Analysis
-
max time kernel
150s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
21/06/2024, 23:53
General
-
Target
979cf20eddb35f4dcdf03f4d038356218286fa8e2bdfb301b80de87868ae6ce0.apk
-
Size
4.8MB
-
MD5
e60d7e61eec04392ce766eef745c25f3
-
SHA1
b5a07034f2ad2b13c578a3a2a29e1d06bac7662a
-
SHA256
979cf20eddb35f4dcdf03f4d038356218286fa8e2bdfb301b80de87868ae6ce0
-
SHA512
502f40243a663cdacfca3c1813122399a6a30ec644a5d2eb77965c2b109936e6a934c706f2fa449e17c19fe4c27ea2cb74ea456e10d583af896d6df09785ead6
-
SSDEEP
98304:KkjOHHv5FGaGAYT6zefWkHB41gVR39uQ7fEAOSl9AE0wHzW5IZzHHrKYdJh0VVfx:KkmHvHdzeftuiR39u2M6l2Qy5I+VVfx
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 9 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.god.godmod1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.god.godmod/app_ded/Sx8IsnBMvWoZresE8WmkGCXmZO0IkzHM.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.god.godmod/app_ded/oat/x86/Sx8IsnBMvWoZresE8WmkGCXmZO0IkzHM.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.god.godmod/app_ded/VvwH7adUkYd6yGGEheoSf8KXkFY6fNK9.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.god.godmod/app_ded/oat/x86/VvwH7adUkYd6yGGEheoSf8KXkFY6fNK9.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.god.godmod/app_ded/suLuKYxvJb2elcLPYnUun2vbszaQRJJA.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.god.godmod/app_ded/oat/x86/suLuKYxvJb2elcLPYnUun2vbszaQRJJA.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
rm -r/data/user/0/com.god.godmod/app_ded/oat/x86/suLuKYxvJb2elcLPYnUun2vbszaQRJJA.odex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/oat/x86/Sx8IsnBMvWoZresE8WmkGCXmZO0IkzHM.odex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/oat/x86/VvwH7adUkYd6yGGEheoSf8KXkFY6fNK9.vdex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/oat/x86/VvwH7adUkYd6yGGEheoSf8KXkFY6fNK9.odex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/oat/x86/suLuKYxvJb2elcLPYnUun2vbszaQRJJA.vdex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/oat/x86/Sx8IsnBMvWoZresE8WmkGCXmZO0IkzHM.vdex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/Sx8IsnBMvWoZresE8WmkGCXmZO0IkzHM.dex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/suLuKYxvJb2elcLPYnUun2vbszaQRJJA.dex2⤵
-
-
rm -r/data/user/0/com.god.godmod/app_ded/VvwH7adUkYd6yGGEheoSf8KXkFY6fNK9.dex2⤵
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52ab8b807ee2323fd26aadb245f297f7c
SHA12dad865756c7f7192d0f61435669cd7ac72b3984
SHA2565984f5fed596c5c2601eb25227ccff6fcb9c323188fa8b69e87aa66a528fd665
SHA5120e577fea3ffd221ba90e1b3ec9e2b8dad4ac7113af20a61f01387aaee7f83cbd5a7c4ca5337e38447c83d936036184f06b420bb27ddee01686505dcd30eaf93b
-
Filesize
6.3MB
MD5252b342e67c4789302187b034c630bf0
SHA17b9679ce6e617c69dde6463f41734a18d8754b24
SHA25606a3a43eaf097d13bcb8e5e292a7aafc9b01b26f8b4b1893e11a0feb55ea0f61
SHA512ccaa9b09ca99c79f18135391c754c61387a950a5dc7eddd2cc17deca74e937523e7fa9f0d3ccee64327aa009cb21f90fb42e8e517deefd83d23a01178e5d7f05
-
Filesize
1KB
MD565c71280dd6f61b8bbbb8112a33873ce
SHA16be5e84353215bdad7672db29211c5b04e444288
SHA2569fa4d60817c616f8328888c7a028f264b6e2463cf9eb2893dd66157b26f621dc
SHA5128ba6f75dc415c69280740777f9518eed1f2a2bfde598c80e5268becb3deacf7cba9f73f34355245228c08664be8dc20fe41047ff721f1a8ce54574270585efdb
-
Filesize
5KB
MD57ee7cbdb2e51c07002c4685db79f7fe4
SHA1a3601fc53d64506bc4bd2e71e8440e0ced3f7041
SHA256679e3756c7590cee3dc3ac9d444b43645cfef9f9bc1cd31c6aa2e28ad534aa64
SHA51278579fa865089a0baf3fb453833472680bf4842ceed8deaba243f4acb35a1f2abadc9cb2076cd91f1b2a3753f05fb0a595e4cd2d4f2f2e919688f06dba95fea1
-
Filesize
6.3MB
MD5eb11a6b9d8a6c7274a00c0cf1ad3123d
SHA18885bb9f73627adfa01f6124160bab173ac79857
SHA2566e4a3c9889d5c7b67933bc4836ce3fd6de588b6b9954aa9b299dad76b09af073
SHA5126d8c9e28c789f21c712b7ec93896d75eb1b9931345a5f73b70067105f7b42c4c60cd223e73c85074d586906d23184985b89b2d762e988bd5295f38d0277e96d8