42557a21a58510a23268509e4457921f81b507b9d407e42f3365a6514de1baa6

Analysis

max time kernel
41s
max time network
186s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
09-07-2024 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42557a21a58510a23268509e4457921f81b507b9d407e42f3365a6514de1baa6.apk
Size

2.8MB
MD5

6bac095ca7c3546e1764695f9c09474f
SHA1

5d729d4f4fcbc98681ba7b1478ca89b1131a0d8b
SHA256

42557a21a58510a23268509e4457921f81b507b9d407e42f3365a6514de1baa6
SHA512

0bade827030293dea806ef2a5dbd31e37969759898d6541c82116281f7b8f81f92155618df1fc4743885359b487937381f225274cee60c7ba6e8cca5f2aa2ed6
SSDEEP

49152:Eiu3F1J72GkfbDVJZYhXnT9/gHKPE7Zi/cNzgLNNGjCYrHPgDf79:XYFvaGszZYhCX7McBITk9I39

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4969

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
c57dc8e231cc36be3abfea751d39f2d0

SHA1
1c8c2f5b98c0cb0040b28676463fc3e2dcfece39

SHA256
38bd4402228f4529df5c968d4929e868a9b02d8d92944533ec8b020a2ccca275

SHA512
2e07bf0d8503c4c466e8b29753229897edc6cb888571aad1a5e73ef407190fa5b1cc606c7e4070fb52ec29282b8b932572971b564873f5352d23de5574b73a3f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
8197b3d4d158e234c03616ed661a2b47

SHA1
190c0465c62797f2c05be3669747fbfac698d846

SHA256
8c191f9109efecee46e9711d352acee97ab7fa000e52f736867d918cc75758fe

SHA512
5ed6fba09c87f3e94d897ce4d675529c8a1817491dd62389b71b8d46e2da416052293b810d82c01dc2ae91c0f4dfc4e2a90afd1459864db107d07ec9dc82cb9c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
59c07acbdca1c750a8a3a792e9bf8a67

SHA1
2612487aee6aa792f9b1ace0b951f64e49f34794

SHA256
18cc50e3ee6bebc0f05af1dfa209eb26ce0079b519914c95a27693d7533a4eb0

SHA512
f66d52cf4019520d5e8f80156bee03675e32eb998ede754f3cd37a23917bba3dbefba279c530879e250562263a37f14c9a45b07d03e80da1d12363e1900fad55

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
a441a1c4fba163cb606f6c2dfdfe2c0e

SHA1
6727f4fe3362107074cfa8f85b849197ee095931

SHA256
d9f156b781bf596d8bed48a73944306746abe3632a5a12ea3b91385413932e20

SHA512
d237fbe5fe618b19aa441dbabba1f7b3e769ffe1b178383e4fa2631b6084984cac729cfc13473f7dafd2a9dafc9b240cb4a98a916c5ff564e7418583f3cd2049

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
dbcaf9f09c474c82b70a5ef1b01f6245

SHA1
76bdd351f461b60c0599f84a8ec5331e59995948

SHA256
3ae037e00a611a3f4d49776a660a304ef8a0767c15be8d35bce390a153a9f36e

SHA512
5677f1f3762bbca2c3bb69019471ca0952eaf5cf92e51811c3eb2458a44dc6372b0ade3a6fcde78ce10acef021f7e83b997e77c7372b12894ebf5148f4ca7315

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
d64c5912ccf32012cae6fa41c5aa93dd

SHA1
1f31d57dad7dea52ddd699c55e2d84fc04949107

SHA256
341903e6b5ad7b6d5c6b9ddd5ce43727c64fc53d918e72141a8f5f94f62ddd1d

SHA512
42c6c2ce4e18b9063918d06bcc87e3a00b943b4ff81f6207fccb7abb67050bef3cd9d815976ff038862e7878ffb0c550cd69b0b4c3fa306985bc93a1463fc297

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
77864acfce6fc00dd93104b256ad090f

SHA1
178bce23c76f7d1cabaee8fa2af3a18d20c68ec4

SHA256
e71ea3d6bb2bc9b45ef4708faee2e533deafa5a53b42e1f59c36dab0adbe6935

SHA512
32ea552070f150099f23912725906b9446ae4d6a91516be48f4233d97a53383303cac8c53e0c0bfe757fdcf302337b1b91c2b6261382effc8c09274a3e4fe6b8

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
182ee2d1bb9b6f54a85f76bd404453ee

SHA1
7717f4242d758f301127c50142834bd763b97691

SHA256
77075bf5647e1c085b96c9ed111856448a4d5b1247add7557c841eb2596bda88

SHA512
4e21dc42fc65c4c2c64646cf0cadeeccfb21d13ea5dce15ee9ccd665890c0dafdb208342adf83c9e0b9cd36336d6daa7ec825fe5a3f23caa35967f244f71a679

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
8b81368606f10cb101d48a6de9a68ffe

SHA1
d6d828c79349745fc9ed24e042606fa2d887953e

SHA256
bf81ce087c2de22568f43c1e23cef6d9c57c364acdbbf6182d9026e8e76e6788

SHA512
b974619bc873b8336cc3d184c3e285220660e3d2c1df7713f0efe898a0f8935e203ed2f2da0b50316fcc8a18f02a5043988be20b6232bffdbd021f387cb82474

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
b1c4a74d4283413e6b86c011b98c3738

SHA1
090c56a662444892b5036203a64ca1ec69c5acc6

SHA256
715c6594e59c292acc77de8244fbfae8d2f56f9e388c4c231470bae23fa52f82

SHA512
9835e1cb7f7a33697690871150c1cc6a7360059f50399c9474fd40ac1d8ae636af49d26a717d674be448ea0c1bac364d3b8f6bc69cea1e12d9de53f9355a4299

Download Submit
/data/data/X.God.X/files/PersistedInstallation7320998804330839577tmp

Filesize
90B

MD5
d7fa3e42c3d5aa3e69b4d43afaeefb72

SHA1
f6f4b16d38b2555f24574bbb10246d37a93b9d6d

SHA256
7aca3aad52b85e7fc9e3b7acb53db64687deba9726668fa576edf0784ff1b438

SHA512
6fc3dffbe23eb2004f288226e3f1034ab10e3bc4fabb333e187dca5babda16110a90f6ba889a1488aa08f90a4ca1121e17dd72495093ab24329d6959455761fc

Download Submit
/data/data/X.God.X/files/PersistedInstallation8141931778026159438tmp

Filesize
568B

MD5
2bb085d9786ceb529025df4b8445445c

SHA1
3df0feb62ed48765ad49cc0ecaa9c0c2255f52ec

SHA256
c2c0d7ac70db0870bb8ef39f52d6327fdcaea1f0775c2f7b1447a9f5a7389bef

SHA512
fb5f194bdc308fcb2a8eb741a7eaafc5424d0df94664f27bf89d0a5df9a581170dd3c5aa281862468ba70f904d02a88ffb9c02172e59379992adcb1e0cf51a44

Download Submit