fe4e6dfd3608d3ca567558d2bc77685c3b8b3650b783dfb248e29ba3d0dcbac9

Analysis

max time kernel
19s
max time network
177s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
10-08-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

base.apk
Size

2.8MB
MD5

7b39bf11b45453c54a771125af3787d3
SHA1

cb8ce2a7dab63d1de60f1216036644dba715b5eb
SHA256

fe4e6dfd3608d3ca567558d2bc77685c3b8b3650b783dfb248e29ba3d0dcbac9
SHA512

1f63f7a839d1ba506fc23ece9133afa02eb25a56fb0ae7af3dd9c0c628e320021f439469b514923d32e1fd7d66a8979eb304c3829fae4a069c0d761f75f65942
SSDEEP

49152:KTbdsl35rnglmqdJy2WTx8Xt8VaamfvXV+1tda1Mt54OLkf2fbFfNTeMvOefo:KHy0mqTy2UU8ViQv+Mt54CjRFTeMvlfo

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4966

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
8a547df3367906b2e09375b948efdadc

SHA1
141de8da8dd7897e80428fee958474788fa220b1

SHA256
f2f42f1e90e0cbce6283c520e0caa4823d9f6daf8b4749e965a282dcb2023628

SHA512
86f47faef9748ee474b824f1dce2afc13d8ae98167d21a2e8f02ea90bc1cc85c2e38990bd6f3b94fcec1924324e2396742d5f93d5ccecc2760aaa7e2d9e82948

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
4cf302dbf6cdb0d5dfb0be4fc4ea3799

SHA1
c870627d05866377870a02b763b3a584a808baaf

SHA256
b61fa7913b4536d692ee25dd6113c81826da418b146920a10e92e0797ce0dc61

SHA512
718b770e5cf8daf1c1c430c9e411d0feccc9ba9bf3748216941562656564cb2cbcf969f15b5142b7f94169e1c94aeb88f6c12508ccbc568f1fc90fa9f2183143

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
779aee512fbcd2ca0b8831deda7913c1

SHA1
673631f4c2d6e6f92e3789278d9b1e26b7b402d0

SHA256
9674132e8c2916e4fb602a716c754d3f7b9d265310dd114d66b977b08c3df597

SHA512
f33ecf38f4f11166370b35816d432056aa39fa9f78cbb9c4ca6ca4e5d4dc10c7295ff8d0dfb13eaebaf93bcc2a09513efa7cfb16bc859affd257eb09b4f99a79

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
4c226ca50202040ddb5defbc5ff11f56

SHA1
259943d37dfd9ef9e03f5a39ce20ed2f8fd9e170

SHA256
5926147af4d1d7fd2a7b064ceaaced28a5f2f68ca5fac82e4df553d95290d440

SHA512
a8b97447769fbb654cc4ef363caab1bbf8a7a0264b4cbd373555c5b6333e4ccaeaebde7775cc71312f8cfec6a1487dd53eaa1da0ccb29145ea06276089508d46

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
08cb73b88620641ed38c0c538e5ec5bd

SHA1
a54a8e2d0094928ace9982d9afa76f75b7f4ef8b

SHA256
f1ab79d75c9dd2fd26932f5af5a8fafd8339abb8cd6fab1c7f9d193065fc7a37

SHA512
be412923401afde138c8ba2c366471922414e7bf24e5d4e296acf77f3cef0694402f927ab398625d275b3dda4a27dbb355b5aaddff62b78658802c4d36cf89c2

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
f0f33cb3bf147b46d3de23c7876beab3

SHA1
0c70a5ef01f409836a8d8b406637486b0d7e66bf

SHA256
916eae1439d89bdca25a85844bd6102ee625e4b8810a25245eb1147c5f0e8e1a

SHA512
d254d4044baad2026cd10e41853f818249bd4ae940350dc1a6b459df95319f71cb975010a19b850e5bd371061ac53a42133c837711da758b7a857c655f3add2b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
fda678e13c654206bb80a0d98d271fdc

SHA1
369a22ab63e354266303d04ecaf579c0d7292c09

SHA256
53dcf7dd61f629f7df563fde7365b665713209b9c99c1c078a04e82a9314e724

SHA512
b89a9d37cf64af0f576f060d6ba3da85b3e2fcf4dbb6ad716105cb139346720d32dbf2ee6367957e34978c7796f2e13de26381773fc8ae460bcfd0743e8e0ef2

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
6cd8f64fee908b0c1c4c3c04237a3350

SHA1
51ff845e91b7dc01d9f881c5907fe14162ed0990

SHA256
abf917e01201950e25201d4f208740ec3a919fd03cd71c77d7549085b481581a

SHA512
14282b0eaf210d2154112be2810f9d1a930f4388d985a244d6dfd406ae37be2125601f5b97d4d9db0fe07d28e321039bc5064de60614aa8c8a738a83aea831b2

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
e90f056cc066931218bdccb73b53e173

SHA1
74c69fc8c5c16c1e14c0bffe44256fc02991ec2d

SHA256
9e634fea1656b8c3110d533f206365671385139d4bffda97eb8b3dcdfe0371f4

SHA512
3202a574909365b54e275a46ee84ac0553b24de71824a906bf0190a726804fa128a0f386d2470f043a24cdb194b9f75371bcda3fa7783472d5387f5911067137

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
303599c2e10d2ca0ef48294b1196f210

SHA1
1f883c2a62462964f55dfeef5dd6bb135e22dd9a

SHA256
569a3a9324badb3b5968b5a88930082185c1253dac8759676fce10f5c6ea6e4a

SHA512
ab8051cdc3d22528d06e99cc400a76b394e54f2f0cb7717c9b1d645535d6b2d8eab646afed48155b869f833c257987c57181cba8df7a211c91a9dea412079435

Download Submit
/data/data/X.God.X/files/PersistedInstallation5498942533329473767tmp

Filesize
90B

MD5
16346a36c89b0348d48b7a03e3ddf5d0

SHA1
8cb83f916fe5b6cf7dfea7d7167a3a4ddd00eff8

SHA256
774bf9ab13879c467df6b99958726d41463241a64c6de77598578cf2aee2e866

SHA512
d756ae46194b212883bb8b190a104d48d48c5b23041386bdae4425c207bc67cf615945fd279f334bd4997dee7931f3598f109a10cf099cbfc92d936b5fe6c536

Download Submit
/data/data/X.God.X/files/PersistedInstallation5709445931347181844tmp

Filesize
569B

MD5
d81bdbb3c8de87ae1e4ab3a85608d000

SHA1
d7cbd5b7fec8eac4218f086800bcf3cc11e636c5

SHA256
9937c502caa68a018d6b4b572fc2bd7f5e0ee5500a4cfc49a0eefdbfe9a87d04

SHA512
cc0d1fe6ea47c00fbd3241aec6637134dd2806c4b520a8618bc965af5c86ffc6561be7d828e8b058c163014fa5cf24229090188a77b97e7ae8a21e0861495699

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads