eaffe035c34659cf961f706f9c8c32d7bfdf79094b8aa6be4f741807186e4f31

Analysis

max time kernel
47s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
02/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sultan_2_1_6.apk
Size 4.3MB
Sample260802-wtly3syepf
SHA256 eaffe035c34659cf961f706f9c8c32d7bfdf79094b8aa6be4f741807186e4f31
MD5 ee9b9d1de0930815b243fecd3a71b2ec
SHA1 d59cdf63a55498ce85eda3b707bc54c37b7ed5e3
SHA512 579a6341386dca6e4a805b15dd80d8a6a5d58be61bcb2a1bf420475aa66ee2d1a91dcd457ec37f2773fe8f3a0d4fbfe61d01ef685d0e1b33957b551788e5b5d7
SSDEEP 98304:T+tbuKEZTHJALUT3WMPPOSkte1zw6R55MpCKkCGiJKwTLkjaDEbPc09/mbDTY/:adEZD3NXOSK0w6RuGi5TYOELc1D8
TLSH
T102261252F769AE2FCCBBC1320E9A433152429D26CB53E74764583B683877AD80F897D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.Sultan

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Sultan

Checks the presence of a debugger
defense_evasion

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Sultan

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Sultan

com.ozzo.Sultan
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4770

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Sultan/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Sultan/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 92315969051ce9e31b085b8057d28ee281b48f2f82c6f8880af1801413be9fd6
MD5 b5c18977f2bf1af25c6bcb7fb7bac5a7
SHA1 42f9e367b17de1298fa8b3ffde43673d24e9a63c
SHA512 3148ce3a7e0092d9b776c94b9d94ed4c80df175a09b011c2a7b591cf09e25810193bc853667b7b83e912d0050abbf7ec13b59c466c29164226d0c8cfb49e6d73
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Sultan/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Sultan/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 934cd5583ed6f7444117e55a237a4f3a20c9670ddf484b8ef840cdae16ff81f6
MD5 4ebd626f02458ea0393a13e8050519cf
SHA1 3af8c6a2ec83bed86927e47a323c79003ba2319d
SHA512 da7a387863cdcd11817943a6fab20f2a904d33bbeaeab1a6416934301d31c7fff8c9cc3d5509b00ac352913bb5cbd27cf5c2ff1cab4d0072ba9a218fc5965ac5
SSDEEP 6:KahQRcntsaQR6zlMy9FZde/kPlOERX4PBX4ogLugMBX4suuK+/0QRChd/iAglAWD:KAXllzdeWRmBEyPbP/qf2iOw2
TLSH
T16372C258ABC22912C54C3A3750C487054D6052982FD2CF0B378116272C427FE54B0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Sultan/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 bbfb85c4682f809f58b21517f7aa1defb5914517bac6e1fb05dee417da56f77b
MD5 d33cd008b07a994c9c29f867244c1bcd
SHA1 d1aedae1e025548cdc12e2f4ac6f76b4dfd00ece
SHA512 f37001cc661a97431b42ddf432e492a13af7982270f1eae19550a4611f547c1a6d59b23bf4ce3babb19505ef1ae26bb780e0aa1db4b13e5eb355e0b8621d1574
SSDEEP 96:X24WkDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:m4xndjnHt9S/f8JzSV+6D86T0ED
TLSH
T11FB3028D0F9A3600C0ED78B095900FA1793E412E9BD3E7D575914176ADD2932ED39CF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads