aab65c7f923ac6e6e243c8d97f730cb293223e662f2d0dc87bdb73f7e96c21a8

Analysis

max time kernel
108s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
26/06/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tapir328_2.1.6.apk
Size 4.3MB
Sample260626-w4232sdz21
SHA256 aab65c7f923ac6e6e243c8d97f730cb293223e662f2d0dc87bdb73f7e96c21a8
MD5 66b284d71a860a73ce990ebc350aef11
SHA1 01583df5b9a9c1a9fb4b4412a7eacd401005557c
SHA512 081bb1719a785bd99dc7b52263a933d72e8fce153ed8eef296441ca7b42a06bf24b9015dd526c7dfedd14122ad2db252f33cb0bb963e977e387bc9c5b86a8865
SSDEEP 98304:N37rivFN7pXa0RnMPUyGZWWGD7nctH6MasbPc6LR/mjDTGX:N37rmHJDRnMP2ZW1naasLcPD6
TLSH
T1B7261242F7699A2FC8B7C1321EAA533552968E26C743E7072458376C387BBE40F997C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.Tapir328

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Tapir328

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Tapir328

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Tapir328

com.ozzo.Tapir328
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4730

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Tapir328/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Tapir328/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 068ea758555c9a1dc553a2acbb55b536af714df1b7c46faf73ca0658a6091171
MD5 b5efcfbddd3a290fe49c4ec3fa5b88bd
SHA1 fe5c2baa4c29f422c4dad1675fb1a7495a96e354
SHA512 de5c75e84efcffcc88929dcfac843e5f1ca28e3af5697a657b12cd6690af3f652c21a080ae455b579eb13df42ffb79b38f8fd0eca6d6b8830186fa12360a87b8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Tapir328/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Tapir328/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 46b992f16818336388bddce1373f5fee607642f10bd82b9373db0eea5ae453dd
MD5 7acc866ab47cd767509b2d06e99c4337
SHA1 c819894b2cb522e01f7d71d0802c5301af1e15e8
SHA512 6e62391e13ba5593a03ed0be4caefd4fc34705ccd7a04e27c85d9ef0bd5158d62692b1be33ddc327b3da1c1218bfebecc59a39830d2953432a6a97e77ee06cc9
SSDEEP 12:KwPdhGXzdeWRmBEyPbP/+CLcG8Rl84OiOw2:KwSzKGSP/vBElJ2
TLSH
T17372C26AE3900913CA2B423B64CC83500E3073197B32C79F5A933516BC022C8A558D4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Tapir328/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 c69b736f0e651ccf72659d9523648635e6cd6aa6a3e7ac02177d0177e0b1b214
MD5 fdab4a67ee76c88588fd7d68903a9790
SHA1 a0e73074ca42c7d7493ab8c8c83fd4ce2ba313ad
SHA512 52c06fd32f18727aeb4260e7cf05e0533bf41b2ad7c591f94d6c9e05eb2e38e273f05652db7087632c8a6677e863abedee1f9f09f5cc2b34277b43306f6477cf
SSDEEP 96:hp2wWQDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:jlFndjnHt9S/f8JzSV+6D86T0ED
TLSH
T16DB3538E4F6D2600C4BA64B191D00FA1793E532EE7A3E3E129921075BDC2921DD29CFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads