fe4e6dfd3608d3ca567558d2bc77685c3b8b3650b783dfb248e29ba3d0dcbac9

Resubmissions

10-08-2024 19:56

240810-yn7ppszbmh 10

10-08-2024 17:49

240810-wedn6azgnp 10

Analysis

max time kernel
19s
max time network
169s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
10-08-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

7b39bf11b45453c54a771125af3787d3
SHA1

cb8ce2a7dab63d1de60f1216036644dba715b5eb
SHA256

fe4e6dfd3608d3ca567558d2bc77685c3b8b3650b783dfb248e29ba3d0dcbac9
SHA512

1f63f7a839d1ba506fc23ece9133afa02eb25a56fb0ae7af3dd9c0c628e320021f439469b514923d32e1fd7d66a8979eb304c3829fae4a069c0d761f75f65942
SSDEEP

49152:KTbdsl35rnglmqdJy2WTx8Xt8VaamfvXV+1tda1Mt54OLkf2fbFfNTeMvOefo:KHy0mqTy2UU8ViQv+Mt54CjRFTeMvlfo

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

X.God.X

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Acquires the wake lock 1 IoCs

Processes:

X.God.X

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

X.God.X

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

X.God.X

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

X.God.X

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

X.God.X

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4989

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
35da56157253e7d82b41403662092a77

SHA1
0ab1f376b876171d970c594dfc1597f46964cc63

SHA256
98ed23ac87b5c8378b2d1b65d0875d5c9bdcb30d6c978e76327b8e9da1e6d917

SHA512
f7d3bb4e2fab35629734c63347c62add206f7e57659ec36061be5238beafe5d6f95dbb25eb6a81c7bb51514a3b98b88ef76c7a45aa03cb93a7bbfd29a0331ff5

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
c33d0f0e1efdd1e0ac6b99aa4ec933fb

SHA1
4e452ceca9c67bdc4fc02137b89807978f46f004

SHA256
b971d6ffc0f1914dbcf768bf10f8a0109e04d999e76ed7c39548c7bcbcbccbd9

SHA512
959ea17ce21edf853dce93887e6145767307e756543d32e9d1367ad6582c84b9506c80ed60741de3ae0e8c0f8abffb4fc50786f668dd81959fc1f66600f4b978

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
4e69df52f73d01df2596fcf10b793ed8

SHA1
7cca4da844e609b8d0313e4c7aa88ff777ac8fe5

SHA256
b146520e554acefa7f951b37b26e439b286b9eec7488183084141ef893eafc82

SHA512
0d1fc14a7d6ecf8e68d3659412adf3028302a306f6cc46812a69837ca052a19ff25766755ec5d308c09e44287c659a93e6040a5088b778dee2b01344eada4498

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
9350f545b3eec666b59e52df9b065733

SHA1
eda9cc36559b46565a61e724535e3cf9f491116a

SHA256
90411cc9ed4360be32f629859a073f42492ae5f41516d697f222ccffccc186dd

SHA512
92b447f79f0dc7b30a50f32860fd1a22ee9444cc5a4978c02f5aa98aa7dcc2fe63bab640f6892de52a42959af9d8b1032cd554eec2b167c95ab9adf4948ad841

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
12abcf4e3fca00bc9a41803d30de23fd

SHA1
8714eeb61b3496267197ae60c8b1de62f32f56b1

SHA256
6d9e78749df54308eb10f907a2a8248c569553698e3fd513b5c6d2e1f5eedd85

SHA512
3ad541f4dddcef150dec7f51ed2e9b07868f8e670736aa32c22d3e0c65a01dd54e22b2e9c0edd46f71615153ef835e11380097d52aa589f4c6aea1c5c73cb64f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
717cc9510d904976c8e087f7963bcb6c

SHA1
62df1467c877017e76cfacf9d2f5c2cc5ff1a5b8

SHA256
735c72905543eaa856b51c4d53b83bfdc59a576f22c3f61df7ffb54f68a5a5f7

SHA512
62063eb85d435c3f6462f1c944bcb3347a2de653f5a2559b5f29744b29e9bc6c055a947f46fca1a1a14f4ea8eacb513ff1e49dbea27ef0c0f0ffe89ce3a84647

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
a6b7a13249051ec8252a5e4d4a5398c6

SHA1
77e4a5883d7b1fe87d3fd024da6b40386f44f875

SHA256
ce94c444d474e55daf1c6c813fe2871f6ab6deb97840a5b26b7f012d86fc2168

SHA512
e000a5ab9d58b1d6e69e257f39ee9817b22dc5f1b9d8a2a115f4edbc065a2f8702af575a14b01a35bd1b80d25f20ac1a56682ebb482235c3e28a585f188fee89

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
5b06021a23a6eb160cc9faf9d1f3ef8a

SHA1
063d94efc58b23f3856084ff0289d022b8359b3d

SHA256
cdf2dc03c9803f6e36c5a0d33f958d7cbb6c5b91e4253d238b70e4b6073dad35

SHA512
fb4a224bb6ee95d524458d0f0bbdbe0679c2c7beeaaa35033191c77784feeb71171caa6ebecaf4e007144b26e8ce13e3c7e63ff36d10dbb285c8051cf94b216b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
682ea09a549f7b11f16ee679d3916950

SHA1
563456d60a19a1492a35b227495c44ad5bd4b498

SHA256
418f8693c9ec8abcb81593247546560dd440b28965e0151ce3d09bdb9dbd2039

SHA512
fc84e13588c31b7b3dade3488e753553c194ad28f001ce916cfc133bab7267400337311a31f3fb420d6cd3e6320c130815ad02a544cf638ce5b2bbe84e7f6110

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
2ca7a05e46b7d02b13599373c942c2af

SHA1
c10d4cfc4781ec42026d97511fe5341a185279fa

SHA256
b92e10152e067d084d9dc4a521aa0ccc0483002ee1f8da22ff51eb45bf31596b

SHA512
66b60578419bad40754bf48f651a7c8d904ec7d4a710af57d37f5155488581315be17d070324249274a6741362c16ca0e9da1d7c05f1bd49a9a962ce2f08a470

Download Submit
/data/data/X.God.X/files/PersistedInstallation4647314129837796498tmp

Filesize
568B

MD5
4eed7fff2069bbbb55fa46bb7541e732

SHA1
d8343d1ca7cf96419bf075a8a18106324975404d

SHA256
bc50a1b1905683065cabdaf53a1d1106c15e1587bc8465f1dd535ae85a0ae820

SHA512
e5b2aeb510b9ed2a45c05b10769e41e622eafd9aeb061b2daf86a8a6433f1777c67682eea68c73a72be641620231df4e16bcef693a7b7df24e74235108193134

Download Submit
/data/data/X.God.X/files/PersistedInstallation5277065147358464264tmp

Filesize
90B

MD5
bec8d2a232b5a5bc81caf55267fa1a15

SHA1
8bb29d08dfa639eb359698a209402bf093a6080b

SHA256
4e6247e80c0ddedbf1daf6e91a6d3b1793e248755147b37df4f675320c2d3044

SHA512
631b6466ae8824ac87dd426e4c0f5ab9030fbe41e3eaf00058b85ad821aaabaf4d9f32a504b379fc82bfee82a4ab113bc3e41d4dd09a4024f2c8f12878bf8178

Download Submit