4d5945fb2ce177a0f8e12489f8b0b4fed528fe060f79543ad8c6a93261b89380

Analysis

max time kernel
46s
max time network
153s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
31/08/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mts.apk
Size 11.9MB
Sample260831-cjanhstcnf
SHA256 4d5945fb2ce177a0f8e12489f8b0b4fed528fe060f79543ad8c6a93261b89380
MD5 e31cfabc7992fbf494581de869305d17
SHA1 3b73b931cef1dcad46539ca0db210dc0507875dc
SHA512 b941860a5ab10dbc7b2d383e6dd95d5ea64d455dd3f00f4f33a64980d666203f904a3ed943b301376a4139a0d4f9e08fb6823d5bb199a557a3de5e706b2225de
SSDEEP 98304:ETXP1gN0u9AETfML7EmMqNo0IS3aKxm53TYC254iFbEjBIMTYrdD:EPKN35Df53TYI+
TLSH
T18BC6AE53EB568C32D2BE5335ACBA831477316D96B7836F431644B4A87CB32C09F992D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4849	vn.mangu.hal.jw
/system_ext/framework/androidx.window.sidecar.jar	4849	vn.mangu.hal.jw

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	vn.mangu.hal.jw

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	vn.mangu.hal.jw

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	vn.mangu.hal.jw

vn.mangu.hal.jw
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks CPU information
- Checks memory information
PID:4849

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/vn.mangu.hal.jw/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 53a0cc10350764114db61ac5003428215dc146406e6bc1101945a3abb090d832
MD5 82fa9a8f9aaa3ace6081a289b3688564
SHA1 eedb99d612277b6abf71113622b1446099ea556c
SHA512 06579966568e9f4be511b4ce83015e20a7f4f5cec589a7f6653ff523627ed717281858cc0b94f63dcd7c2605d8e0197fb87c92537892706a03b8ab6d75287b65
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/vn.mangu.hal.jw/primary.prof
Size 3KB
SHA256 fbe74642028a18c149fdeb380fddb77abf4444742abc34fc05e152df0b7c2832
MD5 62e978a2b419f7a9e9c2988556f3ec8b
SHA1 c3ca8885e4b807998ad49fa318d8cb30f52c9fcb
SHA512 e7a24a03d89661719bbbe23756d70fd1712e9c9783faf6e0ed21a511d45e6bb223f572680b7105b8715918ab9797a1b5ac878a974e37dd2f50ac54c8e9340134
TLSH
T14B713A8837913EE896784A5BE14721EE907EB606A53FDE04D836B32D0015C38296B39A
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/vn.mangu.hal.jw/primary.prof
Size 6KB
SHA256 cd3b9aafbeb280890d226bc5b4991de27eb82e66467ec25b03625d7f1b2bff6a
MD5 eb31ab218fdcc19177b1d2895bfc6d21
SHA1 6b55c73f7552280b78b03b28da20790869bc0c47
SHA512 45242fb98996306af1a4cfe674f7f586a0f65715384816b93305c6f4fe0e2483619357090b7028ef997426c4189dada49bc1b3d5290ff2fdef77faf9d3e2ca54
SSDEEP 192:nKLj3t7l5AKahPkIm4NCNWbQ9YR7k5ZoI8GjCNy17:UhfahPkImTTr3rGNe
TLSH
T1A0E17EED144428EB3656EA5A2106BB9FDEC858AAF5B0C4D0050FF3308639C588FF961A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 12KB
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
TLSH
T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads