86d37e273b01404e0410381cd23b89575ecccc8f6f3a88cda6650f4b697e6949

General

Target
Samson88_2_1_7.apk
Size 4.3MB
Sample260903-w431catclf
SHA256 86d37e273b01404e0410381cd23b89575ecccc8f6f3a88cda6650f4b697e6949
MD5 4ff8b18af0bdc54d0e723401818313c8
SHA1 2c654663d9d1877a3fa9c915e5597e8bf62491a5
SHA512 ae2960e9465ea6b31b3ed0f507405ec85c442ac61a07b0109a211691f25de418dbd50f3aed7745cf21abc5e5e5491e327bada46d49fabd46dc3451927dbbe53b
SSDEEP 98304:6G4LmiQ/tL/Y6yYKFF12V1UnE6cmpvgG5kbPclw/mrDTbJ:6RmjFLA61g12VbUvkLcpDJ
TLSH
T1CF261293F369AA2FC8B3C0321D9A433152968E62C753E74B58587779387BAD80F587C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access defense_evasion discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ozzo.Samson88

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ozzo.Samson88

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ozzo.Samson88

Checks the presence of a debugger
defense_evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ozzo.Samson88

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ozzo.Samson88

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ozzo.Samson88

com.ozzo.Samson88
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5024

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

androidx.work.workdb

Path /data/data/com.ozzo.Samson88/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/com.ozzo.Samson88/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 c24944b1c8cd989f17b9a6308504c5cfe1f3ea123293d71ce6d844dac3cc76a7
MD5 1a18ea8a853628e9e3a28a32097a44bd
SHA1 c998c1e87ad48544032e9f6e4a8a4f0492ec99d2
SHA512 162e62e48818c5eade60b4a2da1974d8fd060b7002418d6fc1132afca84b5f9eb0493e46a7da5d624031e9ebc4297ab8bfe79795a859d7e4dbd1dd3722c33f1b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.ozzo.Samson88/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Samson88/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 68a44c0146ed3d8838f02b3c6fc9c2a4e5360547d01878425775e65be5cf64aa
MD5 8eab2d26533027dac7b4a2af895c00f7
SHA1 0fe7a91fbfbab20fb7e25929dec5099ef3e6a283
SHA512 4c922c149c3a2fba40e80ff6ba967f43fe76638615543333c820db3f950dd9d9003cc0dd74cfa3bc9a42ab854129bff775da45bfa85fd3063b0caab7395f7a2d
SSDEEP 6:KEUjYA9FZdrlOERX4PBX4ogLugMBX4suuK+/Bt7KMSWOw2:KEUsKzdTRmBEyPbP/BkMzOw2
TLSH
T1AA72C264B3C00912C51943F255CCC30B1FA6A63D4362C70F5650D5597D42BCCD490D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Samson88/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 994a4eca676f2f0aab32c03288856d9aa7d9e841d6b024ed1a72b8d349080f11
MD5 d6ba605d5242e631014f2d145f9b4df8
SHA1 f76e3d7c2877ceefc8198b36b8d7bb86eaacc971
SHA512 cce589ae7f496a2f7c35d9254f1688939150504858924d6fd5e6154ccaeaba94941f247885d2718f6de5c61d647379de2df5f5788c6cb222dd333068e6016b17
SSDEEP 96:XmqJWwDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:Xr5ndjnHt9S/f8JzSV+6D86T0ED
TLSH
T174B3FD8D1F592600C4A964F0A6D00BA37A3F853E9393E3E36591C175BDD2D20DE29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/com.ozzo.Samson88/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 c633388acb97812e10dba8f74bb0f0a1ae120937310a9698cf7571a83d196c27
MD5 e788a8b70827e34f212be49cd7842922
SHA1 e760292660e9f27c18abc6be630306fc18bc77bc
SHA512 e26eff6d9bcb2983aba163c55b000f97162856b5a21d9b787ebf37a7a700d20b8df5e62b41310cecf04e03d4b9b1ba2883b17d5acd5cb9d64570fe8874c9beef
SSDEEP 3:RWt8byOtywzXtRKVjWsq2llN8MMlhJ0XllgoqKXtRKVjWn:wFOtF72VUmTk0p2Vq
TLSH
T12DC392E326AE4813C211C7B9EE6F6B9A074BC928408CECB74609CAA03C20BC8A525044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads