ec4bb99a0fb78a65de0e48a2bbb7f2e4bfb14a7d8123be273f16349e7f063e05

General

Target
Sakura_2_1_6.apk
Size 4.3MB
Sample260721-plfc1atthv
SHA256 ec4bb99a0fb78a65de0e48a2bbb7f2e4bfb14a7d8123be273f16349e7f063e05
MD5 36971203648c663854216b0c47e43733
SHA1 928818cc2e4980778dc8e751a1615b455f7a3d0c
SHA512 16539e5cdf530a5323dcd5480007565c5043a1228157b7dce72e6a8742b000588ee02e25a9b6c0d2706e2165bb11ae520882244cd4eb3ea279979604e5df077c
SSDEEP 98304:UShnDQuC3Ccn4bxV8t5sHMPi3sYH9e0Z+Y8NLNd9bPczs/mrDT/9:fQuC3kube3sKeup8NBd9LcTD5
TLSH
T1E5261283F72AAA2FC8B7C1361A9A533112968E26C743EB475458776C38777E40F897C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.Sakura

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Sakura

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ozzo.Sakura

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ozzo.Sakura

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Sakura

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Sakura

com.ozzo.Sakura
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5082

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Sakura/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Sakura/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 65c9cabc1849c919e0571b8f62cfbef4cb211f69d3f2e762ea39ad2eb1a764e7
MD5 939a5eaf0b8879b3a3341db04e19318a
SHA1 3bc5001aa9968ea729401b1015b93d5885a3b5d0
SHA512 aad6fb78823f8dd4598a075651c024ed24f540102ccfef0d55af9516a3d9943d49207e1a9f6e7da933565c1c5c606884e77be626dd14e9ac62f5437c5c947aa7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Sakura/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Sakura/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 46eacc1d154607abd779fd2b3e37d411e0cd31461df3e035920ba16b6f7961e4
MD5 098b2caa5c374444995150cfa3b7d51c
SHA1 584e942f97150a707a6ed40d16e5c49cea3e91d8
SHA512 e42ec542fbba07d950c1f68ee5660a13f368066abbb0cdeaeaa0573e787c27dd120d7b95a2d01827a7d64e173648906dba72854e9c3c98c83c92abdbaa2d4170
SSDEEP 6:K8Obpv9FZdrlOERX4PBX4ogLugMBX4suuK+/aHjeHwKt+Ow2:K8gXzdTRmBEyPbP/aSQKt+Ow2
TLSH
T15C72C25493982963CF144676A0AAC30B0F60E6384316CB4F12950D547C03AEC75D0E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Sakura/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 3e227eaf467a1fe3eda518d5d0dcb3cbd81e1cb95c369ae72802b99c8ce35ac2
MD5 c94a9a225b4e55e53c88c7283c08c7f1
SHA1 32a9c897616687f83953cefcc32d36cf84a9e2c8
SHA512 4e4199832b3d7689c759cd4b5fed00bddce0ddec3ebbcb081906e8846c0f6c8e458ca5745d3dded4e470605834c004de49bf4c776cdca0d7a64f78a361547a48
SSDEEP 96:7boWjDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:7boendjnHt9S/f8JzSV+6D86T0ED
TLSH
T167B3228D0F6D3500C6A958B0E4A00AA27E3E453D9393E3D565910875ADC3931EEA9CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Sakura/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 afd976201922c805b8f39d497846c7a72e0a0758338f565744b399ef385577f0
MD5 87935603f9b55577012729a582677614
SHA1 68d3af4c267917ffa63415f97ca7d734ee3d4108
SHA512 14bbad1900f46e64cece88a253a6d989ad1e00c63a2d6e4f72ba724ee6d3b873c94ff10d51b0da3261c2f3d10c907379b06e16a859a50c9163c6a69963155f42
SSDEEP 3:RuxrmcwzXtRKVjWVVl+/HE6wLd0XllgoqKXtRKVjWn:IEH72Vul+/HEVh0p2Vq
TLSH
T127C39BF337292413C7155B7CED3B55DD5612CD5441D45DB645090D651D017D415A4005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads