b89ecafde09182f1b0eaef752d5a146c465e49d51840a9b571a63d359fd5efdd

Analysis

max time kernel
19s
max time network
185s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
08-07-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

ff04ad3b47d9b71753545bc02dc8c33e
SHA1

184b7979dc29ce42fcbbb033671fb928e695331d
SHA256

b89ecafde09182f1b0eaef752d5a146c465e49d51840a9b571a63d359fd5efdd
SHA512

6937975030162551b38e8d91a35b175009be470d66eb30992a460c3c9275f16e8d58295a7a20cc5e544cfb3455ea247d3c22dc6212d791de06c4ea6758dd9d6f
SSDEEP

49152:mPSe9096pV6rX+Q1VpBaHoIkoo59X9SABZ+nm98mFBXAwtWk0ESkbUxpP:mqe9b2rX+QFMIIkh9tSABAngW6qP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4966

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
73200aac388aaeab13ce24060e9b81d0

SHA1
6787f9839baec9f7a49883779ba2155d64fd000c

SHA256
2491518cc1a56291a8f541ebf1a3606fd447cf803821c0ae9b853b82afac0ec9

SHA512
8ddc1081909a232ddaea349717896455255457319db655d41d60550e1e6b91316b8ea99f041c60bda6b23a43bedfb47dd6d53a8ed95b6d359a59ccaa67c91d6b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
43ec8aa818e3ac2e1593f585c20c67ee

SHA1
4e42f623e492378fea6e6027254ea5a23b70a653

SHA256
3b50959f6f911d3e1c310901e86147ffbb6e0d237285b0662c5290f848cc95b8

SHA512
821e2fa4d373823f85e27cc8d95f713af6ad6cacae91a4a086829396bc5ca79695d099491a4053d4a2761d50414c9e19011fa3c3fe2f6208c22ddd8dba2c462f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
64f14dd968226fc688a9596bc76e5a01

SHA1
450f3ae9ffcc751c595a5af812393e7c1d70160d

SHA256
d4bc34bc7eb4bd91b238b05d1cec40a69cc944f4cb8213af5a3881ba2b435be6

SHA512
500a1f80d2ad7ab17f5a1da306ef6d19ef4cde75adf9325e78e188204c78acfd08251ddc7e1f95e13e91b24dff574b7e3e9d4f6211de2eea5c05a7a99bef56c5

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
ad42e239722a8f4cb5d34750c668c7bd

SHA1
0f20ddf346243bf34f2aa18bdbd3bcffe24a78c4

SHA256
36cc4c1668335a64e5966d0374efb540116df01c6cd12946d27e665e6fbdafa5

SHA512
c938b6fd3bc2781bd73a522f965e76ef1f6efa248df68fb6fb37ae5c012a767ef1bd2de627384adc1e08800059a596a13bfaa3479d2fe6e835ffa93f35c5901d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
1e1dcb8f9bbf8659222a59af1308c5bb

SHA1
91975bbd20bde771149a6be6ba3548827d383f6a

SHA256
34dc10524f5554ac431bfb5efbe8c444c98fa1d61757be8ebd12cadc4586a225

SHA512
0401bfb68927a1cbd7e0323022cef689e7c93734f7128f518e9cd1ef297a5fe39d01afe22a87bf975f959b437489772058dfddc94d5d3810d7d84ba0d4b0e64f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
a6fb74f1f493e4656d4c3a964fcff581

SHA1
260d05d0bbd8a5b97ef46b6d5b63104c9679ac64

SHA256
c579d94a4503d71d9e980a4f170eda53c6e8b9e786838c9e05efddedab5082eb

SHA512
7f430de5e859197234e34fc1e473dab14c16b6b9e8857f62234bd61ce4092fcb42e53b50369d2d139e62034de5486801960952014db801bb22c6fd52a54d5b76

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
c4514729970ec7b5dcc26968c4f5326d

SHA1
31b7f0e921883129c9bc2a9bd73ee355463a70df

SHA256
707172e0a46f6aac11fd43875dc921aef5d1ca4476676c92f731eba3c701c89f

SHA512
0fb5093a4f845f2fabf480416f163376604c445258a422d6648e79bc447b9202dc561fd344bd6ece121513a5dd8ad6cb1dac9ef032d45e1da1dff021dd03d8a4

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
9382b5434970819770cb01c6fdd4956a

SHA1
4511fbd86706dd75be677b9d49f279d4b36c6c21

SHA256
56927422db57adcfcf7a795ec3cd06e15904f71d351640b14bbd7594ee8ecf4d

SHA512
99255675ff2971bd2c553e48a22aeb78929a7ea166897506fe54459f8ce50aef54983d9096272c7c5483b146fff061a0623b80447df77d5f7f279eebd3babbab

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
908628c7f1d81795b0f74503c5461f62

SHA1
6f8f9de976506be915eea9ede3740a4fc1e7e779

SHA256
46b6ca1cd35a3eced9abe3732c2eaffe3baa173377b89095a9a9d20092702c48

SHA512
5039916d845fb3ead2ed33f8a590402e5203607caaa867125b362cc9d2c3a3f7fff7b8acce56fcaa51c7d7b35942364f306e487fc4b268fb7959550885915960

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
1908022d994d8f4936315b57ac3147f9

SHA1
3b8070ca08db04be832d4b6917a496930707b83b

SHA256
f4b5989fe109f65ccffb601750d3533a762fe6fe7deee75c016c2e4390c06ea0

SHA512
f5c383caf96386b472921a491aaeb6a54f4890de8583e223818cc818270f9e01167535557f1d6eba4255198ba52606c862bf6e570e55670a1ffcb58602e1a211

Download Submit
/data/data/X.God.X/files/PersistedInstallation1657322525987973127tmp

Filesize
90B

MD5
d457e5f61d046fc6e752e8e6e914772b

SHA1
087a061b1ea60505327eef4362151cd70ef74926

SHA256
656dfd828656434205e6224dbf82f320a488aa1b65408e3e79f4747f4d8f7a0e

SHA512
b814f1452e5f0f6423c76ea8e721df3a6ab5f2c6e7b9ad78e582c2d4eac120a29fc01fb234878dbb91bfe8f93b582d8a747b01e2d1a8d44caa46e41ff2831a56

Download Submit
/data/data/X.God.X/files/PersistedInstallation2412416096730622992tmp

Filesize
566B

MD5
7c0a2c10c8da7a4dc4ae49a94a631659

SHA1
8c2b350e53cb2212b78190b97dfba42d2e16de90

SHA256
15b2608d0da734f37397c1bcb72bb7ed37c1f8024d70fd210257e30e8385d388

SHA512
fb9d84083a65004eb78ecdb69c06711875f1ddf7adb1677dfd949ceb81e0756c101d23c270f5fd26ecfbf8dda909ec7e17046ce35fd2cf5875a3f4da246f07c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads