7c5f2e39be09846225f593c2acb6a4fcf0b864d02567ef4ed57d3790dc1ee3b4

General

Target
Ratu311_2_1_6.apk
Size 4.3MB
Sample260813-wvamface44
SHA256 7c5f2e39be09846225f593c2acb6a4fcf0b864d02567ef4ed57d3790dc1ee3b4
MD5 d19989767cd5632d599b6fd9a8de52c4
SHA1 f7f54921e4b41e5d105f3e4cd156b72396336b70
SHA512 b593db306132778f5d812a55df764fd7fb5f5c56d9c6945bd5e43378f79daae1f393b6529e51444705cce55a0c0d7966ff9fae3e947756b4c014410cf3ad741c
SSDEEP 98304:pxOsDpTfyvP/o5cgV21Q4HDUk6UIk+viqs3PDY5zZgbbPc7e/mrDTQi:pxOshaQCgVf4HIkMLvW7Y5zGbLchDV
TLSH
T1A9261283F768AA2FCCB78032199B533522928E16C753A70B645837AD787BBD80F457C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.ratu311

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.ratu311

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ozzo.ratu311

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ozzo.ratu311

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.ratu311

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.ratu311

com.ozzo.ratu311
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5023

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.ratu311/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.ratu311/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 2ca4a8070b59a453cb839a246ce63c431885956fe2a3145d44ff011cb0e50230
MD5 9560bb5a1aa23f98d851897aa5dab897
SHA1 b7781b310aa62100e3408f9c1a76ae1241e75ce8
SHA512 b8b2485b6f19fdd5e391102d005f6c96dbf324ba74c5183f7d99f8fe2ed2da1d4ac0998676f786f0322e255d920b78aa7d7d75df80a7146edc93d33d95f65a77
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.ratu311/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.ratu311/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 c8d47a26e2e940a7f59bb55b4e3d6d119decdef1556498caccd22df93588b81d
MD5 5e8058724ffa20acb221df17cfcceed6
SHA1 c4771ecb30854e8ae37f579889137c7d93767e25
SHA512 0060dd7b5676b9adc222ddfea698ac3aa48b4f2b705829577ae6349012299e8f7a25a488bec3746a964768bf52320b4ab42c8f2807665f316b62a89c2b6ec823
SSDEEP 12:KuCw6CA1wlzdTRmBEyPbP/ECwar27wSwv4Ow2:K5w6B1wlzyGSP/ECwaQwSwvC2
TLSH
T166722B6A9BC02B53C1495BF2A6E4C3842F72AE4A9363C71F659927543D117ECA460E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.ratu311/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 668537f8b0a2a9dff0a624a14d6699bea7f197297829773754a267a448cac148
MD5 7dff8b6d8747e2b13865dedea16a45f7
SHA1 02e9f5cafc758f6ec7182cd3b2ea1c17bc324afd
SHA512 aa1d05d545eac7593d1c272fbf287be8877d45c593184eb77c5e8253f7c2cde7d3543a18bbedf81e8054951f6b2d58289741f11baf06f74964e277808caef416
SSDEEP 192:pVPz6MHCL/uqv3b2IW4SRadRUJRjb3ndjnHt9S/f8JzSV+6D86T0ED:7PJndjnHt9S/f8JzSk6D86T0ED
TLSH
T161B3049F0F993700C09968F095E00BA17A7F492E97A3E3E965920175AEC6920DE29CF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.ratu311/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 24986f64f8941942d7b45ce6b12cb4caa2449fb71eb12242e2472e149a62ddd6
MD5 bb9604d5256f5efcd75e7ccc20fa5e3c
SHA1 f325d8915ca828634858836151dd66aa6f78a8a7
SHA512 62934acd9e07acfde5c5f45d7fcb6b72c30572082816f3a0247b5734273026ae5d5eb3626c03e9fb52a65448f014c3393fa978b0f81b4d07706d1c18edf2a3e1
SSDEEP 3:RhA0wywlQegkHwzXtRKVjWn/lHywamDqFjd0XllgoqKXtRKVjWn:Vw28Q72V+tSwaxf0p2Vq
TLSH
T133C392F31EE42922C4150FF8FEAF5E888217ED0446AC6F7E561F0BF02D1038A0130440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads