656f28e25d3b3f30c46c2ee44ff1a4dd1871c43407e954e4ef1b63225f72d2fd

Resubmissions

04/08/2026, 11:08

260804-m8na1saa877

04/08/2026, 10:56

260804-m1s7astyas6

Analysis

max time kernel
46s
max time network
899s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
04/08/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OziBot-5.0.5.apk
Size 2.6MB
Sample260804-m8na1saa87
SHA256 656f28e25d3b3f30c46c2ee44ff1a4dd1871c43407e954e4ef1b63225f72d2fd
MD5 96350b3df632bb748ec92cd87efa7bc0
SHA1 5e6e80cb02a876c98e866e06abded7a2f37a403d
SHA512 490b6013909e6571e296cd86eda8130df54d007dc2fd40a4e05b777a911e206669d92ae58df01529057a186ed798a296ab6765d3a420ab0fcdb3d10acc923210
SSDEEP 49152:zbEXtC8ZTxR6AZvHz+crtFVgVSPoTwrFC:8dCGnjZvKc51oTwrFC
TLSH
T136D5AEC6F7D95D2EC87710B6CD6A52F6A6574C0386439F83A9443B1C287B6D80F89BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

impact

Malware Config

Signatures

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ozonbot.shifter

com.ozonbot.shifter
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:5077

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/com.ozonbot.shifter/files/profileInstalled
Size 24B
SHA256 19198273d2321851c140aa2ca7281bcb652707e6c247ba2cceee852a348f0fec
MD5 4aa27a252d27a7e91ec86660029c03d2
SHA1 49931fe7b10290cee7c24d16364c7794ea911a41
SHA512 c48ce70eee81860a6e0da9c172b9ee88f1f035b512a0542ca42512deb65b94d09c9e052afc61ff24c0b81f49f43fd8c1d72f23fb9d9c71c86cdc672c91bb7ae0
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.ozonbot.shifter/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 91e9620625deb5071b90fde9f6d6350e56a36f99a755c0e84c9cf7beb11de28c
MD5 5be3ad14641e8570a29dd0aad3309e86
SHA1 f1bf660fff96330b6356586ebffe9cbfe31b7351
SHA512 503d362924ed596ce02ae9daae6a121e1c7c5cb641618b4b1360c1a3b34fd3fd399d810cc4f26ca8b8d205793335e6b0413d7bb5583d95ecf1ba78170af2cb5f
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.ozonbot.shifter/primary.prof
Size 1KB
SHA256 37e3a03199871f8c17304442975cae304d032fb8591d50bd33b9a2604a9e4541
MD5 d0c426d6c52dea8ca360edbb54d0b005
SHA1 c33c81ea975677b396b86e2a009b55297a51f15e
SHA512 18047c68a4f7ada853ec9e66f8b2625a30cb8f09da1fc175046bfee651066dd31592c6427c57de5887e77e53a2a69dc2e5c6b1ada06e5e5f49ecf6846d1d081f
TLSH
T167210B6667F752F155244D5074D32F821CC4BE1322E5869A640D10F59AD17945C1A379
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.ozonbot.shifter/primary.prof
Size 3KB
SHA256 eb6e500dd046cbbcbdf20404950d36d9ba50fe0b7a2448045c03877251808cc9
MD5 461e33fa59cac4576d3fe3e5ffa34064
SHA1 69327be4b9ee0d3d224e979142a4bb7d01ebc842
SHA512 9227ff39cf1f943299cb9f29fbc685f23383dc1135e3d1136083cb3fbe88d1fa4f9d40fba3dd3e127ac16e502c306b18f366f36072c31102522132f9d9a64524
TLSH
T193513C8D4DD25B248594CB020FC9F8677FBD1250E6390AAF8E23FCBE50946C79145485
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads