c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5

Analysis

max time kernel
26s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
10-08-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

84164f77738a604232c7e497103d7b80
SHA1

5c466d6e0be3754e8cab2ba2139944b8d89ee749
SHA256

c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5
SHA512

74be9810cd4e23b411f6804904bc54938f92d2f5bf44abec16a825c99beb77e224524d2f24ecefcb2a05be95142c7134907185c41c9dce5534cb25d59357f8d8
SSDEEP

49152:/wa6XjRtCjJQ2C0L5jpUuIfvbnU2Ek8ocBlJixY+Mspv9qcXzqWC0eyeI2cyzVZV:/7SjRtCtlppUvnjHcB/i/v9qkzqWC07u

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

X.God.X

description ioc process

Framework service call android.accounts.IAccountManager.getAccountsAsUser X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

X.God.X

description ioc process

Framework API call javax.crypto.Cipher.doFinal X.God.X
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/cpuinfo X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	X.God.X

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

description	ioc	process
File opened for read	/proc/cpuinfo	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4490

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/cache/1

Filesize
702B

MD5
718bcee2026dfcd3cdb2936362b2a42e

SHA1
e6ab0a166b26ca4052b8a35836a69ad756245801

SHA256
3c8b088387eafebd5580565031a4ffae103f46018ebd3d46d728e5d4be7282c8

SHA512
fcd11e281fce25612d38673f53ddc405d67bd21d2ac57f8ec5afea4424231ddb666d5c9e23cea1a28db05e7712b8184dcbb763e33837297a9188dcec2bb572f1

Download Submit
/data/data/X.God.X/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
82e177b6c8f292f06ef93bd79a2ff682

SHA1
a80ec9ca93b72a8d9a49337554e732d8c4984d43

SHA256
8da15d1d057cbfd4107929cee8fac4e18efb6e00007cdbe7f4c8adeea2a8cc08

SHA512
b0b1d260173d355f0d62ded037d4e161329e6cf905b70402b45519249cb102fcc3e8988a4b340501b55d8616677a81781073ecd224ea483e381381b28c7182c4

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
43b65968b64552e3dacf517dd2bf8d76

SHA1
aeebd6da8a2745664e71dd9bdbced574b03f5d74

SHA256
0a03f726580a73aee5489a6077b88bfab1cc87f518085b08ecbf99772d3342ef

SHA512
78667d662cee9f1a5df66b972e94f93e720d88e5b6b0f287a939d14d64a43d6e0ae1a2b93a8d4b50352fc992ff8f7e15c4bf77593a0b9aead7cdec4032d9d58e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
0b6a6cef638388c53174dcf0fb209017

SHA1
52be0bce8badbe77ceafdde829382bc4b3b204ff

SHA256
9fcae4b83c7dd642b2ee3b39b1769321837cbb09477ac7c87cbd23ab7d3e2d6d

SHA512
b8ecd8a0711b6df21ee22d3919e53a74ae2e15c5a853d38b2e203cd8e7d14f3782b30ee447e50b2a798c899fe10ab647bf9b568d1b40522bc3841b8f4737952a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
b1f7730ec9c3a20afdb0b52a54528820

SHA1
f3cbc3896d6a989ef77b8c3cbcc5d470e744643f

SHA256
f3185c600321f7c12fbcc63b40b3779b5fbdb5f6934260145958b607022093f2

SHA512
2577f24e3c8d7af9329d8458f67d6ad6a10120f981a0515034c72535ed40ab476f3fd5456fd5862ecc16cabf9eb35def5bf6915a0b7a1dcb1d9e0623447e74e9

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
de82e2c94d2718988804b035a46d17b1

SHA1
705f5ff19093ad209f2a666085d6ccaed3bf58a4

SHA256
29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39

SHA512
68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d9cf75fdd1c2292d986f6c3d5d60f2c8

SHA1
07ecb1d3a26d952ae5fecf54f36699ab498510b1

SHA256
2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

SHA512
442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
b3640a8a5c7c78e223a533439e558ff2

SHA1
ab68b07fc9cfcafeea7e39ddc0cc22646de02652

SHA256
54df962ecc425e96919dc57995d721c1ffc77719b8f0ea4822fcb2057b47c4bb

SHA512
588130d7ee4381f012317d22f24dd5b39e74be1c68a985b85c21c9dc1cf6ed35bcc09ff3210a7738e63604c6af0be27ab671bfd78d7e8f41aaf01ffe811e6f4a

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
a6baa1e590e7231915e071e77520aad4

SHA1
07455a28c6f5268dd016bda4a5970b6e72c7d4f2

SHA256
b2dd113520240220b7dc9edddfd9a1eeadacb06fec92d909fef17a8c043e4d34

SHA512
9aab3f95329d63a259e59a817d7c13c5906a330f3a8e653c0a9cd393cbff6e8000d63592cffcafcd0ad4b0ee653547e73eba715a36f1d961515d034c1c830869

