Analysis

  • max time kernel
    65s
  • max time network
    154s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    11/05/2026, 13:31

General

  • Target
    mt-manager-2-26-4.apk
  • Size 28.8MB
  • Sample260511-qsj57sa18w
  • SHA256 d012e52c7f45559e3afe71225cb6b909c808bbc2a768675cd5414d08180580b0
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • bin.mt.plus
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about active data network
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4811
    • getprop ro.miui.ui.version.name
      2⤵
        PID:4849
      • sh
        2⤵
          PID:4894
          • id -u
            3⤵
              PID:4911

        Network

              MITRE ATT&CK Mobile v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              core-oj.jar

              • Path /apex/com.android.art/javalib/core-oj.jar
              • Size 4.7MB
              • SHA256 4df590b764f65c16b51176ff394458d0b3a866ca75a4f912d6f76b7793043c1c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db

              • Path /data/data/bin.mt.plus/databases/ua.db
              • Size 40KB
              • SHA256 be504aa1d103250fa666635a2fd58ef366c8fd4a80d9b9ced1a068aab7a03480
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db

              • Path /data/data/bin.mt.plus/databases/ua.db
              • Size 24KB
              • SHA256 f91c2cde51f7ed18e5bbccda7d61b12666270ba8ea7e0572113337294881dad2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db

              • Path /data/data/bin.mt.plus/databases/ua.db
              • Size 32KB
              • SHA256 9ad9fca47a3dfb1d37f6f1a491dbb6fee4aeb320c72cafa373c206d6ab511412
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db

              • Path /data/data/bin.mt.plus/databases/ua.db
              • Size 36KB
              • SHA256 f3042ca231ba589a29cc63287ec1ba97c8ec04dcee5b6ac2a928355f234fc97d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db-journal

              • Path /data/data/bin.mt.plus/databases/ua.db-journal
              • Size 512B
              • SHA256 e46f800a9f24c77db5faf7b224e56c1487632f9c7f855bacae8abfcb2dff9e07
              • MD5 SHA1 SHA512

              ua.db-journal

              • Path /data/data/bin.mt.plus/databases/ua.db-journal
              • Size 8KB
              • SHA256 4214726261b8c54f75d19ee04008fbeaa8139d9b48f1c239a1a3cfea3964e047
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db-journal

              • Path /data/data/bin.mt.plus/databases/ua.db-journal
              • Size 8KB
              • SHA256 595f70e89d2d51b1e3bd865e6eb6e2afe5cf3c07ec42c78e52bb4c6e8dfde8bd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db-journal

              • Path /data/data/bin.mt.plus/databases/ua.db-journal
              • Size 12KB
              • SHA256 7123de34986f6daff8aebf8c841ca7116f1d19e078e820b4d3b230305836d29b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db-journal

              • Path /data/data/bin.mt.plus/databases/ua.db-journal
              • Size 16KB
              • SHA256 11ef5729088c681daedc70506467ebeacdc0a7c35f30b15106d4faea5cdcf982
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ua.db-journal

              • Path /data/data/bin.mt.plus/databases/ua.db-journal
              • Size 16KB
              • SHA256 8b8ffddce59f5858adbadee25a35463badaa34f57b00cfab9619b14ed8b4b2b3
              • MD5 SHA1 SHA512 SSDEEP TLSH

              OJZHG53XPVCHS6T2OF7XMT3HPNQGS111.new

              • Path /data/data/bin.mt.plus/files/default.ini/OJZHG53XPVCHS6T2OF7XMT3HPNQGS111.new
              • Size 7B
              • SHA256 f6b152542fbee2749ec6a0edd66a885f912a2b680d2c99fc7e41ec3762b234df
              • MD5 SHA1 SHA512

              OJZHG53XPVCHS6T2OF7XMT3XON4W2111.new

              • Path /data/data/bin.mt.plus/files/default.ini/OJZHG53XPVCHS6T2OF7XMT3XON4W2111.new
              • Size 1KB
              • SHA256 1e7fb76fa8f6ffd279c86099c72c2d3497b78a0c9423ad603ecb985d17e37095
              • MD5 SHA1 SHA512 TLSH

