8e00e43db6939f7aa53999cc8d8d687625c42a1c707ca74b9d540514cdc7d65a

Analysis

max time kernel
19s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
09-07-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

4c307e6962c91e6ba9a7a85f662f5db5
SHA1

c76926b8d6af7f8718510c200f2083f842ba1ac7
SHA256

8e00e43db6939f7aa53999cc8d8d687625c42a1c707ca74b9d540514cdc7d65a
SHA512

17112c92ba8ad9a36ff8104b6102d33308effc4f520f3f430b2dc00ffd50b1efc4b9ed6b675597b57b9809e805ddaf99553069a7882e62f0c6191c85a4e52cc4
SSDEEP

49152:uPSe9096pV6rX+Q1VpBaHoIkoo59X9SABZ+nm98mFBXAwtWk0ESkbU6Yf:uqe9b2rX+QFMIIkh9tSABAngW6af

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

X.God.X

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Acquires the wake lock 1 IoCs

Processes:

X.God.X

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

X.God.X

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

X.God.X

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

X.God.X

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

X.God.X

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4953

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
cb852dab5bbe08d0507ce911c7d09bef

SHA1
793943d1a4c12df9ff5f56c97247bd68fac1425b

SHA256
d10b54a9ed77d1fc94878601662e1b6bdf4dbda1caeb2b91633e27d01cdde80e

SHA512
3b0e591d553ce1393949aa54820e919931ce91134d5d78daef4c4e20d6bddd6fc32bcd46e6eed3f66a9c3420ec13ef47d70d2c1c3636d900854ee41f0da77259

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7b47f4f01e1685b4de1c38780a22b638

SHA1
a921a06766f04b553d44adb8889e88de83cc4f86

SHA256
076ac8e6c9d7946fd92ad72ede255bd6e883f7b6246c84906b6cf2c50b1b7e9d

SHA512
5c917625d471779500099b4931b2addd976fbd17697c2ae2b791882c0e14980babb5c381a3d5ee3e644890753d923d0015d4d26f15e2db2ca688cea67d854d94

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
a5e054093904d799fdd144bc0749bc5e

SHA1
18cfe7dbb4cda79d00b0eccb5da2b8f8bf47dc07

SHA256
a3bde4ff8ef686436fc5b68b27982ee70c8780e2b283db200ab918f3311c5ffa

SHA512
a696cfb9fa3e5485c50bd346224d7d02c8409064a4bad58efaa063756e772ed89fb9eee58930a680d28d4806e7abdad0d6206d1565a9fcd6a3adf5170ac9fc3d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
8c07c41d49235d76cb393cddae5800b3

SHA1
10780b30e68dbc920bd237a65767dbd5c11dcaba

SHA256
756e1c74d2d760a5a5f9209ee7e752a5cd4209defadce17ade7a5b3272587418

SHA512
bda8147a60574b4371ed6d499a3f3079ada0c757d0ca4e8243cffbfb55e734b1c295e4d03cf72267e7adb53005351c6b202accd544d0a0eb709aecd8d46ad815

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
09b1db754cb658695cc37c81c45399e2

SHA1
f201c73256308c4a0f1d5eea7e1e7475eee9bacb

SHA256
f33a4b33ab157ab50f47292e09da3ad097a2f10755bd81eab5cda6e104bb9ed1

SHA512
cf8d1df224d1bc9936556ceb2f8e041127a028481a0441c59a940a1c78437d6deec294bcc1f0180c9555104d9b4230ccb4a930b5a0a082042281e1b8aceb1751

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
c10d536b4c57b496971d2efd5d5326a5

SHA1
bb66692a1d9da7f91ee38bdf7dcc66b3c3baba97

SHA256
64840be309397d426a985a63763f8e1fef8b18bf5a90e2b351aa3cad5280c4b0

SHA512
41264b8da73a1ca80d6827f0001a307e126967fadc16ad0efaca472cd818e56847dc40ce8369b195f82c9f8d288fe14cf496c9a4e20de955150156ce25f4460d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
10ccf157bc1b75fb2aa47bdd2ac4c412

SHA1
4c992cee9068619d64a85e8c6e9485b34773ef35

SHA256
94df9bff52286329bcdf94f13de4386fc8d34a161b7a86bb5cc328c3484ba248

SHA512
ff72e009572321314d78d705b1481e003c90579f6bd2098b7c93e040f3c9c7b908e0c6db720d9df1f0b87722dda6096ddfb1c8642c5543bba2c008359ce0f1b1

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
7115bd437484e6bdb53a957a66866a29

SHA1
187347938a371b7b51688e8392c55d6ea5764c47

SHA256
b520f15425cfac68248cd1b6d29f25d39afd40b8a4d5d672b3a29a7bf6e44f5e

SHA512
7af637cf17603d52ef77a91468c8c4a43a9f4b7c24b185d1c4ec709e4fa56616e3dfdb779927f1bd097bfc6f02e6f09e777f2d84934bc260b0a33f8935ae3502

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
bc5efe90225037ddd8968bd15aca2426

SHA1
01a763a54c02339118bca5e3090a69b557b4209c

SHA256
d10b12b038dc21c38c64fd135dc6acfc6f4d27df02395ca595c6d5068d9e0495

SHA512
6f39b60ae74abf34ae22ced8edc07fec44d63cf0680abeae31e74c995aaec14bc6de912c047fe0eb156a830d08b2b6f480c63df8c54c1bf84a645e0f52d99b6f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
3ae9102af58e0d7a917870eb72d366b1

SHA1
94756d7891b1db9c46ded4a157b6ebcf5141f2fd

SHA256
1e10831f1f8f420cb46ef0b85eb3587e9bd41de1710e66fa19184c7deffb8f0e

SHA512
ddef3a91a600b8a9e1a15cd2cd8bc75d04020d40608f92883dbc63703c57874ac289387b3a16c51bec846b42ff44ce4d66f9d4eb6fceba2cfd934b7db492c49a

Download Submit
/data/data/X.God.X/files/PersistedInstallation5934714752266601371tmp

Filesize
567B

MD5
4fc1f54a40fcc5fbc301173204e2dc04

SHA1
820ff3528abc1767c9ab7b169568f22bf722b874

SHA256
a0c379803718c716bac2ab575197c9fc031d40c7e6c3735808d26d5e077fac13

SHA512
db2f5b5d2d6ef8d3292f79ee73111c4b722d0b07bebf5360546667646854e1882e7a9cafc0f971b346e748ce3b2237207884a57b3b6cc0db6bb23d52034fd0a2

Download Submit
/data/data/X.God.X/files/PersistedInstallation612526215599188328tmp

Filesize
90B

MD5
65dac2c6cb1f914c1b96551b402af7c9

SHA1
18b81081c5857d23f6511c9c5372448be61b5433

SHA256
7f7794a9b3c7a1dfbbd80064d1943ed367a5946061d08a3cc98f09cf58bcebed

SHA512
db53ace2be0d929fb761b0c9671964865d5a0a7813357db81ac4de103c2b6a5b51d7206802674407aa9ae9b38db5659ad7f014f04f6087794c3bdcf3942a7d53

Download Submit