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
672fc490e0360a6e83b58a2ce31cdf7e

SHA1
987625364ca2a998d18f94b76665ce9fc602db22

SHA256
52021ee60a8b9be9af39fa3edc3478da1b70598f446825325a00bb2d83439837

SHA512
742d51954a3814fcc8940bf249bdf6689276a89cb43e3982785f711e95a9329ad67f0cb58c822a9a62b1e4690b67a3e2534ccf8d6626c8f3b80c882173e53565

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
9ac98cce43f0079e21a56831f1bbc391

SHA1
64cc5508f74cbef597f0fae65c788ef666bac270

SHA256
f8523c96895f31faed4c792511f78c64f3e02157e777668e22beccca3ee34e28

SHA512
38a58710bea23e01ae1bdb33975758e46fe16ef25ce58fef31ccfe27328e93c2a482b3130185f73713e1cefc184ba3970d66fc918fecaa03e006ee0e1764a442

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
bcf544f79d018f0e925830fb08fa320e

SHA1
6834c84b0e66e076c8fc85f5fa2df0accc9fb0e8

SHA256
9e674d7e2f9dae66bdfc7ac0548ae9c69ea92642ad3935263c8261bde6a48edd

SHA512
ef4bc181f02d342455ca27811d984395f7e726569d7cd25ff5ebe4d8c7757098a27640712cc81caaeda2d932acc7b3a8489a7837840bb06e0a1e6d7cbe6eba4d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
c19a45865d041af075baa6aebbfa6a39

SHA1
011eb3df7b79952f1d54249f81b9a7739d381c94

SHA256
eb99cf23be9482f0095491b1057370858fb1f012318657e81515bfaaefd7292e

SHA512
d6c0c4912086ccb0347c0f071ec743bcefd3a54e4cb2cd71c6f349a1b285569eb29ef41fb3da0c46dc3c3cc9c048fcbe01d104847555098b0b436171e808d795

Download Submit
/data/data/X.God.X/files/Domain.txt

Filesize
381B

MD5
6f1d334c9695835852e19ed4163e6b97

SHA1
1989cb808fd3e203eb77f8e00a8d4f3794dfda91

SHA256
a5b0cb36bbe9d80a6b8abca5d2364745e93e6564b3701db24144aa2d4a1d05da

SHA512
3da4f14bef9e21f213fdbdfa6492cacbd115d129e258bcf5ebd1d64bf9bf97bb8e446d3378df82e94cf2a839b84e8641e57154b3c0b02b83467cc9fb6a926ad5

Download Submit
/data/data/X.God.X/files/Information.txt

Filesize
31B

MD5
c8228aa1d400c839f1d60a60077be03b

SHA1
b19ccf8fca76d532a57f1218599719a78bb7ff97

SHA256
0c71064b8b93ab709f94413fb4fdfc06c38dd71286fa31b9b90224dbf7eb1028

SHA512
7587003996644521a40f73cfb8160d5cd8bef3cc70eaa60de855e3c7e5db3ee8b19f35cf05d4e6a9f8925e86426339d78f6f6b3daad646b8bb9cd3699ea503ed

Download Submit
/data/data/X.God.X/files/PersistedInstallation7445040782172934968tmp

Filesize
90B

MD5
cfe0c69d6bdac751d4198bfefa60e907

SHA1
a67176f10d0594ba09959c74c988f90199fd72da

SHA256
175e1a70419463523e3f525726a23c4f9a8be94c3adf89402ad070acb7f01237

SHA512
0071e4941541d16106ed094918226de92d0f8fe3cc44060554838445e0ee10a589a5ebf17c8b88c7571212b13edd447af5190e8fae4d2a45375a5600bde50e9c

Download Submit
/data/data/X.God.X/files/PersistedInstallation8070709282392150881tmp

Filesize
570B

MD5
8216715ace81a1e6e4b67f03b5c34264

SHA1
93394aa6d5e3922265a156d2661b3981ee5455f2

SHA256
9f5968da5936bce1e719dc0df0d668a5e22929ae375124b05090196a6058b522

SHA512
61a32a67ce27516f61ae672dc3299970a35ff59cee752b6eb4fdf73b605a2b9a8dfc4bed7f7e979e2ab37dbae842e734004b5553ba58445423a1999883eaa670

Download Submit
/data/data/X.God.X/files/X_Signature.txt

Filesize
6B

MD5
960b44c579bc2f6818d2daaf9e4c16f0

SHA1
45e118d0563ea8581f830f46e85b60ae714faae4

SHA256
a7248eeb45eb1ce247f81693283e22e8b39e8a50890cecd22d02e75025547d90

SHA512
9b2ab664b8599c84637bfc6d49a7b7b040fb25dc1c522942609d1945ff51a89e9cf15d400ce082f1450ea028cc30843f3d38ae75c1eeb544ef978533e6ec55b4

Download Submit