Analysis
- max time kernel
147s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
08/08/2026, 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Mentoz4D.apk
Resource
android-x86-arm-20260325-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mentoz4D.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Mentoz4D.apk
Resource
android-x64-arm64-20260325-en
4 signatures
150 seconds
General
- Target Mentoz4D.apk
- Size 3.0MB
- Sample260808-bjkytafj7x
- SHA256 268afec2ae409f824061aa119426854186fe095db9b0e8c2e417f7a0dd9b0401
- MD5 2318914aeb24335886cacd2ec99fe15e
- SHA1 1b674b0d10887784beca2daf1a6d5330876fd96e
- SHA512 6e23ddb061892722f86d4d51edaa690aa87707a8894b09d6407fc15a4a0e257804afc960c23f0a27261607813882445b8214f719eb5a419ee27a04d961b505c6
- SSDEEP 98304:vEmYbZqgor7v00vSxDeAT2dQ0586njv8zxwh1:v2UgkjMD3ifpjvUS
- TLSH T1EDE51282EF65D92EC87B44370DA6033022169E6ECA96974785EC362C6C776D40FE9FD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.p4d_mentoz4d.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.p4d_mentoz4d.app - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.p4d_mentoz4d.app - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.p4d_mentoz4d.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.p4d_mentoz4d.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.p4d_mentoz4d.app
Processes
-
com.p4d_mentoz4d.app1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5083
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.p4d_mentoz4d.app/files/profileInstalled
- Size 24B
- SHA256 413d59f54a323de32aabb561d7d2009f99153c195a7ba9ad0eb18b7578938f8d
- MD5 00e8da2aeac04c925316d75ff1312e44
- SHA1 713bbea852243e1c0fd96d33e972f999f8b0593c
- SHA512 4a34c4c5bed790d301443252b135b7a878e79dd373d0ab4d5a887cf64c3a9f670b34d870ff26b4d53dbefa3f5be661bef6423cecef9dd18e528e27a516bda3f0
- MD5 SHA1 SHA512
- Path /data/data/com.p4d_mentoz4d.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 cd8f1008c3b9671b46f78b98777dd2bbab29ea6524c3602a18abdf342ec1160f
- MD5 1a295fe0bc5691a9497d85b7dbc7894b
- SHA1 5a66cc5e6bf79ff3cec4ee65475ca1a0db3cfc02
- SHA512 2ea9470cd4bf184e87a938c36a84aaff9d2f055926e037a1b9623745bd360e08a5298b45b56b32c97bd4721526fe3886daa32978b5cafff4f4488e1be0d4e630
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.p4d_mentoz4d.app/primary.prof
- Size 2KB
- SHA256 98838ddf660b7390d9cbd6f5b95cd3080ac21212dd2bf9f4d44a6496f4eda9e6
- MD5 39e7c23731521c8f85ee56fb65e40fd6
- SHA1 02da14aaf1e5cf34f234c52d35deba412233bdbf
- SHA512 d018c52ddaf73bc0c41f8438aa39a3495d7990453814c225676be2fe674d9a34d82aaea16373800f36207e0ee3d2afbf828cb2e8e99e637e8c76908291f69e5b
- TLSH T1E6415EF255013511C0DC6067ED389746E4CB71D004BAE7F5A16AD9784403BE4E5C8BAF
- MD5 SHA1 SHA512 TLSH
- Path /data/misc/profiles/cur/0/com.p4d_mentoz4d.app/primary.prof
- Size 5KB
- SHA256 b0dfe8bef0bf3f875e900011cefd83431ebbcd9185700924902cc687e1ac417f
- MD5 47e8832ebd471c51afc2548407bec658
- SHA1 32704089f42c1cb71148b3c4c6c96a3ddc088156
- SHA512 6d25027f80af8da16a87d8793d8e9d51f9c50277c1672ab910b0bda889fa0c526c78d90cf3d1e9837544658d41aec98fdaaea6e940ed45df661165eed47f0750
- SSDEEP 96:ZkKnTRkppnlHdcgdWFBAlt7c9UlOqvI3RimHFhcmW9Cy7RiKKHJGK80703:ZkKTRezdcSmBAI9isRiKQ07703
- TLSH T1F2C19E31F630EB964109652DBECEB920CF8D39CE9383345A234A49CF1275FB8305A759
- MD5 SHA1 SHA512 SSDEEP TLSH