b89ecafde09182f1b0eaef752d5a146c465e49d51840a9b571a63d359fd5efdd

Analysis

max time kernel
19s
max time network
185s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
08-07-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

ff04ad3b47d9b71753545bc02dc8c33e
SHA1

184b7979dc29ce42fcbbb033671fb928e695331d
SHA256

b89ecafde09182f1b0eaef752d5a146c465e49d51840a9b571a63d359fd5efdd
SHA512

6937975030162551b38e8d91a35b175009be470d66eb30992a460c3c9275f16e8d58295a7a20cc5e544cfb3455ea247d3c22dc6212d791de06c4ea6758dd9d6f
SSDEEP

49152:mPSe9096pV6rX+Q1VpBaHoIkoo59X9SABZ+nm98mFBXAwtWk0ESkbUxpP:mqe9b2rX+QFMIIkh9tSABAngW6qP

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4970

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
6822c5f1f4900505464f7fea12ea2131

SHA1
a40d0af84f19b0968bd1750bd6828d1a2ed7794c

SHA256
8742d48d9725216571f21d23804c5e9ddb436712768a7cd088cc65caec427947

SHA512
54bc4f59ea7115864be1fc990805fdd13e2956903f352fdc56381b543a35e29b4bab638d1f60bd1b8f9b9b4fea4a20f7a588f8fb830f9e13b2ba59c1e57495d0

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d085b190237866b8be5ff5958ba043c3

SHA1
cc4216c0a68d542113850ffd463868f3e0ccee7d

SHA256
645240eea73cf8700ad3d60cc90ef5ffa427de0fa35722d18e0905081aae2f92

SHA512
e3553e15d8f4d676bec46cc1929f9034bc7ba713ca87bc0b569a4f7d7c7c852eac0e0da6daae69fd68b5f5f29996f6def1fab0a5efc50ccb4d087fa4fd30ea90

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
a158160db85dd28a59bebfc2459201f3

SHA1
f3ab009596a2298e15dc6ad80183fcffda3b186e

SHA256
0c76ac66e4ac2379f7a5a2c806959a664376df7d241d940ad4f5f0e9c9611338

SHA512
f606406ab974f1fa19c51f59ad4d9b88b108842f2cd7b48cb5a92abf9427aefb6f6210c36e8b6b768ae4901c621429cc5fca24f648ada144055491b16842d814

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
0213482c5abd5698146cb1f3f3844d6a

SHA1
9a50a98d766e62e9c1334898c104af3421254ad9

SHA256
b1f07c6ca298beb1754ee8bf8503a60638018c6805e353b35d8a6b9b3713b73f

SHA512
da31b860efb2d95f1bb254629b5018a2392b5a6de6059125709663bb3aebc810e35801454ee0d89a60da79fb7d9db8a3afd4619fac458443f4cfd2ca53b963ab

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
8145fbf44a4f83318b8696cec3385bce

SHA1
493c2f873ba265d70ef060742f166e822906927e

SHA256
940fd7d81f10d5137ccfc05b9677a4b02f8d7220fb378724839217bd77fbc585

SHA512
78e357ff562e089b28a8c14af0cf590fdf6076a14b2b6c32090142a7360750fe6dc639dbb74f0c3b88d123e9f115f78309633243705663bc9b3b8a2c7beb2a44

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
c86261cb27a21590fc93a634699b152c

SHA1
6a149ba5df975fda5bbbefdd7e8d3b669610fb68

SHA256
2c2b884f26adc1a9c9602d9182afedb736170936e71839f63ce64a4c4f6dd6ec

SHA512
9891416f07be8e05c2f8e23aa58a9d21d2550ceba1be876b0f1d142bd378899456854aa137490cf7adfc0cad823a2bc87bcffda2b5035ee7ff552634d2e2a463

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
b0b3c97b4d4b9d4ff5e7111e0adabd40

SHA1
c7fb2cc8ff6f0efca49f04a733deb11925d0b08e

SHA256
6851b7c3b92bcd20bd2a38398e7016c3377e17f5acffdd574f0765399e3fc235

SHA512
797ee284217352338b028174eb3feda308dc18ea2c367f9e2af1c874917c459152175f2b5baf4ae3b1d401bd1a28ff5e3bf695435cef1d117d0e9f30c4a31738

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
5996c2698a338dba20a91a15a9ebb8d2

SHA1
f520437e4211ce13d6fc3ea5758ad4a2854a5452

SHA256
e87537f6a109d5169feb77fc92bc3a1faeae0f2261e83cfcef23f0fa5f36ca47

SHA512
410e65d33e1c87bcd9b2d1bd408494b35ffd9226a2563616ab391f0ede178e26350000aed8f9f34520ce46a1636a2238f26db72eecfd18f5201fb84cf35aa905

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
6a82bde0c28ef369b33ecfca899451f2

SHA1
b4da94b2e621280db902af63c1f8dce648dd51f8

SHA256
2b5d23bf6e4d60d346b611067567e8b6aa13f2f42ba4780cd0162dbc5101e67f

SHA512
a431e14754dc0d7654ff5ad84f43a5888bc3ed2691383b6a3a6f08b72df16afe046cebc8a47a08e4addcb6db078e23115fc99a21955fde3556507dcd08331a2f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
ed2a786004569082fe29564a6364592b

SHA1
712974d14eda7643e6b574e90c01dbeb9aa58c0f

SHA256
d831e2acaa50074545aff69e1740819320712703600e3eb7530ff1f5dc3c9fc1

SHA512
b32e25ef61288e07cc2002c18d469ff6df1b0d81c583a46cc505391275e72a382afe9ea20d48f1eee91fa40882aba1ce48aafb5065150975fc1d19a4f5690291

Download Submit
/data/data/X.God.X/files/PersistedInstallation3206180366483154967tmp

Filesize
570B

MD5
b8e732d4bf185822d1e6265e6d9df185

SHA1
230d1161bd18ee19db241e10cd26c124c117a4a4

SHA256
326f23c5ca16ca1f92e2dab793251bbdc651db6ea8d4e7cfdcc6b77e46b7e510

SHA512
4eb1e8823017c5b4d600a038bd650316d9b310bd79c41816d2f36d6ca5b5f2ac7181b9ca8a3d11a412ba3a7fd4b105b883f2b7bc3f899064d10b56e6d790590d

Download Submit
/data/data/X.God.X/files/PersistedInstallation5146858926131589795tmp

Filesize
90B

MD5
d62ec813cfed6bd000b4bc8d509f7836

SHA1
29bade451d7d5d7794632ffb42dd571cfe8b4696

SHA256
66752b310c83cf391cf13c4be267410d40b04acbc42510cc3deb2cb6962f00f0

SHA512
f9fe9365828cb1c93556f4c4f63214cfaa7008ed8049a937a231dbea552884e630e2f5b3204b78fa05feb9b51d41faf38773b3a0cc64cd977572febc8068568b

Download Submit