e1fd8b7039c0958b3c60b52852bd339a6011ee45f1d8aea23f3f3b5cad24d0b9

Analysis

max time kernel
108s
max time network
173s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
08-08-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

app.apk
Size

3.6MB
MD5

4b7437e4617978c96fc5932b868fea4f
SHA1

bc064c601906b25374b0a84e041e74057c6c48cf
SHA256

e1fd8b7039c0958b3c60b52852bd339a6011ee45f1d8aea23f3f3b5cad24d0b9
SHA512

e517721e9febff4741f5fab2e1df795c14f69c996397b6dfcb689258cb440cc4ef38e71cc549fbc243d420868873d2498fea582739bc1dfa9dd271e1bfbbccec
SSDEEP

98304:NhgxDJOzORUH+OiKT/ZxilcSvVwlanPV29JhtC:N0lO6RKxTxUlcUwmPV+htC

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

X.God.X

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

X.God.X

description ioc process

Framework API call javax.crypto.Cipher.doFinal X.God.X
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/cpuinfo X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	X.God.X

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

description	ioc	process
File opened for read	/proc/cpuinfo	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4492

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/cache/1

Filesize
841B

MD5
00ca8019c1a17d883a8386bbca91e67a

SHA1
480075fac1ffc86541b27bee8018c19e15b505e6

SHA256
c6c122d7f20674edf7bebdea1215e6782b87473e6867caf45a606205f25bacbf

SHA512
fde9dd88f2bec8a0ce51444ce8789120ffe013f1eac269cd01660e9ec26a84960f46954b00c1fcf640bf326befbf9fd8b5d07d949a44ead736d03daf2c1f8ff2

Download Submit
/data/data/X.God.X/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
2dadb79274f8137611388cc905ccc298

SHA1
8cc60a3b3d677fbc5e6fc709593250be7da6b6fd

SHA256
53e8043ee9df760982edd62336f0eba0e07b130d513d5eec8e4a24c38d59962f

SHA512
d541de81a6d6f75970f868e8a1fd7e3065021feb44a9aea013265286fa4262b72bf91fef469d6336a49e5380ba8ed2f687ee4e61ca3554c0331676fa81bb5d1b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
95ef878df21e65ef039465840a507ee9

SHA1
6fcf64d807f6af2c04475b6109732bfdb2177f23

SHA256
17697274d6524cc9d5eee5c8b6781720f2c2064662b86fd76eddc622625dbc48

SHA512
32b0e1472f31165d36409c0f88b57e2b77df3ca4d47b9c70209ab092880e1c85141fa3d705ef74335585e26e23ebf9c2bf89e30b72de123755b02fb2b1ad9417

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
040e5a03ba36e8f1064db8136413d1c9

SHA1
4e00f18d2cb19f6d3e964322f870f3e318ee714c

SHA256
251fe480ba3bd53ab44feaffdce18bec49c6c097d006bfde9944ad4efd9c2d51

SHA512
9ebc6180d614604d99ede09bebb03b3ef189c78d93fe86598b26bd9e1bb665191b9849d49aa056e0e24f0bae12f3189e0e9f04592b17242866727f96b355888e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
9177a40c6e35a6d6f698b2067b9b1eff

SHA1
00c3949620fa4449a7cb00edce78c0cdc7d3f4c6

SHA256
85d147fa49bec736b79a1eeb29fcb521933a8be80cf78d41da2c4ec452836663

SHA512
7658c520c559fd7e3093f71c8e5ad085587457826f296b5e43de740e39f118f4bc475394ffecdcbcf4a3c350ab946d6edbd2914211c6abb2933d469d867268ab

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
de82e2c94d2718988804b035a46d17b1

SHA1
705f5ff19093ad209f2a666085d6ccaed3bf58a4

SHA256
29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39

SHA512
68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d9cf75fdd1c2292d986f6c3d5d60f2c8

SHA1
07ecb1d3a26d952ae5fecf54f36699ab498510b1

SHA256
2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

SHA512
442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
cb8f13eb3809d2de87120b083884f6ec

SHA1
b9c05a3ca637dd4e7b719522b2889830624badcf

SHA256
62aad93e4ebe324f60fd5f27b8526fb0c401a42205d93ea2104445baddcfdd89

SHA512
b7a6002282c3727161e4012ec39723dea1a9b1fdf95ba9b78a50c5f7e61c6e10aa1235fca489ae0540fb78d8ec8263bd1a9a7e2274af97a6dce05c7371736349

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
757488301879ec168f3c6f9d2a61ff3d

