c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5

Analysis

max time kernel
102s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
10-08-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

84164f77738a604232c7e497103d7b80
SHA1

5c466d6e0be3754e8cab2ba2139944b8d89ee749
SHA256

c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5
SHA512

74be9810cd4e23b411f6804904bc54938f92d2f5bf44abec16a825c99beb77e224524d2f24ecefcb2a05be95142c7134907185c41c9dce5534cb25d59357f8d8
SSDEEP

49152:/wa6XjRtCjJQ2C0L5jpUuIfvbnU2Ek8ocBlJixY+Mspv9qcXzqWC0eyeI2cyzVZV:/7SjRtCtlppUvnjHcB/i/v9qkzqWC07u

Score

7^/10

banker collection discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

X.God.X

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

X.God.X

description ioc process

Framework API call javax.crypto.Cipher.doFinal X.God.X
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/cpuinfo X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

description	ioc	process
File opened for read	/proc/cpuinfo	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/cache/1

Filesize
702B

MD5
718bcee2026dfcd3cdb2936362b2a42e

SHA1
e6ab0a166b26ca4052b8a35836a69ad756245801

SHA256
3c8b088387eafebd5580565031a4ffae103f46018ebd3d46d728e5d4be7282c8

SHA512
fcd11e281fce25612d38673f53ddc405d67bd21d2ac57f8ec5afea4424231ddb666d5c9e23cea1a28db05e7712b8184dcbb763e33837297a9188dcec2bb572f1

Download Submit
/data/data/X.God.X/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
05abc551847b3aa8562843d9d19ea782

SHA1
d3f235e18607210a56f6f8f3e3f811ee5f20fffb

SHA256
fcb3b294b37d364217c5578de34ce57e2be05e9af53a8f0970f91bfe52b1cc14

SHA512
87148aa8f63e6206193bbfcb23e775e362d79b4d403b54dcee32281dc3cde08702ddb57d7ce2ed7261921e84305a64297d60d7fd859a8f4856561376d02e997c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
00f916594e4f2641a3df1a5719ea2f56

SHA1
b5b9a536920545aa5c569646a8f1a438de6fc04f

SHA256
cb4f43cf71bf5840038b08d78e4bfc7a18fa5b8ab83f1b3565ef3ecf32287a9e

SHA512
539fb36b4e43254009f049652c5aefcc564e7613e358ab334f29991e0a390b76a2821e1e5629ef37342bf0f79e27b9d9e9636143aa7e34a655348cae4b72de42

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
058c2becade5b066305e8d01d4ed8c29

SHA1
e893dfb8bd236bceb6f15f1963f50adf9f04ae93

SHA256
37a831cd5c31d770c910c201a59cac47358a6a61db52d1aef4ba95e28fd34df9

SHA512
4947d52da0b871cb7c1e7736239ba8f0086ee7da1a359d14b5350dfd8e0c2384ef346a85d98b07bda203def027d31cd99b7727292d1ebeaa6ae19706593e14c5

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
0762b321310ff7f5174e06cc077397bb

SHA1
9534e32a4eb31356ea4f3aba1b10f3aef30feb28

SHA256
ae036831c35767238c849c3f9280e76b1a057a60249ea34d37649898e1a11983

SHA512
d7b1bf9db8af7a107b3c9fa505d9dd56478fae733f83f2765d64852fdcd00d009111c510a283cd19f72770bcae6e7fb1ccb0b974ad32e9126f0438831ee18d5b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
3e881d9a01ca707bed38018ac69f4518

SHA1
5820f9351d7cc8082de6e5686eb9f8fedf6fb830

SHA256
4a5bf9bfe9b032546f886dd5fe6717de78716734aaadab620c0444ed6df5151c

SHA512
8f0395c94b3a449f3c61e7117f400c7b8a12c23d3655be6772bce2c8aa0ec8d8be8000c5cd2c6e10b334ef54a4add5583717393c3239da80c334c45b8b392db8

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7237409e0640cfab7bdbd429bf821a3b

SHA1
4c3da934842f8d4835dfe2a9c275a300e5123309

SHA256
5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa

SHA512
c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
89c55d847c0d5bb6dc0ff8e5c762494d

SHA1
744e13e54fc4327fd0c66dc5b8c9baa37621ff80

SHA256
0c1fb7805e042452ea631505e5edca81e5a7c3f62e7ee73944c55a5ece48b0f0

SHA512
161705903ad3d295a057732fa08e90253fbbaf9ecb27dc52de5ad2455e8749941392a9b65b27758548c0859cdc5db465146764fea8a1a5b279e9d8845e71cebd

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
ece6589ef88470cda7518b0ac1bffcab

SHA1
ce410169e812990f1f6daa6264caf7959942fe42

SHA256
15916ac8f4e42db4aa24c8bd9df3bb18457affec66bf777f8febb102058e3f85

SHA512
4c962ad9c52104016b9b5e34294c232c226f7322ccdd574be50f77c427dfcd4fad77eb2cbb09e44d0713315367b768ce37d792d3b5658b3dcf16e277b8b9ccce

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
5c71fb4461bda66291b09ef8e8b0b430

