Analysis
- user interaction
yes - max time kernel
79s - max time network
886s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
- submitted
03/07/2026, 17:22
General
- Target MT Manager v2.26.7.apk
- Size 30.0MB
- Sample260703-vxnfmsc161
- SHA256 cc22b59fbd936bf998c538c722e1ea059a688e3cf7a2a383ddd3bfa4f3145b4c
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks CPU information 2 TTPs 1 IoCs
Processes
-
bin.mt.plus1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
-
getprop ro.miui.ui.version.name2⤵
-
-
sh2⤵
-
id -u3⤵
-
-
-
getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.build.display.id2⤵
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
core-oj.jar
01413ad286728c1f4e1d69db17c57ba65b0.0.tmp
0a32d879f5e54e50a174145717c57ba6998.0.tmp
0ce57feeccaa51fb7deed04b17c57baa048.0.tmp
0ebf85f5b6f97f1db59c676217c57bad310.0.tmp
159ebfe9c18a20cc6b6b11ba17c57b992c0.0.tmp
31f2d1fb8a9cb6537600cbf417c57ba8108.0.tmp
3481fdfaf807158df2e382fd17c57ba9878.0.tmp
3d04ad33479f53b610da97ff17c57ba6998.0.tmp
3d73e98b1ad3bd2575f7a56517c57b85a40.0.tmp
3d9111e2d3171bf4882369f417c57bafe08.0.tmp
40deb401b9ffe8e1df2f1cc517c57babba0.0.tmp
41b3e14268bc8d0ef452b69d17c57b86dc8.0.tmp
49b3d7ede8f829c04ca0dbc017c57bc9060.0.tmp
52120842be753ad61fa0cb7b17c57b45ad0.0.tmp
55c7b68000043d751cf3e47817c57b47df8.0.tmp
5734e8eb49b4234b62f913f817c57b020c8.0.tmp
577c8de17839d82220c906de17c57ba65b0.0.tmp
680d03679600f7af0b4c700c17c57bbd0f8.0.tmp
6f17f2d87665322778c5ec0017c57ba61c8.0.tmp
729f5fd1bce94da8617f218d17c57ba8108.0.tmp
75c2ed791d51a07cd7b5f00517c57ba7938.0.tmp
76be430c0d7663ea4e6c915217c57b44b30.0.tmp
7a877250e9599c2457e62eb317c57b85270.0.tmp
7b47e6f85a812b25cb54def917c57ba84f0.0.tmp
7c2ff4a4dbaf133ec76a288117c57ba6d80.0.tmp
801c3494cc30bc6d6153677617c57baa430.0.tmp
84402bfea081efe79c20104617c57b996a8.0.tmp
8a2581a3f4a313bef35129bf17c57ba61c8.0.tmp
8de6005c969af36543ed62cb17c57b8db28.0.tmp
965bbf4d18d205f782c6b84017c57baafe8.0.tmp
9e8df3d0c7c1f50248b6ee0419f2900ff39.0.tmp
a1202a63f5df5ae4ca780f6a0.0.tmp
a4e0c7b0f0a7cb587d46bee217c57b76040.0.tmp
a6ef3d3be36e3bff34e5a5ac17c57ba6d80.0.tmp
a76a9277307989fc5532984217c57ba6d80.0.tmp
ab1359306de43320f9557c790.0.tmp
af127cd2724e3e44d1f9db7d17c57ba7d20.0.tmp
b56afc43168f7eb3372f773317c57ba61c8.0.tmp
c269bce7be08f98da964003917c57b9bdb8.0.tmp
c31b32364ce19ca8fcd150a417c57b992c0.0.tmp
c35d8c906ba092269db0945e17c57b42808.0.tmp
cad12a2e1fc8489d1d6a42a317c57ba6998.0.tmp
cbe8c7c25be320d0c6f8847e17c57b020c8.0.tmp
ce95eb024d52d10c0fef2b7117c57b98ed8.0.tmp
d282cf8ae5517fc65fd3798c17c57ba7938.0.tmp
d6154e7027dfbe132272163717c57b49180.0.tmp
da1278e9288b7126d21c25d017c57ba65b0.0.tmp
e2d5b3f32b79de1d45acd1fa17c57ba9878.0.tmp
e307a3f9df9f380ebaf106e117c57ba9c60.0.tmp
e5e110a7ee859f1233d872bc17c57ba61c8.0.tmp
eeff4a78dc207af7e30a9ba617c57b98af0.0.tmp
f7aa348215f5d566f9e4ca8617c57bb7ef0.0.tmp
f8837c6c14466294960dc54817c57b87598.0.tmp
f9ee0578fe1cc94de7482bd417c57bb1578.0.tmp
fc704e6b13c4fb26bf5e411f17c57baac00.0.tmp
journal
journal.tmp
ua.db
ua.db
ua.db
ua.db
ua.db
ua.db
ua.db-journal
ua.db-journal
ua.db-journal
ua.db-journal
ua.db-journal
ua.db-journal
umeng_zero_cache.db
umeng_zero_cache.db
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
umeng_zero_cache.db-journal
i==1.2.0&&2.26.7_1783099414585_dW5pZnlfbG9ncw== .log
t==9.5.2&&2.26.7_1783099409664_dW5pZnlfbG9ncw== .log
z==1.2.0&&2.26.7_1783099408058_emNmZw== .log
.imprint
.imprint
.imprint
exchangeIdentity.json
exchangeIdentity.json
J5GUMQKUL5DUGWKN.new
J5GUMQKUL5LUWQCJ.new
JBFECRSTLBJEAWCYIFDEA111.new
N5RXE5CYOBQHM6DDMZTA1111.new
NRQHC523OVTXGYCWPBRGWZL2.new
NRWGAWRTGMYTONQ1.new
NVQXA5S2ORTHEYKXM5XWW6A1.new
OFWGE23EL5TWG73H.new
OJZHG53XPVCHS6T2OF7XMT3HPNQGS111.new
OJZHG53XPVCHS6T2OF7XMT3XON4W2111.new
OR4GAYL5PZHWE63TPF7G47T4IZZGMZS2NNWWIZDW.new
ORZWM4C2MVQHI3DNMZXWG6A1.new
OV2XI4DQPJBX47L5OZ4HCSDCOB4HQYLGMA111111.new
OV4WQ3SCP53XW4T3JRTWK4DWMJWFO73DMBUQ1111.new
exid.dat
exid.dat
lib7z.so
1783099364143.log
osmd
builtIn-abnf.cache
builtIn-asm.cache
builtIn-bat.cache
builtIn-brainfuck.cache
builtIn-c.cache
builtIn-cpp.cache
builtIn-cs.cache
builtIn-css.cache
builtIn-csv.cache
builtIn-dart.cache
builtIn-diff.cache
builtIn-dts.cache
builtIn-glsl.cache
builtIn-go.cache
builtIn-groovy.cache
builtIn-hlsl.cache
builtIn-html.cache
builtIn-jasm.cache
builtIn-java.cache
builtIn-js.cache
builtIn-json.cache
builtIn-kotlin.cache
builtIn-latex.cache
builtIn-lua.cache
builtIn-lyrics.cache
builtIn-markdown.cache
builtIn-mtd.cache
builtIn-mtl.cache
builtIn-mtsx.cache
builtIn-nix.cache
builtIn-php.cache
builtIn-power_shell.cache
builtIn-prop.cache
builtIn-python.cache
builtIn-rust.cache
builtIn-shell.cache
builtIn-smali.cache
builtIn-sql.cache
builtIn-svg.cache
builtIn-swift.cache
builtIn-toml.cache
builtIn-ts.cache
builtIn-vb.cache
builtIn-xml.cache
builtIn-yml.cache
builtIn-zig.cache
builtins.cache
internal-arsc_translation_editor.cache
internal-arsc_translation_item.cache
internal-common_passwords.cache
internal-folder_cmp.cache
internal-regex.cache
internal-regex_replacement.cache
internal-smali_old.cache
styles.cache
umeng_it.cache
umeng_it.cache
androidx.window.sidecar.jar