SHA1
9546922b026ecd04adce218dcc0381be716ae5a2

SHA256
097b4ef2219e574f2d965442dd058dd6118f7142f93f4b38cb44e4104ac36609

SHA512
71e3cfb86a7f89e5b7cabcdfbb44f90f6ecba24daf3338c54de9a01dcdd70dfc7a41ec9eacfed65d81c678b2695c96ddfc6f4574f2b85a76dfb654a5a9c19144

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
658f216e589359fa1431ed5776e8fa65

SHA1
576da015410aefe9333a284765f9ecdfa4e300c1

SHA256
d753f4b289a7723820b9a358a05df96f8b98d518bcf8de8aca68b797dc9a5b71

SHA512
26b20604b630ead533592bbb3c3d2177b0d54f487f57623fd27ea911e1669ed1be6c0dfe953301133b12a9e22ce150f17aa2e8c341a4564f148fb2b1db788081

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
2d82a2d6fe6202a788525b366f30ed30

SHA1
f8d7239627eee6dd2eb996d83835a4a27fcdde6f

SHA256
dbf9358dade4395d16b6478a4b8f19e8ec68e2bbde93f2d694acca4d7d7725b0

SHA512
12562039cf08b2d23d3e812786f3c12bb9bbfa2799dfc4ca9dbfef027de16159b715fd83f4359124445eaa1026cc5bd436a43745704312301b3e88d23855cc33

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
4ee8742c8080097e80b3899924e07b86

SHA1
47a8a2c7009fcf7891f5a969f1ad5712065ebbef

SHA256
a360ec4e72227dc0181198a6a5aac016387a363487539e0e6f4a7d17579c855b

SHA512
6793990adf7a4aa30d173e64273164d5dca5735b4d24051ee6761302b53baa8d2a71f88087a5872355cbc0c056b5ebc3a04b04b99d51278c7910eed52f3e6d0e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
36cc25d344aeb1d4d7636996db5b5d40

SHA1
cb4af23bfdf8c8b76924fae077edcdb6c8e2d0bc

SHA256
f1236898e742790b3f68aed9822b60c28db18fc1c34d9f5e823f15448b86abb6

SHA512
fd67f6d89f8759c373faeebc0e1bd8620111878514c0174259d3d61cef893d6191a233701f2019d0f942f0440a9c69622d32112434b6dc4e5b6c2e3751121ee3

Download Submit
/data/data/X.God.X/files/Domain.txt

Filesize
381B

MD5
6f1d334c9695835852e19ed4163e6b97

SHA1
1989cb808fd3e203eb77f8e00a8d4f3794dfda91

SHA256
a5b0cb36bbe9d80a6b8abca5d2364745e93e6564b3701db24144aa2d4a1d05da

SHA512
3da4f14bef9e21f213fdbdfa6492cacbd115d129e258bcf5ebd1d64bf9bf97bb8e446d3378df82e94cf2a839b84e8641e57154b3c0b02b83467cc9fb6a926ad5

Download Submit
/data/data/X.God.X/files/PersistedInstallation1935882405094478208tmp

Filesize
90B

MD5
14371a82121cac0574d1fcffb5c09357

SHA1
76d1ace3f83363a9b7240aca728f7c6d4a5c2373

SHA256
f2a89846376d9e66dc5b7247e6c303312975148ad1e5882fc5736edbcb992afd

SHA512
114c57c1037de5d81c561d92fb56e8c1ede0d8379b0384df34a1acd8dd3d995204761edcc51c5bf4fbd4ad76f9d9d17ea47c06e2b06d02196c0dfce6e3479f8e

Download Submit
/data/data/X.God.X/files/PersistedInstallation91227594285016625tmp

Filesize
569B

MD5
f069dd4a4b7617060d22852fd674b3ae

SHA1
e598ece7d6665f490e355294935500d5f039581d

SHA256
c827be65a45bb74c4de3b39355d16e37e976a763d714e9e8efc9a6da5c998c34

SHA512
1ded60229ac94ad63e9d0c589a467f3f50949d066ee3a055d7246c6eefcca7dddfee440ee44909e0350031d3f74b76fb37c1a35b51ff6b4983dfb12a39e5abb3

Download Submit
/data/data/X.God.X/files/X_Signature.txt

Filesize
6B

MD5
960b44c579bc2f6818d2daaf9e4c16f0

SHA1
45e118d0563ea8581f830f46e85b60ae714faae4

SHA256
a7248eeb45eb1ce247f81693283e22e8b39e8a50890cecd22d02e75025547d90

SHA512
9b2ab664b8599c84637bfc6d49a7b7b040fb25dc1c522942609d1945ff51a89e9cf15d400ce082f1450ea028cc30843f3d38ae75c1eeb544ef978533e6ec55b4

Download Submit