c2da3df534ece06c4e87d60ae4690f4c58a9b6d3d05a45898181123201c1d8d9

Analysis

user interaction
yes
max time kernel
36s
max time network
37s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
12/10/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
manager.apk
Size 4.3MB
Sample261012-ewxd6aas8k
SHA256 c2da3df534ece06c4e87d60ae4690f4c58a9b6d3d05a45898181123201c1d8d9
MD5 02a2ff9e69d85de4dad105213f620382
SHA1 690396a68222724daff6622715643cfa48ce5940
SHA512 041c83686150960f2a5373f6a84a58d0361e0374b6947cd5c0071ca5fbc11569aefaf614831085a1412146431eab96ef76893792aede0c4f820a7c170e28ea23
SSDEEP 98304:AAU5ofra3s1A/YOkmr8R9OobyFB9Uiwyt7JsXFI:qkCYS+Fbq9Ure6X+
TLSH
T10526CE97F7689A2ECC7200F2495E6632624B4D528E47D7837C44371C387B6E82F89BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.vanced.manager
/system/xbin/su	com.vanced.manager

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.vanced.manager

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.vanced.manager

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.vanced.manager

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.vanced.manager

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.vanced.manager

com.vanced.manager
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4218

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.vanced.manager/databases/com.google.android.datatransport.events
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.vanced.manager/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 25b89c5af7dd6616f2557f41feeb39b4bc60319375ca335027ed97ad1cecefb2
MD5 193780c1c0005971167ccdc474dadcd9
SHA1 6fc982170bd49044fbd7befcf2b3c08eb1a3e3a1
SHA512 0f137a9f3af65c6bff30beda5686e0829f769db9d109bb1dd00436c118cc739938f9b5768f32426d88ff71dd6ffca0d7fc07c91bab617b524687e4b33dc571b4
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-shm

Path /data/data/com.vanced.manager/databases/com.google.android.datatransport.events-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-wal

Path /data/data/com.vanced.manager/databases/com.google.android.datatransport.events-wal
Size 136KB
SHA256 7f364adbc16eb5d29cc9aa504ab4b8d79c760fa2df2a04663a12a859f6b66877
MD5 1c141cf345abc4f8abed6b1c4e6d3e2b
SHA1 fe3421a88bb8d747ba74f21ba998da39caa8f386
SHA512 e2364659b45af63dfd57818c232ab9c72ca4e54a3a418b2592a7493d5e5a550c9e854599b11cc0b2ef2a268faa8388b2685da377f3f8459dba25798a2e0100c3
SSDEEP 96:n0PJt3KMEX0xIyNYMaPLxL1EjvbBjb8bvxLCbEjLT/bvxLoxMHuxbEjc98dbvNZ4:wX32CapFZYbhbsmaxM+MZqdb1Q9bpH
TLSH
T1A5D3EB4EFA300DB3C259AF39DE5196A03B3D76DE556367111BD818613C882968F72CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db
Size 16KB
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
SSDEEP 6:l9FCls1ulO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TgEu9zmzrfRmBEyPbBvOwk3
TLSH
T16772C2CE9F102647C6660377B4CAE3916DA4A12D872BEB472BA50464AE42609A861F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db
Size 16KB
SHA256 3eb58258567fd6bb0d79b4a702c614c6b3aa9c495df7fbb4b732c4414705aef0
MD5 4d6fadbd5fbb3fdf9bf4a73e3cbd30dc
SHA1 44d515221a80ff6a3e5185e7a4dd1701af13afda
SHA512 cc6c309888f059120115ebf6c5c7cd6bcdc581a3731bd973f7e3366cf09fa5c118994b9809e57f7f00bb6fd85815bd4ecc806fe0bf1976411b69021990d680bb
SSDEEP 3:qqb/NjghzY+/lzyliMlTXmqBLNllBnl4fzMlklKllgIn:LCM+/lulvl6q9NllBnl4fQlrf
TLSH
T1027212C13281C706F53B873492C79FF21830B2847E12C11A7802230C6C822C11A16717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db
Size 16KB
SHA256 a8809ebf981724ff770613b2618634d5723ac0889d2a802733268f2cede075f3
MD5 3544a997cec767fd57e7fb13d55fb841
SHA1 e127583d764d116ed9cc8509c19d53e143560e4b
SHA512 7d6577113a4ecf9950df555c52fa4018b2cd183c96f48a8ec757f804b26db5b7e9e179696461c9521e121d9e890a335d59fc8436179511b2996aba67a39efb09
SSDEEP 6:rLP/gEhV71m/9blDqlrElvlXPlll7Qlr2ENllrCM+/lulvl6q9NllBnl4fQlrf:rr/gW49blqYFlfl/8d+/0Fl6mh7
TLSH
T14A72A7D13265C706FA3B4F3891C7EBD2343931561B13C11578037B0C29873C21525B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db
Size 16KB
SHA256 f12dd9edca0cd2e6e05b017b75bb1d71d42ef4674c67d81f633e7877acf28b4d
MD5 268dad2cd479be972604f47e46db88fd
SHA1 3055887fded9b5b884f2c70e56de6fcb86f03787
SHA512 5d06c367071170a58356b92af7059c3bb7d88d23db143513e2bb7e94ed0eb6de05123f923fc96cac5d306ddcae29ab32007790c1ec66ca93d18a70e077f61c6d
SSDEEP 12:qolhOLauAUZw2qc7UyWl4l2749blqYFlfl/8d+/0Fl6mh7:qovKaufEWY7499FRl0lFf
TLSH
T1E572E58071A8C716FAB74E3841E3EFD2353930B24B13D21678066B0D69423828521B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db
Size 16KB
SHA256 8144b4ca2fc2f2e0a9a375d49d80395ef6b66c3b65cb5048db36e4762046b998
MD5 f15900c09cc835b8f3548fff883b420a
SHA1 3dcc8812843820dd74626cfa5421cd5a140c764a
SHA512 b3ca5bab788ce805b6b3032690b8d0fd157116efd8e073b1e04ce6a7f6dbd52c3b7c444fa00dd57436b732027e55321d733d1f95d8e447c96a651dd8927ade8b
SSDEEP 12:a6olhOLauAUZw2qc7UyWl4l2749blqYFlfl/8d+/0Fl6mhv:a6ovKaufEWY7499FRl0lF7
TLSH
T11172E5C072A8C712FAB74E3C81E3EFC2353930B34B13D21638026B0D29423828131B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db
Size 16KB
SHA256 c06d8a49dd3f2df5e688278a012d5ac73b32c2551ee4f5bb9f38865111c8d64b
MD5 3514034537f26ed843dfaf4f25d8e3d5
SHA1 87664b0044449f58edce0bba5f7fd158e688f8b0
SHA512 14d981b327e455af534a0527738ff17021197af19532f2d13131e65e373e7c192ccdc5f64f9ccadb6759682cafe5d0ff84330be449979437442f5cf4cac357d2
SSDEEP 3:o1zr3r3bX6lXUl+/:oH3r3Wy
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/com.vanced.manager/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 c2546653961cf04f391c17979d110bb585dfca5df027aaa71d63f7b7b221ff7f
MD5 35cf1ae6c693a598589ed33e3398f0b7
SHA1 f76eb91a28135f6b6be57f56f162ed1d12e2ac26
SHA512 83624bd06d6ae04c5a68a9e3aec32785a331bbd4754c72fd5078688e7789a2af4b9e95a21e040b9b436ebd36cc993ac5ed76a01a3a9f0a2aa488458faf7956ec
MD5 SHA1 SHA512

Submit Download