c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5

Analysis

max time kernel
44s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
10-08-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

84164f77738a604232c7e497103d7b80
SHA1

5c466d6e0be3754e8cab2ba2139944b8d89ee749
SHA256

c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5
SHA512

74be9810cd4e23b411f6804904bc54938f92d2f5bf44abec16a825c99beb77e224524d2f24ecefcb2a05be95142c7134907185c41c9dce5534cb25d59357f8d8
SSDEEP

49152:/wa6XjRtCjJQ2C0L5jpUuIfvbnU2Ek8ocBlJixY+Mspv9qcXzqWC0eyeI2cyzVZV:/7SjRtCtlppUvnjHcB/i/v9qkzqWC07u

Score

7^/10

banker collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

X.God.X

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

X.God.X

description ioc process

Framework API call javax.crypto.Cipher.doFinal X.God.X
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/cpuinfo X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

description	ioc	process
File opened for read	/proc/cpuinfo	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4920

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/cache/1

Filesize
702B

MD5
718bcee2026dfcd3cdb2936362b2a42e

SHA1
e6ab0a166b26ca4052b8a35836a69ad756245801

SHA256
3c8b088387eafebd5580565031a4ffae103f46018ebd3d46d728e5d4be7282c8

SHA512
fcd11e281fce25612d38673f53ddc405d67bd21d2ac57f8ec5afea4424231ddb666d5c9e23cea1a28db05e7712b8184dcbb763e33837297a9188dcec2bb572f1

Download Submit
/data/data/X.God.X/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
3c56001035cce21de1fb9f5db8ab8431

SHA1
ed0ad78186a118ac7fd51ef09502b9d47e596b6c

SHA256
118f0f68510c270275c4da8e4efd38b71589e2456950b821617ea583c7e0796d

SHA512
041852a4e77b8cd638fd7028101b0291ed3e5b65ffc66b1be45b3ed30797ed096d035dbd9fbd916dcb84a6577cb491208297dcad4a3d4696d2eef8542b497cb8

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7101f03913256fc1587785dcb4a65e95

SHA1
d324f9c9c4649d4c083d3da03350b1b9e74037ff

SHA256
8fddb3882fa0ef8f8e82f8fb2ec3a7d20f1f3147a7c1fd2b22b086c5c1d7c686

SHA512
720104a23678bb8391e95851f3e1dabcbfb34d23a00e5d035e640094f5243f8c1f42cce349eef0ad00d73df66a36a068de07f3d5954731bce1a293bae331c46a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
14e786e690399e95fd1a304d5786cd8e

SHA1
78066492001cbf1a427c443d39e5a05b004e9804

SHA256
4c1fe18ed9697effa2e71c56306d86f24e9ee3deaa6129b912f173009b619122

SHA512
5bad1fc2ea165a2c3096f917fd94ec0d95a2b5698ccd5646a1ee8b1e874ec80240a6d6064bac3b5e2944e27335f3c35e914dcec1f32c45df1b2872483f659c6d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
0e56e413cf35eb116ce16290b2701f27

SHA1
d56f6d221412dbddd022487a1ade6e4dff8e090a

SHA256
1bc57bbf555d2424c3f9d28c622f4b0a1a47489449325a21d9f106473cb6e431

SHA512
1d97cf58dfa62ee27c1a3bbf45f63b504cd6d8c83e4cebdce71037785edf61dede21f4c5ef4ab5a88678060be52f2ed60fc2e7a7cbad3bc2b9d7be5c43319dd9

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
4951d07a12734b83316494beb9ea9fb1

SHA1
a7b1e50431200c2313447ff580b203fc412163ba

SHA256
f45ad5c467f1d4681a020780c193d712c196d34006cfcc7d5dc8504fc770e2d1

SHA512
11180e93fe5bf03df61ce1d33c86a74c70f7d2a9f226af9f8f101de0878bb10ba1fa2c63f4a4e6ff230223fde1f5e082e6f771c7ab30dc7473c700d061915b49

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
f70262b99e9ed53374ba934f972469e7

SHA1
01dece44c579d4ce58ed351a5f735c67207dd09c

SHA256
dfd54e4517abe7c573a96e8b9903659c90d46e0f4951852bbcab05d74f9f0ad8

SHA512
06afc43a4b9a47e3756e4fb4818d223be940d278acb5828418f766a7d2671b8173f637060969a9128c50ed498886c92a4f4a8990f1d933b600b430ab787cba59

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
e38b5027901769e4639e261b12867ca8

SHA1
ade8e735e075d466b63410eadd6d6ad0058a79cb

SHA256
e4b476174143dd679ff15227baa26c9cb07eee8be464ca654c4f43dc66b33831

SHA512
fdf0da017165477e8e9bb1a4c3b24d2b7b9f372cdd1a88747b02df5d56773cbae181189f30f2222586e5da8dd83fd460d3bea2966cba8c1cd8fa5ec1686565dd

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
d59c87760e804935076df0a20af3e62b

SHA1
8ae5f75c1a209fa74561acf16af98fee19f1964c

SHA256
71776e90ab9784a47fb60d98f71f2a5eeb46aa74bb874450c31432bd287e84a9

SHA512
7e3e3c48f9139b9538a64a15664e71b6558d4747aa8cd717ea2e94700e372c10aea0a458dea388b1e9a3b9f38a9a88fe2e46e5d58d8ba5393a00074496d46d08

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
40298d7813280c12b2732b9cc3113f10

SHA1
fd24980c0e090704f9697533af338ed966e06848

SHA256
d7468fc85e5e9cc0861617a69b9bfb79a09f91a5e9debf59612013cb942583a8

SHA512
e481826660f62b4311f08080077c87d5b25d14bd51104711058ebba1490f8c08945bb3b94dccc550759527e7e09e05e5464f0fd6bb89d974b65755ac303ee13a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
9178f95aa8c29204c7eeaff3f879524e

SHA1
c1a2693b9e3ab04de129e595cc20e72aa78e1c3f

SHA256
a7279cc309e89d988174c4c4b6ecf8cdec71d680872b8ab4e467986b38d2b88e

SHA512
f6edc771046d561110d98619197f8aa38a12e4a166592d9f01df4cc60b4cd67d70e8f6811934aa32dc2aaef24dcf2f366ca638195fba7c8a1bb25c3f14769a8e

Download Submit
/data/data/X.God.X/files/Domain.txt

Filesize
381B

MD5
6f1d334c9695835852e19ed4163e6b97

SHA1
1989cb808fd3e203eb77f8e00a8d4f3794dfda91

SHA256
a5b0cb36bbe9d80a6b8abca5d2364745e93e6564b3701db24144aa2d4a1d05da

SHA512
3da4f14bef9e21f213fdbdfa6492cacbd115d129e258bcf5ebd1d64bf9bf97bb8e446d3378df82e94cf2a839b84e8641e57154b3c0b02b83467cc9fb6a926ad5

Download Submit
/data/data/X.God.X/files/Information.txt

Filesize
31B

MD5
c54f2deebcd03c0e7b9f41c7a4d70253

SHA1
bf29f233a299a64f740454dd8fc732fe34b39e04

SHA256
cb51cb1d9d075a8d0d841b1c3d51fb233e9e975c884e5d1ce11947a70ca14776

SHA512
d4764c8cf8e6746d27b13eb5b5753403b5f75cd3b3d4a503597f9f9ea4d6c0012129142a5975eb52bc4da709913eff22324cc151a8a207ca490cf4c8cc4fe0eb

Download Submit
/data/data/X.God.X/files/PersistedInstallation5022983933470833276tmp

Filesize
567B

MD5
87553788e53164abefb0912a121fdf96

SHA1
f4536367267b292a7ee83c57ab5a48dd21f71593

SHA256
7f6bc73124599b1a61005dbef164e3d840e6b70716d030866998d7cb64993f42

SHA512
ec9d22641fce0f78a51ac9baa7fa19dd4beee39456f6286b5f024a57a1d1718e9cec3a805e2fa384d38f48c876790fbbf64dab2d4e034780ccdd7c74f167795d

Download Submit
/data/data/X.God.X/files/PersistedInstallation8568729863439381075tmp

Filesize
90B

MD5
20d5c9dbf3e9f7ee605371da298a3339

SHA1
3954467612fd675fd0518a99ed89073da76f0b98

SHA256
678a37ba9940876d4a8adb875041662a1c0ddca698d7ddfb4d88979fd6cd02d7

SHA512
3ec7b3f8e4d918e280cd13609738f6d1cb4d58477b7a3c5ef4375f630262976d6029e675f54d3ab132429afc749373e0693e79864105329e79d57e8c8d2ea5df

Download Submit
/data/data/X.God.X/files/X_Signature.txt

Filesize
6B

MD5
960b44c579bc2f6818d2daaf9e4c16f0

SHA1
45e118d0563ea8581f830f46e85b60ae714faae4

SHA256
a7248eeb45eb1ce247f81693283e22e8b39e8a50890cecd22d02e75025547d90

SHA512
9b2ab664b8599c84637bfc6d49a7b7b040fb25dc1c522942609d1945ff51a89e9cf15d400ce082f1450ea028cc30843f3d38ae75c1eeb544ef978533e6ec55b4

Download Submit