c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5

Analysis

max time kernel
26s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
10/08/2024, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
base.apk
Size 2.8MB
Sample240810-mapfesyhmc
SHA256 c03ebd3ca7deeb2d7de27a0201aee53298f0810755460d30fb53bb85a5c40ac5
MD5 84164f77738a604232c7e497103d7b80
SHA1 5c466d6e0be3754e8cab2ba2139944b8d89ee749
SHA512 74be9810cd4e23b411f6804904bc54938f92d2f5bf44abec16a825c99beb77e224524d2f24ecefcb2a05be95142c7134907185c41c9dce5534cb25d59357f8d8
SSDEEP 49152:/wa6XjRtCjJQ2C0L5jpUuIfvbnU2Ek8ocBlJixY+Mspv9qcXzqWC0eyeI2cyzVZV:/7SjRtCtlppUvnjHcB/i/v9qkzqWC07u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	X.God.X

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	X.God.X

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	X.God.X

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	X.God.X

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4490

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Path /data/data/X.God.X/cache/1
Size 702B
SHA256 3c8b088387eafebd5580565031a4ffae103f46018ebd3d46d728e5d4be7282c8
MD5 718bcee2026dfcd3cdb2936362b2a42e
SHA1 e6ab0a166b26ca4052b8a35836a69ad756245801
SHA512 fcd11e281fce25612d38673f53ddc405d67bd21d2ac57f8ec5afea4424231ddb666d5c9e23cea1a28db05e7712b8184dcbb763e33837297a9188dcec2bb572f1
MD5 SHA1 SHA512

Submit Download

~test.test

Path /data/data/X.God.X/cache/~test.test
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 8da15d1d057cbfd4107929cee8fac4e18efb6e00007cdbe7f4c8adeea2a8cc08
MD5 82e177b6c8f292f06ef93bd79a2ff682
SHA1 a80ec9ca93b72a8d9a49337554e732d8c4984d43
SHA512 b0b1d260173d355f0d62ded037d4e161329e6cf905b70402b45519249cb102fcc3e8988a4b340501b55d8616677a81781073ecd224ea483e381381b28c7182c4
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6f:TLiEq9zmzrfRmBEyPbP/P+/0Fl6ldP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 0a03f726580a73aee5489a6077b88bfab1cc87f518085b08ecbf99772d3342ef
MD5 43b65968b64552e3dacf517dd2bf8d76
SHA1 aeebd6da8a2745664e71dd9bdbced574b03f5d74
SHA512 78667d662cee9f1a5df66b972e94f93e720d88e5b6b0f287a939d14d64a43d6e0ae1a2b93a8d4b50352fc992ff8f7e15c4bf77593a0b9aead7cdec4032d9d58e
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFl3uuF+/0Fl6ldP7:TLopmzr0GSP/h1499FJhlFiD
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 9fcae4b83c7dd642b2ee3b39b1769321837cbb09477ac7c87cbd23ab7d3e2d6d
MD5 0b6a6cef638388c53174dcf0fb209017
SHA1 52be0bce8badbe77ceafdde829382bc4b3b204ff
SHA512 b8ecd8a0711b6df21ee22d3919e53a74ae2e15c5a853d38b2e203cd8e7d14f3782b30ee447e50b2a798c899fe10ab647bf9b568d1b40522bc3841b8f4737952a
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlu0w/k449blqYFl3uuF+/0Fl6ldD:TLYpmzr0GSP/9PKary5tz4499FJhlFiD
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 f3185c600321f7c12fbcc63b40b3779b5fbdb5f6934260145958b607022093f2
MD5 b1f7730ec9c3a20afdb0b52a54528820
SHA1 f3cbc3896d6a989ef77b8c3cbcc5d470e744643f
SHA512 2577f24e3c8d7af9329d8458f67d6ad6a10120f981a0515034c72535ed40ab476f3fd5456fd5862ecc16cabf9eb35def5bf6915a0b7a1dcb1d9e0623447e74e9
SSDEEP 24:TL6vpmzr0GSP/sPKary5tz4499FJhlFin:T2vArSP/sSaryzl5nS
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e
SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W:TLuEe9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download