              OV2XI4DQPJBX47L5OZ4HCSDCOB4HQYLGMA111111.new

              • Path /data/data/bin.mt.plus/files/default.ini/OV2XI4DQPJBX47L5OZ4HCSDCOB4HQYLGMA111111.new
              • Size 7B
              • SHA256 a6872b166d03d6b3fe89fa626bd7770b8342d060bfa1a25648237b28c16bd245
              • MD5 SHA1 SHA512

              lib7z.so

              • Path /data/data/bin.mt.plus/files/lib7z.so
              • Size 3.2MB
              • SHA256 1ffb7302d2cd28d4c6ee4c0114ca46fe93870a13cc830da556619de4cbd3c1cc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              1778506315150.log

              • Path /data/data/bin.mt.plus/files/log/1778506315150.log
              • Size 4KB
              • SHA256 9ef5b2a91d1499dd59b3dba0204394c00b385fb3f01d90389d2579d719091cec
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-abnf.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-abnf.cache
              • Size 1KB
              • SHA256 85a4aa9fa76b670c48a6108d8bd996e3e47b18056565c57d546b83f22a98b97f
              • MD5 SHA1 SHA512 TLSH

              builtIn-asm.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-asm.cache
              • Size 3KB
              • SHA256 fe322eeaf7b468fb75e95553af8290901bf06ebde213bd96b9f00dbd7348a6c8
              • MD5 SHA1 SHA512 TLSH

              builtIn-bat.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-bat.cache
              • Size 5KB
              • SHA256 74cdcb5dede39eb981163ce74c96d08a12b2c84b9a37aa8d06e78c0595cda3ab
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-brainfuck.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-brainfuck.cache
              • Size 3KB
              • SHA256 0893a19cb7730530d5040e30be8a7ddcadf4b76232bac0b9051617d558f0ede3
              • MD5 SHA1 SHA512 TLSH

              builtIn-c.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-c.cache
              • Size 4KB
              • SHA256 fd74326711b890de09ff57dd0449fcc9ef14b4e87c7a5329c86229d23b55d0d1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-cpp.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-cpp.cache
              • Size 8KB
              • SHA256 3d07c841d4ba3b42cbaf6a776f79419e7195493866db843fc3059dc34c629c72
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-cs.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-cs.cache
              • Size 3KB
              • SHA256 46c80569fc01e2682e46dc09634ede1eca1468761f878a01fba5f33b300a9c3a
              • MD5 SHA1 SHA512 TLSH

              builtIn-css.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-css.cache
              • Size 45KB
              • SHA256 f381d581eb4baf5c06be2420430f9f7e401a9021be079834ec586b807b007871
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-csv.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-csv.cache
              • Size 326B
              • SHA256 31d65b145869bb02dce2734c9d02d992a3166e1adb4b9c22e2653ae0c2ee4210
              • MD5 SHA1 SHA512 TLSH

              builtIn-dart.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-dart.cache
              • Size 6KB
              • SHA256 eeb93f006480ae2952e79be665b83a773e02f1b1e974373d765dc34b886859f5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-diff.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-diff.cache
              • Size 4KB
              • SHA256 f60fcacb7d0e42bbe944cd06d305f66e5f6e2b22b42c32506d526139821065c6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-dts.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-dts.cache
              • Size 7KB
              • SHA256 3a826bdeddb25697938192bb0b2c6a2ef5ea2d2ba80d829383fdbdf1b7498153
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-glsl.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-glsl.cache
              • Size 10KB
              • SHA256 6fed863ac3efa3884bbff466ded10afcc6d0325887d54644b592f026ee09af16
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-go.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-go.cache
              • Size 5KB
              • SHA256 05ecbf01e274bfae5b5b72928cf644f003c8464f0c2a02abbf778c78daa7d06e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-groovy.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-groovy.cache
              • Size 3KB
              • SHA256 980f3b7aa98bb63e555acb3188ef50624afeb66c33eb03f0427608419a1d9acf
              • MD5 SHA1 SHA512 TLSH

              builtIn-hlsl.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-hlsl.cache
              • Size 7KB
              • SHA256 9bc1d9264b6c96cd8d47f5f535404b44672e294637ecfc5f5b0a63947452e963
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-html.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-html.cache
              • Size 7KB
              • SHA256 d9a8edb377cff06675f7cbb833d390c65d33e79033478afa6261e5f3fb9c2230
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-jasm.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-jasm.cache
              • Size 17KB
              • SHA256 bf74bfb5f0356b900b243839f42e0b0b055992400f3fe4ffb3dd41b9b299794b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-java.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-java.cache
              • Size 3KB
              • SHA256 cb5f3c922bb1166eec371902f4cbc3c696e8af7fde86056ed8a36875536732ce
              • MD5 SHA1 SHA512 TLSH