SHA1
b5c3d8cfb87a9ad2cdf64cc435f11270377fb741

SHA256
014a3023bfb428abd73c8f6848804d60a6d3fe9647a1dceaf4a1a8e063fa9666

SHA512
abd9db7efda64f947eb7cb434cd1c4b779d4241cc073d4c8a2663b0e2d8fab2a4a68607df17e635b9f2311da9f9ffb545147748ff5163cc8146607eeb65e1dc7

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
dd58a3232d11966628cf98ee6a5bdc4d

SHA1
121ccf29685ac98c3fe9ee00232539f036835834

SHA256
8c1b0d4b6fdfcc524b9b4627dce79629e8a0392a4a0653a264da623efdfe45a9

SHA512
3f1cb11903a1337b9922144cf7c4ce91ac7a8b281f3328ce748874abc8e5085418536ca323f48990bf241228175be6fdc736cf30711e60f958f226885aa852f7

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
62c0f6cf5598ce4207bdc32d7aea1a09

SHA1
626efdfa168b2acf32757413daf2006029232a21

SHA256
ce7cacf050b2e07646cea37de9908aab3bd43925665aa699472119ff6bd66218

SHA512
646629aaf51456e6b06520d1d48f24c4e2bb8ed1c46a6821dc0ddc9bd86516f68261cbedd4188874cf71ed15ab6b31e44c44c12bfffa78390b9379eaa7599d9a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
4KB

MD5
6674ad7fd8320b7309ecff79bdd480d5

SHA1
bb0f29483da3f5620594c45bcc7c2a604043f9b6

SHA256
8e267daf82678e6b5acd7b295106c090e571a444e26aacce947d7ca6aa428757

SHA512
3d9cc019528ac88a7bdad9b468f8b39f77f7d89d96ec0813925b3e422837ed414650664d3ea9553c4539977c2509bd042bdc66f55ba54cd9e8598502e0ff0e6a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-wal

Filesize
36KB

MD5
ebc51711b8d3ee98cdc60ebfb0c17f50

SHA1
f6d869ca31ff0731ce8d6694c63adb7453faf8d4

SHA256
6ba125ae1c6d14a1e42cd89c09238c426efa12ccbcd13cd78088029a5a0d250e

SHA512
92d29d447c8c51352e0bed4934323f457b44588d85c25cba0346cb4f3be7b0038dc2c94e9a9fa0c12d1e87ab8ad44b5f3bca3ac86a34466725bd089c6f32d23c

Download Submit
/data/data/X.God.X/files/Domain.txt

Filesize
381B

MD5
6f1d334c9695835852e19ed4163e6b97

SHA1
1989cb808fd3e203eb77f8e00a8d4f3794dfda91

SHA256
a5b0cb36bbe9d80a6b8abca5d2364745e93e6564b3701db24144aa2d4a1d05da

SHA512
3da4f14bef9e21f213fdbdfa6492cacbd115d129e258bcf5ebd1d64bf9bf97bb8e446d3378df82e94cf2a839b84e8641e57154b3c0b02b83467cc9fb6a926ad5

Download Submit
/data/data/X.God.X/files/Information.txt

Filesize
31B

MD5
2c6301526d9f4635a052e986656b221a

SHA1
48b66f43e5f4b9a1be146a7922e775de7b90a215

SHA256
8b097eecbfb2c14616543666c8620adf0946518297ff2f1ab742a98544b647f3

SHA512
a6115f76dbac0d0ef6c5834e26eb8dd5a9d1849afdb2076bc59febbc60c99e7d26c3464827a1bb7b260a24d74f0c5afa49898bac6874049b9ebd5a54f9329765

Download Submit
/data/data/X.God.X/files/PersistedInstallation5054201639958319793tmp

Filesize
569B

MD5
f9263144bb1cb0fbe5b46c9e83acdfc4

SHA1
f82e8d86363bb6c1a70050fd0a2918cf8499db8d

SHA256
4d44d14ef648c8c01a4e526b28c0fc4346550bb0c3cda2c47b477d08ab70ca2b

SHA512
f1948cf07289664a56e7d08bdcef829153196f3463bc9807d1c439a10eb1343c6d2b186d6e57ba1c95b7862ef07deed3f559736dc777da281be78e752db153f8

Download Submit
/data/data/X.God.X/files/PersistedInstallation8691013677308581398tmp

Filesize
90B

MD5
42f3fc42e84812d6c419ecb87b3803af

SHA1
632f82317f890ea2c71c70d17cd934a0c868bed3

SHA256
4542f38a9eed702a97e04c95fd285d21c03c456798563da2e04ee45a7feb3c2f

SHA512
36dacdc1b543c4fa1a7bdbe18966a793ae62d3b901ac8b45c86b2e8c10fc0f44ce89b41f8cbc705c6b146a725293fdf6a1809ffbd4a846b61012f12cc661d5bf

Download Submit
/data/data/X.God.X/files/X_Signature.txt

Filesize
6B

MD5
960b44c579bc2f6818d2daaf9e4c16f0

SHA1
45e118d0563ea8581f830f46e85b60ae714faae4

SHA256
a7248eeb45eb1ce247f81693283e22e8b39e8a50890cecd22d02e75025547d90

SHA512
9b2ab664b8599c84637bfc6d49a7b7b040fb25dc1c522942609d1945ff51a89e9cf15d400ce082f1450ea028cc30843f3d38ae75c1eeb544ef978533e6ec55b4

Download Submit