e1fd8b7039c0958b3c60b52852bd339a6011ee45f1d8aea23f3f3b5cad24d0b9

Analysis

max time kernel
172s
max time network
183s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08-08-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app.apk
Size

3.6MB
MD5

4b7437e4617978c96fc5932b868fea4f
SHA1

bc064c601906b25374b0a84e041e74057c6c48cf
SHA256

e1fd8b7039c0958b3c60b52852bd339a6011ee45f1d8aea23f3f3b5cad24d0b9
SHA512

e517721e9febff4741f5fab2e1df795c14f69c996397b6dfcb689258cb440cc4ef38e71cc549fbc243d420868873d2498fea582739bc1dfa9dd271e1bfbbccec
SSDEEP

98304:NhgxDJOzORUH+OiKT/ZxilcSvVwlanPV29JhtC:N0lO6RKxTxUlcUwmPV+htC

Score

7^/10

banker collection discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

X.God.X

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

X.God.X

description ioc process

Framework API call javax.crypto.Cipher.doFinal X.God.X
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/cpuinfo X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

description	ioc	process
File opened for read	/proc/cpuinfo	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4257

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/cache/1

Filesize
841B

MD5
00ca8019c1a17d883a8386bbca91e67a

SHA1
480075fac1ffc86541b27bee8018c19e15b505e6

SHA256
c6c122d7f20674edf7bebdea1215e6782b87473e6867caf45a606205f25bacbf

SHA512
fde9dd88f2bec8a0ce51444ce8789120ffe013f1eac269cd01660e9ec26a84960f46954b00c1fcf640bf326befbf9fd8b5d07d949a44ead736d03daf2c1f8ff2

Download Submit
/data/data/X.God.X/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d80cc9ac60af0b7a3f797a53a2e15a0a

SHA1
53cc71f010da301b43482ae03168941a9db7276b

SHA256
d63ad73726844429355c3595203d6eb288d7e1b961429526fe124782f9de537f

SHA512
f4b41c03b0982343bb7b08bb3e62621c30c7110c45745022616d37d33b27c8d6465eead53edfc29c7bb9cb378a32c71ef994c9e62c9bab6f190aea014f287aa6

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
6c3c89a94b575ed7c06e402f4740cda5

SHA1
1580166dae084cdc7553891f81405c49b7aa2c60

SHA256
ebb305d583c045fa8977932042f004d64b6291125bb41fba93b9074e0210d6cc

SHA512
772f10a97a48e8c0580f824b7dff1b572c78e5fcc690a8459f112699f7c2410d8deae7718af747d77ddbafb64f25f7506f935c5a31350ccb2786570819dd7ee5

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
542376898ccd0285e459a76ed15f6768

SHA1
40e38878320636c1400c791d724ca5d883b06757

SHA256
27e819672e7f3fd716593d10ce107a01d38646e5ce1c28a8baa6377b4f2c5557

SHA512
012d4a49a0b5d90174108423d342d40efa2da58bf6a5d53601c5007a409abd06fb95fac7a5383d570bab8253ca0d55def90c3a4acdb9ff40a713acfdf58834b3

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
3a1c6dffdbe60ff0f285e6a273dd407e

SHA1
274ebc0f33f248a51791048ac852e9da2a243584

SHA256
780b899c02cab81e47c6ff6665ced3a180f248e0eacef23be003812b1071f781

SHA512
b1a7a26c09175a39b1f267d156a91a67459b82705dbfe7c7be78cb93d6978cb77920a0a13c2ce88f07f200d46f90208baf17a524a1e9f089b222999b9c05d92a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
3e881d9a01ca707bed38018ac69f4518

SHA1
5820f9351d7cc8082de6e5686eb9f8fedf6fb830

SHA256
4a5bf9bfe9b032546f886dd5fe6717de78716734aaadab620c0444ed6df5151c

SHA512
8f0395c94b3a449f3c61e7117f400c7b8a12c23d3655be6772bce2c8aa0ec8d8be8000c5cd2c6e10b334ef54a4add5583717393c3239da80c334c45b8b392db8

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
bbe5fff61f5108ba73722437f5786d50

SHA1
1726504cec43edb7d2956e5c497b6fd8e634b7e8

SHA256
d8f462455d69dfd77c41df3617f144f8d2c252242c4c19d49531b231b60e5fbd

SHA512
7d3b98f82468314780aa63cb65027135bd67a174d2011d9febeea7a8ef43c79116f3a4bcef52de4a5ea036998cdc257458206fc9665793c36d2e8e0113d7f57e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
31839ef5bf4c9afed01b4d4cd08db757

SHA1
8f69290996ac46f1074a6c763471bcad72c33b63

SHA256
46453be5c6f3da3cee07e55a3874d25f3b54c533bfc48ef7cbcf42b9aefff4a5

SHA512
e161f2005526a28c14bbf017ea17993b74835c0ad164b565ed4c3974e179931864fdc852274a0d1fa80d25fa2cf0fb37a514af5eb6bd0906cb81ee9714b3a167

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
d9ff20bfb76e4be6ce2ca27620e588ed

SHA1
d520278d7ef6b27df9a38812329d0a84e7be58cd

SHA256
f5e8e9667a684a4171471a729e3431b0ccafd8adee31bfb8ad6b2136f474ee39

SHA512
7b20a6e530d5d490fd46939ed7c836f62342c5f4e3a6a3db3364a2a273531b8118af0a3fe80ea056fa5acdbe8447fbe951e6561b24d6727735ca08595125098e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
ad5f451930f4893fbe708b34f6234af8

SHA1
91add476b9e41ed130eda1f47e282d57d69c4085

SHA256
a5620be2008df7280ba218d169da45866253551b318bcb9966ca74d863c430b9

SHA512
ef20e12c84d7b8f0476c6560fce88fcf280474eb0cc8245e08bdb12b96fd15ec4c9923d3b65c6f86ef69b4355efa7d9bc67624ee88f7229dc744ad270af012f1

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
857fee49d96f868ad75324f88ae9f444

SHA1
94743cfde0c43d30e530303c4a02a5d2e32536c1

SHA256
56c5c37203e2c08fea7614bd566e3ca7f4ffec1b109eb88c7662ad77298e05db

SHA512
97684d83abe8981b150a12711af7268f590ccaecf80a8fc2439892ba813099b7f0e903bca3c88add9275d813e7cb5bc9043be26adb01bc8ea0d843c5d3db7628

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
80bdcc348decea1c6b34898db6f49fe5

SHA1
46e1dee8f723901ec2d316c65d8679b2038f61f3

SHA256
9d1353fa5861e873fded83d5a2de3e9d0b63aa0d8540eeff18ec0dee575bf1a8

SHA512
1bb2f117c9bb80c496cfa626f026a8bb1fe7f9a4f4b024f1c10e09b4d9810afd11e971040145de68dae67ed585611742c4d2c08fe162b371c9c55524acfefafe

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
047fa8bad6e72fab27a347ff0f9a30a0

SHA1
df548e65921c4416524c56e6036e0a139d542019

SHA256
2036948ccd1afa9704c0fe50162a2a1dc918899665bc25aece4d0f329811f74c

SHA512
9e3a2c84a6646886905d3479a008e6223b9bf82dd646d3725f03a4b6bffbfdd58d13e2c04a98eecce67e3b6217da101c606e80e99a1b90bc6fc0a7d60a3e5c3b

Download Submit
/data/data/X.God.X/files/Domain.txt

Filesize
381B

MD5
6f1d334c9695835852e19ed4163e6b97

SHA1
1989cb808fd3e203eb77f8e00a8d4f3794dfda91

SHA256
a5b0cb36bbe9d80a6b8abca5d2364745e93e6564b3701db24144aa2d4a1d05da

SHA512
3da4f14bef9e21f213fdbdfa6492cacbd115d129e258bcf5ebd1d64bf9bf97bb8e446d3378df82e94cf2a839b84e8641e57154b3c0b02b83467cc9fb6a926ad5

Download Submit
/data/data/X.God.X/files/Information.txt

Filesize
31B

MD5
20fa458a2a4a377efc5af19c72be6f9d

SHA1
b402bbca9c9d8fe3f2f232be5e194a35acf6b97e

SHA256
e3d5b1e8bc13fd93691024a7f8cbede112aacb7b0cbd3dce2a32c7c2be91cc66

SHA512
5d4319eb5bac16052768942b69b3c3a2a154af87ed5db738be9be0ee17d5437f260e6960bf123f86168f2e951c39327fd8cd5e70ee9596de4a3edd4661705fe5

Download Submit
/data/data/X.God.X/files/PersistedInstallation5401330932702884611tmp

Filesize
570B

MD5
4163f9b08f0b4115be4a66ab305c31ab

SHA1
ce26c5c8d31822088be47c74b2dad8323cc7f58a

SHA256
238b6bf6dcaa161090fb9f0f1aeba51002887c01c2ff9cd08f803fe31f9c8521

SHA512
35084a57af386d1240c1461046534af9ebf69492f2a0ac2e7af93511fe99ccabc7cd2badacec5ee386d2f24e681a8adcce0440c825df8027dd366ac77027ece9

Download Submit
/data/data/X.God.X/files/PersistedInstallation6695036156498872821tmp

Filesize
90B

MD5
0a54d2e327981a8dc961a9f47fae36a9

SHA1
243c637204c1922d1f6bd6ee9dcede471d9a7aa5

SHA256
cdd1df035d6f5eea6fca68412312b65f63231dbb629faa494ee006d29e35d4b6

SHA512
f082911bf94ba01a006203c41666848913f83296ca9e4f5ef4f9d895b7723751b803b14495f8e6b6b34179bb55942ef0b7b25b38c9bc04d6e95e592a12699bef

Download Submit
/data/data/X.God.X/files/X_Signature.txt

Filesize
6B

MD5
960b44c579bc2f6818d2daaf9e4c16f0

SHA1
45e118d0563ea8581f830f46e85b60ae714faae4

SHA256
a7248eeb45eb1ce247f81693283e22e8b39e8a50890cecd22d02e75025547d90

SHA512
9b2ab664b8599c84637bfc6d49a7b7b040fb25dc1c522942609d1945ff51a89e9cf15d400ce082f1450ea028cc30843f3d38ae75c1eeb544ef978533e6ec55b4

Download Submit