              builtIn-js.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-js.cache
              • Size 4KB
              • SHA256 81da38f3f6d4ecbe372bd6c939243d063a7dcef31417e92aea9c78ed836c6624
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-json.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-json.cache
              • Size 2KB
              • SHA256 c27bac00927db4dca3dfb23082810ab726d04d763d9d68f169b72e5a4fe50f36
              • MD5 SHA1 SHA512 TLSH

              builtIn-kotlin.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-kotlin.cache
              • Size 1KB
              • SHA256 d4aa68ae2a62513fc3d7892ff9017877efe0137b89266249c7ed24052949cb47
              • MD5 SHA1 SHA512 TLSH

              builtIn-latex.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-latex.cache
              • Size 14KB
              • SHA256 ad5099fef5d360fa33e0d263cb82ebd34457e9fc850cb2c86c9743085b44f70f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-lua.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-lua.cache
              • Size 1KB
              • SHA256 16ce313a1a6d25105870b19228f1f01fe9306088cb81b0ece24c9a23cf276e3d
              • MD5 SHA1 SHA512 TLSH

              builtIn-lyrics.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-lyrics.cache
              • Size 1KB
              • SHA256 bd7dbda8d191fa01ce467ceaa784d32bd09216cba5f8e6a73f9311a28795dc30
              • MD5 SHA1 SHA512 TLSH

              builtIn-markdown.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-markdown.cache
              • Size 26KB
              • SHA256 2c5394f93c0927f163493acfe708e1f25ee8d7dbaba222d09e8d2e383efcaf05
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-mtd.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-mtd.cache
              • Size 1KB
              • SHA256 6301f01572a6a177eadc00c5c5d2fac132bbd232072d03c142d80dc74555d300
              • MD5 SHA1 SHA512 TLSH

              builtIn-mtl.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-mtl.cache
              • Size 1KB
              • SHA256 f9ffdb41721679295b37456ce2ad977d7dc00f6dba7aa6a4c310a6f59d80b82c
              • MD5 SHA1 SHA512 TLSH

              builtIn-mtsx.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-mtsx.cache
              • Size 7KB
              • SHA256 961406d2ad0be798550c044a19969cdbfde4456cdb0b83c407793bef18372e81
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-nix.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-nix.cache
              • Size 3KB
              • SHA256 668f1c871a2924666d6412b6c88b289be46bdc1bd23089361b637ae2ef6e1784
              • MD5 SHA1 SHA512 TLSH

              builtIn-php.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-php.cache
              • Size 3KB
              • SHA256 ae7cabe3d688111af1168ed093973d2536c2121d10a028930895171557725ed7
              • MD5 SHA1 SHA512 TLSH

              builtIn-power_shell.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-power_shell.cache
              • Size 2KB
              • SHA256 79f40e08d827c533c54a158617a6f519ab52d4242ed402c1d091312a62450fff
              • MD5 SHA1 SHA512 TLSH

              builtIn-prop.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-prop.cache
              • Size 647B
              • SHA256 356506c44d8d53e56bf6554ff9da97c7d4c377251cc59c1fd54d2817dd92c4af
              • MD5 SHA1 SHA512 TLSH

              builtIn-python.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-python.cache
              • Size 30KB
              • SHA256 f3e4a610d97706961813a584a03d468f33cb815296643c6ba0ee008455a7236a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-rust.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-rust.cache
              • Size 33KB
              • SHA256 ad102dc4ba37efa8a58de74d9f9012563e0e41d417e0a4d67e74c667d6391785
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-shell.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-shell.cache
              • Size 10KB
              • SHA256 aad61c28fda3420db31a3013ca7f9704c2e67d082ec2aef25d88f67837bc9116
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-smali.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-smali.cache
              • Size 10KB
              • SHA256 781e537cae3d017ba10ffef34fe6e953b68197d97f4cebc6b3c2f1f99c9dd2b7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-sql.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-sql.cache
              • Size 9KB
              • SHA256 f47fdf6548dda62da139baf44f615a71f068518c2dc94855ea4c04d789e27cd9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-svg.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-svg.cache
              • Size 4KB
              • SHA256 f4fb3bae06316e8ab1f2b9dc0fa637f2785955c5bd12e955eb433bb45bae5d7e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-swift.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-swift.cache
              • Size 12KB
              • SHA256 59ab14b9846788c9057a63ae239d56c0a0ad2c89ead5ca413d81a1e3f3acbc6a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-toml.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-toml.cache
              • Size 7KB
              • SHA256 6276ef60bc77a099e4c8d7ad62b56597c18824cdbfdbc10a87e0880c1ea82da1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-ts.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-ts.cache
              • Size 3KB
              • SHA256 b061d68f0e48eedb70cfaabe28faee43c0f2c8f69899f9da094d920fae344223
              • MD5 SHA1 SHA512 TLSH

