Analysis
- max time kernel
24s - max time network
151s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
19/05/2026, 00:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Semar123_2_1_6.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Semar123_2_1_6.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Semar123_2_1_6.apk
Resource
android-x64-arm64-20260325-en
5 signatures
150 seconds
General
- Target Semar123_2_1_6.apk
- Size 4.3MB
- Sample260519-ag7jcset2w
- SHA256 28e26c38965142c54ee0d7eff5a64bc47de6dcea642fcdd5e82ea3c5398c52d8
- MD5 5c368c1f4dc79fe238b939d850c76621
- SHA1 a33763ba0a7bba8f9a72c71ea503aa190d69ff6d
- SHA512 2e1705813b218a97982f48a4ae694e524631379431a8a991a6964673c26ab277a961742d024ce5dc3b474799818f45709aa61878596f809c21040848686a89ad
- SSDEEP 98304:45vCJYKpDI3Bv2YQ9Rli1TDa35PkEv4AYxkkuNw+loWpxXBbPcObT/mCDTAN:0vCLO3sBmDapPl4INw+TRLcWD2
- TLSH T1A9261282F7696E2FCCB7C0321A9A533562969E22C743E707145837A8387BBD80F597D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ozzo.Semar123 - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ozzo.Semar123 - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.ozzo.Semar123 - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.ozzo.Semar123 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.ozzo.Semar123 - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.ozzo.Semar123
Processes
-
com.ozzo.Semar1231⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5090
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.ozzo.Semar123/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- TLSH T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.ozzo.Semar123/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 f2e2a87122b0c9c3c1fa43ad5b3daed776081f19b045250b3ea375799d76b0d9
- MD5 dcb25925adf03dd6bfffd6e59f9df10b
- SHA1 818a6b4a93e1bc2211161e2b025f8b99681a9ace
- SHA512 a946cfd5ed5ef6128b2e20adc8a75e6bb6cf4d71a258d41f71a9f2ff2177722c6c45b769644f303f3cb42bbd7b36309717a05c7674d8bdd61df615ffdee381af
- MD5 SHA1 SHA512
- Path /data/data/com.ozzo.Semar123/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.ozzo.Semar123/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 e0f24200e83cd06c2ffbd59097a58d18a9121f1d63ae56d0741006c0ee050ab0
- MD5 61ce415ee7ac0e4ec46555d288671dcf
- SHA1 d06757a0241086c4258ece1b634cb53aba1588e4
- SHA512 cedeab8bc0b7484848a7c4b6ff5ea18a188cd45e9c6bb2a3100c414424867ac1c61d2260b273807b99e9bb261498b8d0c0d7b0d6eaae71e76bd105c395a0da9b
- SSDEEP 6:K80twop4Qv9FZdrlOERX4PBX4ogLugMBX4suuK+/GgP1tolWOw2:Krtwop3lzdTRmBEyPbP/RPHVOw2
- TLSH T1F272C29AB3801912E329C23650CFC3239E6163389F52EB4B172114557C027CC9470D88
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.ozzo.Semar123/no_backup/androidx.work.workdb-wal
- Size 112KB
- SHA256 e943bec57266a957c89783ceb2e42ad74fd7848093cfd949d46246151f0fb0e4
- MD5 abcf3a47d968c3ae65536518fdcd4a98
- SHA1 2fa1a472e9be5f8cdd48e3dec7e2c1c9bc528b6e
- SHA512 c9022a870ba948d83bbcbd1d9419f03cd33412e271318bad2fc273910855b3d7e073870287b67278e85d1fbf505cfbd941c1018598b5389963c1861f35d44e35
- SSDEEP 96:erzvVaWaDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:erzv0/ndjnHt9S/f8JzSV+6D86T0ED
- TLSH T1B7B3218E1F592500C4B9A4B0A5D50FB2B93E473E8B93F3D266910075EDC2925D939CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/com.ozzo.Semar123/no_backup/androidx.work.workdb-wal
- Size 120KB
- SHA256 7c7218ca52a95652b01f25dd34640aef854faceb3cf2f5f49dc90c84baf92026
- MD5 d95aa6c9cb0e4b2c7b1f6020e54854df
- SHA1 cca9f2335756a987c5e3130a5dc337568008b668
- SHA512 fc79078c9842c0acfed2b2b793e465db5c1f250f005f6a630ae02bc3dc09b8f393c5c538d26306a014946cbeb7b747a087d912a9118c1d92612ae67cd8b6334a
- SSDEEP 3:R5LDW5tkqywzXtRKVjWLd/ml65uHS9h0XllgoqKXtRKVjWn:O5tF72VUd/mxyf0p2Vq
- TLSH T1E1C392E737550462E221E7BDFD2F96AFA002DB205ACC79B2A72E1AB06E143C84674094
- MD5 SHA1 SHA512 SSDEEP TLSH