07be9a28.0.tmp
da1278e9288b7126d21c25d017b07bf78d0.0.tmp
dc8e0c112a5dd240fc1b873717b07bf74e8.0.tmp
e2d5b3f32b79de1d45acd1fa17b07bfa3c8.0.tmp
e307a3f9df9f380ebaf106e117b07bfaf80.0.tmp
e5e110a7ee859f1233d872bc17b07bf7100.0.tmp
ea1c0c58800606a18ecb6c6f17b07bf6160.0.tmp
ea40bffdcd4460aff5578f1c17b07bf80a0.0.tmp
f7aa348215f5d566f9e4ca8617b07c0c0f0.0.tmp
f86206f9ff5ab98f59e7564617b07bf9bf8.0.tmp
f8837c6c14466294960dc54817b07be4ff0.0.tmp
f9ee0578fe1cc94de7482bd417b07c02898.0.tmp
fc704e6b13c4fb26bf5e411f17b07bff5d0.0.tmp
journal
journal.tmp
ua.db
ua.db
ua.db
ua.db
ua.db
ua.db
ua.db-journal
ua.db-journal
ua.db-journal
ua.db-journal
ua.db-journal
ua.db-journal
umeng_zero_cache.db
umeng_zero_cache.db
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
i==1.2.0&&2.26.7_1783099556674_dW5pZnlfbG9ncw== .log
t==9.5.2&&2.26.7_1783099551839_dW5pZnlfbG9ncw== .log
z==1.2.0&&2.26.7_1783099550497_emNmZw== .log
.imprint
.imprint
.imprint
exchangeIdentity.json
exchangeIdentity.json
KJIFWXCJIJEFUQSCLNOFU111.new
KVLVYW2OIVGVCWST.new
KVLVYW2OIVOVSQ2X.new
N5RXE5CYMVWWC2DBKZ6X62TMPB3E2ZLZPJZQ1111.new
N5XW42TKMBMWIZ3HNRRGWUTYNJRGE634PI111111.new
NBUGS3LNM5PGGYDANNSWYVL5MF5HG111.new
NBUGS3LNM5PGGYDANNSWYVLNNFRXO111.new
NN3HQ4L6IV6XSZL5.new
NZRHU63HMRKXQYLJMNSHIZDGLRUHY7CAOF3X47TM.new
NZUXY2SAP55G45TXPR2XSYQ1.new
O55WU3CANZ6GQ62NPV2XCYQ1.new
OV4WQ3SCNJ5GYYTZPR6A1111.new
OZ3HUQBJFEVS6IQ1.new
OZ5GW3KBN56WS6SMMJ4HC73A.new
exid.dat
exid.dat
lib7z.so
1783099366509.log
mtio
profileInstalled
builtIn-abnf.cache
builtIn-asm.cache
builtIn-bat.cache
builtIn-brainfuck.cache
builtIn-c.cache
builtIn-cpp.cache
builtIn-cs.cache
builtIn-css.cache
builtIn-csv.cache
builtIn-dart.cache
builtIn-diff.cache
builtIn-dts.cache
builtIn-glsl.cache
builtIn-go.cache
builtIn-groovy.cache
builtIn-hlsl.cache
builtIn-html.cache
builtIn-jasm.cache
builtIn-java.cache
builtIn-js.cache
builtIn-json.cache
builtIn-kotlin.cache
builtIn-latex.cache
builtIn-lua.cache
builtIn-lyrics.cache
builtIn-markdown.cache
builtIn-mtd.cache
builtIn-mtl.cache
builtIn-mtsx.cache
builtIn-nix.cache
builtIn-php.cache
builtIn-power_shell.cache
builtIn-prop.cache
builtIn-python.cache
builtIn-rust.cache
builtIn-shell.cache
builtIn-smali.cache
builtIn-sql.cache
builtIn-svg.cache
builtIn-swift.cache
builtIn-toml.cache
builtIn-ts.cache
builtIn-vb.cache
builtIn-xml.cache
builtIn-yml.cache
builtIn-zig.cache
builtins.cache
internal-arsc_translation_editor.cache
internal-arsc_translation_item.cache
internal-common_passwords.cache
internal-folder_cmp.cache
internal-regex.cache
internal-regex_replacement.cache
internal-smali_old.cache
styles.cache
umeng_it.cache
umeng_it.cache