              builtIn-vb.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-vb.cache
              • Size 10KB
              • SHA256 2abff890311b4088eece001b950a07e65e54ec15274c5bbdeae6c18829bc18ea
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-xml.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-xml.cache
              • Size 4KB
              • SHA256 a68bccc6a3837c0df6b95446bc8ce5e57a4fb4364a0bf8f8827ea36eea5f39ee
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtIn-yml.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-yml.cache
              • Size 930B
              • SHA256 fec20dc1ef4875e6153d01f32004b1d896ec503cef114c645d42e61e2b7445f5
              • MD5 SHA1 SHA512 TLSH

              builtIn-zig.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtIn-zig.cache
              • Size 6KB
              • SHA256 8c692c06c64cc7cd70e17b0f2248ef9d27975828b6ce05386939315e96bb6c1a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              builtins.cache

              • Path /data/data/bin.mt.plus/files/syntax/builtins.cache
              • Size 5KB
              • SHA256 5cb1e7103be38e01fa589edbc910fe1a9d02faa602dbc154bd01f983530d9483
              • MD5 SHA1 SHA512 SSDEEP TLSH

              internal-arsc_translation_editor.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-arsc_translation_editor.cache
              • Size 3KB
              • SHA256 2d2d2e961aca8885812852f7415726b78ecd59f9d7ada607cd01c52e96faaebd
              • MD5 SHA1 SHA512 TLSH

              internal-arsc_translation_item.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-arsc_translation_item.cache
              • Size 1KB
              • SHA256 a6d3500c1bd1b34c7878b1fcfae3b3f823883d9801ec467d1a43e44bbf72c983
              • MD5 SHA1 SHA512 TLSH

              internal-common_passwords.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-common_passwords.cache
              • Size 1KB
              • SHA256 b429cdf4afeb3e86650fcb65e1b73d3002c82018b7993be9d0823c3d9a9ec664
              • MD5 SHA1 SHA512 TLSH

              internal-folder_cmp.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-folder_cmp.cache
              • Size 357B
              • SHA256 8b674bd09dfd16ba6bf488730ad49b7162acc80a9ff9a51c4b88c27cfd1dd124
              • MD5 SHA1 SHA512 TLSH

              internal-regex.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-regex.cache
              • Size 3KB
              • SHA256 6037805255c7820925ff9c53f4bb7e68d2919a3fcd310e2d9df74b36a13f1ccf
              • MD5 SHA1 SHA512 TLSH

              internal-regex_replacement.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-regex_replacement.cache
              • Size 1KB
              • SHA256 aba21ab0c3a000e07d6accb9539e0fced36796c4d4d9f0e96bd1ae8bd637ddef
              • MD5 SHA1 SHA512 TLSH

              internal-smali_old.cache

              • Path /data/data/bin.mt.plus/files/syntax/internal-smali_old.cache
              • Size 7KB
              • SHA256 ed9c9682a775cd6708a64c44340ada8defbdd13d7da726f1a47e2692b219b65b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              styles.cache

              • Path /data/data/bin.mt.plus/files/syntax/styles.cache
              • Size 1KB
              • SHA256 428256f47aa52e6b6f77997ed2866aeb23f16e38b291dda2d6ff6dc766fac666
              • MD5 SHA1 SHA512 TLSH

              androidx.window.sidecar.jar

              • Path /system_ext/framework/androidx.window.sidecar.jar
              • Size 12KB
              • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
              • MD5 SHA1 SHA512 SSDEEP TLSH