b0b006464c4eb6ecc09ebbcea91f56822f97bab9d8e4341d362ed94257c76aa2

Analysis

max time kernel
47s
max time network
164s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
09-07-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0b006464c4eb6ecc09ebbcea91f56822f97bab9d8e4341d362ed94257c76aa2.apk
Size

3.6MB
MD5

137051f21856123cb25530994883e1cc
SHA1

024bdee3a7bec368a8a460ac09e07e361776451a
SHA256

b0b006464c4eb6ecc09ebbcea91f56822f97bab9d8e4341d362ed94257c76aa2
SHA512

4579cbe55dad6ad44a14b166124fd047aca37aed136258dfe5d976a27e955239568c3091f502fa4d7b11b3136a99e453b99508385812c373f6a74cdc6e2b8c0b
SSDEEP

98304:OAyaNOBvwbNZapFvjvyjJUy1lDB3uQ5ZWqyOSvNb:8aNOFwbupFbvyjJlfeQHWqy3b

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4947

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
30cc7392c2494fe697ae7fa2f1be6aa4

SHA1
dceee72f02aa671b766bef91ba1c27cb1ce010bd

SHA256
18af079e3c44a30e4517e6ce14bc4555f2de0b20a323990630b2a0a1dbf054e2

SHA512
dfbfd65cfa61ee6fdf0e8dbda9f6d5eb87559e1b6b5d3d905a842f06dc6940e70f11119cd4f15c8e3646c19b3a7fdd302e0f803202c7f012645ae89d6fac6e0e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
87562a86bd5168d6624c572cce16ae59

SHA1
d5fb4b53eb52d102b4a47c166b1248198d41c605

SHA256
72bca840138b6315626b0a3f92e6f2d12cf84ef3bac6bba85c4d38a492c18b9b

SHA512
ead978caaec2942fc3c4aa8d2b5e594fb1b19830384f0b617295d8827018889801882e7501215e298d6242f316896da75181bf20cac858b78cdf9444d25174f1

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
428dbd8e3902d8fd38f15f91ef4a1ff8

SHA1
744e4c7f6092cd59aea44c8f02324b87e553fb61

SHA256
d8249d8c34a79fedb191601ad46d6aaa22d7558c609ce262f9fdf847efc050f8

SHA512
c9389f9dadd2be023298ef8191e18880f74348cc985fc0619914204f31d0a8380409dfea119bd11257cff40e3f6026e8b3f5009376c5bc2c34d9c8532be166e0

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7ef43e2116f4955974dce2dd5709bfb1

SHA1
d2e36b73886d2715d0fa1b8857c82124a6c393e7

SHA256
c41999d904c260a33474449e96fe7b2b3159e020a6009d3a1034b6f0f9685141

SHA512
d533295179ebe8b22607000716396fbadbad632d6a5d9cf1244d09197ad71b809c8a327bf77dde5c70c20c83366827e847b7e29c027d441bf256eb7eb01a229c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
5cc2620ccd26524ec6afb650102e7d20

SHA1
4e40edfaeb983a0b363988a0ec631c125b9fdf2d

SHA256
a0ded855c5347af536367ddc9f724abd43017173746ec8618ae28fcaad9cd89a

SHA512
3538499ecad6617f1be146e0d04cdaf45b253ec7bb4ec88f30bdca8c64300a7c0cd5848eae61d4b6f8ce6f8737b7baca188e6b38fb44f5797b023cc9d8862a00

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
6ff1ba7e8878257653de3b183f15ff89

SHA1
37990c4eb1490a414e20cb74478c6a150d2ed794

SHA256
ef1dda774b4fa392ecc0cb7c8bff333be4001b678f749e5110594ba2da0ef105

SHA512
229b6af48e5e1471058f29b17faefc09fcee0930641e7f6f9558189b498360a1977f1e2531e2035d6831fd86747dcc904e062892c19f35f9dece9445f8fa02b1

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
723dbf41fed74adfdf340c8da94154c7

SHA1
6e7e8ec2de114c1cca930f39ee17947b03b65ba9

SHA256
db8023837d797bb24767e69d956858510914a8f667f56719dd1be708f525d084

SHA512
d76765dcf5f4760191ba48bbb8a12c2e22f8f1d49113fe0ddc8e87e8e5ba3bbea8add6637bd407dab59c2406708ba7afb2f6dba819d6535ea7e12c0024b24d82

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
0861b0042802c3412d5cffb48eaecb4a

SHA1
475afd81e3c1474b2c613a77f4dc196b7500bfc5

SHA256
c269798270e610097095915fdff2ac5a9b0d1a11d35c03a9cb69966f3744485e

SHA512
767cf50d05aaee41b796ffd1e75c46450a42ada58d15945796238e36a03abd3559caa472d079c4b19d661714ed1d27e7371986c4cb4ff5d838bfd09e31691ed1

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
643cbad38ec706fec12cad4a3c37efb8

SHA1
9c66b721c3897694cf804fc90faa0545ae9dc3b6

SHA256
9c087cd00f8d32b0e031e0d4a7380f8bf717d313bf0ec704c75b6cde46e901c7

SHA512
90890ef01e347b5e40c0f45eb8a9aa0ecc10cdc6ffa686c972fbb1bd70b96fb345ef2c00e57079ab768eb30d3fd296a603cf3e2397dce74c2d0be18f5915e51f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
5481db5b9424511dc1e966d2fbe34ae4

SHA1
025856563a448108cd12a8e904afb804e6c662d8

SHA256
cf926c976087cf01eec43df2acaccbcaacf78700320e702d9979e375c88e2960

SHA512
7f78df8c7b9dc7d6a3687ec27edb532fc8b1cc3b07935ba86bceb6598b521b54727873a7337a99bcd1cf0c4d078361c0cd9ed5bbacfd13d84ca400ab32bf3ade

Download Submit
/data/data/X.God.X/files/PersistedInstallation1947255652842227716tmp

Filesize
567B

MD5
d502c6e231585ab697c4587b10fe28b8

SHA1
b317d68955fd3bd9185a683b46b815c48508e513

SHA256
cfbccf6dd9c68205a0de9a6581bdfb5ce033f5c85f8fce5860a36515b6eb7e84

SHA512
b63d11c232d4960f64f7704fd6f0c3c1ddd7bd47f7f05a70f7594547354d98d09a90d2d9ac30e14186bb42123c327111b3751c008720733747f4073f5fe67ddb

Download Submit
/data/data/X.God.X/files/PersistedInstallation8787362020769504201tmp

Filesize
90B

MD5
c802c75b2fbc8bdeea64307298798163

SHA1
cb072f54c197fdd1b53a4a9413029a92aeae55df

SHA256
4c7d030cda71554c850f3ed86d149018315d618bdba329ac65503e371cddf090

SHA512
a3c7c979fe3a103f7e367a28e684975a41e0e3a493e790d5ebfaaf722c0e24c7c59aa165961c0d2366f0b64147ede5db6c37815f9ca55afec0e6f4df99fad79b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads