761545a64df744abb4bdf1ca01ef571bfebc7296fd1716d6da0598339ebabe6f

General

Target
Jos129_2_1_6.apk
Size 4.3MB
Sample260626-alcjsaf12s
SHA256 761545a64df744abb4bdf1ca01ef571bfebc7296fd1716d6da0598339ebabe6f
MD5 39b4e9bab6fe1ad8de635726a3b3b094
SHA1 498289b78f80d85495e6384533a343df527834a1
SHA512 542978da547cb49e730d0e3207fd8d8cd24425b1e59eaec970447fa48e339825a2db53f5796060fd6a169a0dcf5196d1bac9299db81d73007ad2c2f0af605910
SSDEEP 98304:6gZTDkcN9dXSQ5RyHflu5yksUphdlui4sY1lW76bPc+I/mdDTR5:7Bge6HfYoAzwedGLcQDv
TLSH
T1D7261283F769AE2FC8B3C1361A9A433152529E56C743E70B141837A938BBBD80F957D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.Jos129

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Jos129

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ozzo.Jos129

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ozzo.Jos129

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Jos129

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Jos129

com.ozzo.Jos129
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5082

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Jos129/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Jos129/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 70134e5580fb0272e096d4afa1c798bad390ef83d3dbeead796500b076123c96
MD5 a3a4327ec354f2a63ee46c4053eb9748
SHA1 27e5177ae2da587a06bf1e252561053a94cd3f88
SHA512 edd532e7b854877dca25577e79d5f1b5a7f6585d9a24a64cb19f5c5b49ae9a745206dd541a282c2b1988acb9475dcdcb1b78530d892fd6baa3b339705ea12045
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Jos129/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Jos129/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 5afabe1f5f5586968578b77179b2cf5584b8ec52790191fc94cfff603e5df428
MD5 d5113084f683a90d94fe8a38fb97df73
SHA1 05844aa26b961b8c40bd2c76253970402bc158c9
SHA512 b99d6aed4fdc082aa87016120af4e52693a50aef92ab6b246cffd75dc65b0e5240027f3e89dc3448471a677048971d6324503141fa7443f15513d357e752a214
SSDEEP 6:Kyj8WRY0J9FZdrlOERX4PBX4ogLugMBX4suuK+/WfZlVOw2:KrW60XzdTRmBEyPbP/2FOw2
TLSH
T19472C29D53818523C0C9027260C4C30B8DB2A68FCB53C70B169E3C646F136889E61F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Jos129/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 cf7b51c40e3d8a2f696a50fd5802e43d247dd09dc20126ef79ba974f1aba6ab8
MD5 7376b6df84881516fde0e3a8657c349c
SHA1 e9dc3140fb2108431f7557ac00440e1cb7f1ae7f
SHA512 af2e543d59de65866c54cb93fdfe0f0e381c5b688802fac2b040bd084fb92aaef0bf2b02274f90ce1406836a1738d3df1b8a4af4ecf202b45f34c7f1119f604b
SSDEEP 96:VcNWmDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:VmTndjnHt9S/f8JzSV+6D86T0ED
TLSH
T16AB321CE0F592500C0ED64B0A5D00FE2BD7E812EDB93E3D265921475AEC3921DE29DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Jos129/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 fbee0c5a0a128afe8cfec220573e36824bce04f0bd1ca4a26334576036ca5863
MD5 73704a41aacd4c70a09f928457cf9454
SHA1 18b8516b6d665af7b040c0d01cc6c4d6e2d8e327
SHA512 1382196cd391acc053dca4ece3a2477ca93d5696ff19e6bb77c4b541968d9bedf64f75c5d1025f2a351725bb40540e9204cdcc619c17a0f15d655157edb2e709
SSDEEP 3:Rg/Ixyzol/OwzXtRKVjWIvk/lClShyA9iFwtd0XllgoqKXtRKVjWn:GQxvB72V/kA8L9wq0p2Vq
TLSH
T1A2C392FB2B19A822C49007F8ECAB6ADA9C12CD8998CCAC73650F6DA02E023850620254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads