f4a46be30210c179f60f0668ee3618fe90a6de22d9fee53ac80c972d310e91a8

General

Target
Vivo_2_1_6.apk
Size 4.3MB
Sample260728-ppb5rawfkd
SHA256 f4a46be30210c179f60f0668ee3618fe90a6de22d9fee53ac80c972d310e91a8
MD5 9432db2f1e8214dfedab8427bcdb6553
SHA1 87b679b0cc4724b898c60d276454224bb6bc0fcf
SHA512 8335d8ddd47d5e0955290652af11acbfcbe953dbba813e35aa1d1055853043543ac4935d163c1da4ccd56c78ce69238a59e73791e3149df371e0aa14d0e164f1
SSDEEP 98304:8jCO/swXo3Oh9uQ05o5b8kNB/advlah2AfOuDkvubPcxL/mODTju:8G2LHhEFoak0vqOOeuLcPD2
TLSH
T1F7261292F7696E2FC8B7C032198A433412529E26C753EB0B2468376D3C77AD80F5A7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.Vivo

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Vivo

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ozzo.Vivo

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ozzo.Vivo

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Vivo

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Vivo

com.ozzo.Vivo
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5059

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Vivo/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Vivo/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 3473d70fede5be06f9fc53fec1d994e67d886f7e9c314426ae3af5721ba7840d
MD5 f43066d2a77071847b84e8c2792227bc
SHA1 af2b4f0b144b3130f4e07eecf821f1d0c1a6e116
SHA512 55b57c4ca8b93d6c914c625976c6e4daa44a702c7b68ec10652d676b171410e770ceba36002270677ed8b194d00097b58742ab18716fc2d42f90c497833cfdbf
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Vivo/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Vivo/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 fa9894ff0091d0734315330c4435a211ff973982ee0c8357035ab758525657dc
MD5 349a7f937a8c48ca4c6033f732c396a8
SHA1 9015bfdd5fc47f4069d0b638592c712e6e599475
SHA512 fa4eb9c98074843bfa7b615eaaf93daf3d08957813ea213f2a53fb96be727fba2f725836a6d834f52604c2ea5c538826d5c381c42c47606d002cdb4ccc90f1a2
SSDEEP 6:KKiBaOY9FZdrlOERX4PBX4ogLugMBX4suuK+/QJKMKN5zIggOw2:Kl1izdTRmBEyPbP/cbW5zmOw2
TLSH
T14F722B5D53615DA3CD17177751E4C351ADB0AE39D356C72F572028707E1738892A0D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Vivo/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 2a88dc9f92f596b7863a5b081cb26a43b2c0d5c49fe9965f1d8eda71b5d2d415
MD5 fc13b0bab4f385348c552b32f9d30a3e
SHA1 6706209757cef413c6ecc1fbef744156d8dc6132
SHA512 62700e58396e7a35f40d83f96a574564889a76a8458c6881449089baf9e6b9a981b97b6f814ef8bdb1b22b1a5ff21bb3bcb740e085264847d445a246598258af
SSDEEP 96:CuFMWpDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:CpEndjnHt9S/f8JzSV+6D86T0ED
TLSH
T1E6B3028D0F6D2900C4AA54B0D6D00FB1B97E453D9393E3E365A11075AFE3A21DE25CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Vivo/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 e74f30792584e1c7476647bb6416c4cfb462c9da88a0f545312294b26c86c2b4
MD5 b71d2d6098dfbae3c145dab55518a4de
SHA1 1b5f38e49474a31bdc90dfa2e75672715e0732d2
SHA512 7fd6a72d4107a27275529ce6ca53a134986a3abca63f0aa3965c7d09fde87011ad8a3d8fdae299181f22a7ea62ea0f120fbbea8dde482c9d504f477e4d085ed5
SSDEEP 3:Rlr2TtOVpHwzXtRKVjWIl4aNHln2+jc0XllgoqKXtRKVjWn:WTtU+72Vzl4GF290p2Vq
TLSH
T149C39BE737740823C4621778FB6B67984001CD1080C49D77C53D19F529117441120008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads