1d269d603a0d55da0de56c3aa861002a7b76ed605ed861991316e0bc10f216c7

General

Target
Tomat123_2_1_6.apk
Size 4.3MB
Sample260807-ph3dcsdp6z
SHA256 1d269d603a0d55da0de56c3aa861002a7b76ed605ed861991316e0bc10f216c7
MD5 a90b2232193d39245d58b1cf80dac4b8
SHA1 1379b5015fd6a2e688a757b65986dac87659231c
SHA512 4e3312a1ec74a333df5fa82710bf0f12beddcc56efcbdfa3c51ff365797b1194e95d9a44a817931e6e9f92624e37af6d7b75b16dc91efcb215b328ef5a88935c
SSDEEP 98304:HrWX2WocFLxE/3qi/pfaN15lg0FETHG20QKbkUB+xZxbPcPSB/mjDT2A:HS3LyvpiDlZObG2CbzB+ZLcPTDJ
TLSH
T115261283F7699A2FC8B7C0351A9A433152968E16C753EB0B5458376C38B7BD80F99BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Tomat123

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ozzo.Tomat123

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ozzo.Tomat123

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Tomat123

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Tomat123

com.ozzo.Tomat123
1⤵
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4264

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Tomat123/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Tomat123/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 3bc80652987d6e8ecab030fb5736cd1184bfff2d042e13ca6738a709e76cb259
MD5 783644ed0d3a96a4d3bf840aaf12472a
SHA1 d55fa0c960d28d21e39e947ab9db58653b9a062a
SHA512 2c22499317fb66e27143e6a8dcb14a06919d4a8a324968872fe3aaa529d0f2b3ae61aed8fb0b4b4a0e7068e5c3b342d4a63dd00beb594f0c322c6e99dbb9fb86
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Tomat123/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Tomat123/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 09aa89ae23a38b4bcdbdbfabb52e1feed06ff855147250be60e72dd6e62eeaa8
MD5 76827356af06b94263097ab73519c7ad
SHA1 6479c96c3376665ca6f95c0e969117b798156aa0
SHA512 de5a3b8d3b08e1893ed7efd46cdefae193d879880f3ab7c5aff9ec22358a13c977ed3c3aeaf84042c938486fcf1cbcd3883380a7ec1b1ca2dc74abf32650ee3b
SSDEEP 12:KCLy22LizdTRmBEyPbP/ULHqRtv2akkjiOw2:K0FAizyGSP/+Kyakkjw2
TLSH
T1FB722B6BD3801A52FE4943BE40D8C3180F71921D832ADB6B557005D47E62BDD95B0E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Tomat123/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 363e4d052710f1f492b2d48d20212e12bfe813cf1747d696bd3e57c16a944b54
MD5 6a055f8419e4aa3fd567bba56b1413a4
SHA1 dd7dfb9a40d45f6c3b3daf73aee140572952dab9
SHA512 719285a491a058b84b1a2831c42a0304a96781ca2c6a4c096d53c676fad955785662ea4383eb9371b8f2428033b771ec27b7d33e161cee1f328aece805adf62c
SSDEEP 384:XKlu9A0xHblNpIOBU1TxMfVCDvKjndjnHt9S/f8JzSk6D86T0ED:6cjxHSsJzSk6D86ZD
TLSH
T15FB3218E0F592500C8A964B8E5D00FE17E3E412E9797F3F1659100B5AED6922DE39CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Tomat123/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 2b5856f8ae2d78924ff4d6d75f42bfb6f6219c276b7b1d6bdbc4d859fb386a03
MD5 c08bae9a128e176b41da8b1def4632e7
SHA1 5762dae5b90005ad31a81142cc5633b65dd1cc2b
SHA512 4ac981e4d936ef851d8cfa9a324bea4a8b182ad56ec5f8fa9c6da1f2e9dbb378252eaa9f1cf8b215c44b38a14e5ac079858132e9e71ccd1c8983077203fadb3b
SSDEEP 3:Rp28PURAGwzXtRKVjWVOQ1ot22+PUGX7utjd0XllgoqKXtRKVjWn:O8sRA572VKO44D+sAiH0p2Vq
TLSH
T198C392E367194463E42017BCEC2B97D44A46DE00B08C7CB5A449AAA22E286892970014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads