93af370c16032f2b34ac2280d50651708249a5e4729d4cd8fac05d3af184a7d6 | Triage™

Analysis

max time kernel
20s
max time network
130s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
21/08/2024, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.apk
Size 2.8MB
Sample240821-gn3mbasgpf
SHA256 93af370c16032f2b34ac2280d50651708249a5e4729d4cd8fac05d3af184a7d6
MD5 ba4d33a8c94eb2d7964922cfcee82d3f
SHA1 5816ae891e89185f9d13f4592f3e39b5fa0ae009
SHA512 c6d82fbf055e7354a83d1d9a8aff9767e10a13c5ee43046da3a298f7581166ee286e64c8d211f8442bed8791b0c9154cc4e9dd1f6d8189d4a7e89bdd145b1724
SSDEEP 49152:TTbdsl35rnglmqdJy2WTx8Xt8VaamfvXV+1tda1Mt54OLkf2fbFfNTeMvtu/:THy0mqTy2UU8ViQv+Mt54CjRFTeMvo/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

Transmitted Data Manipulation

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks memory information 2 TTPs 1 IoCs

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks memory information
PID:4468

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Replay Monitor

Loading Replay Monitor...

Downloads

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 482e8e66b47b12ea56ae2a979941e3e05687733a480054e7c667f04b85871c95
MD5 26a38157e35a4785b7317ddc9ff19c50
SHA1 3e7ac857528b220454cf56039eb66651a6861900
SHA512 8ec1abda4c6b97dfc0c4529ecd10566635ddde273dea6904c4f324114810b3ff715c868e7aa0c9c81851cd2bf9d9ad0b710ccc07fea909d29ca16e5461108da4
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6e:TLiEq9zmzrfRmBEyPbP/P+/0Fl64v7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 bc67ffc84600fd401880470eb0558a86d89706a1048863859be634acc7de6da1
MD5 6905a9996e070ab72fc9ffabc2b79083
SHA1 40941968a85cbdfcd28e46ae043d7b2d923dab9d
SHA512 ed9c5657431dc11e01211dd641d5a1495b17923609033acb0325daab79994e0a077e525a87cd935d10186d40322a7d05883c8f94a3e4b4a048a9ee54761e7b84
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlVmH/+/0Fl64v7:TLopmzr0GSP/h1499FrklF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 aba56b09b8abc3347623d73e17622d6c7eaa51ad9fb2cc0a11e750bf6045b3ba
MD5 0903708452468fef974ff6847eb4305f
SHA1 558203f75bd83721c26f909c9a3f780c72bacc63
SHA512 7ac6383a305760cfd2f71ce16a184c1d7455804c5f14686d15caba1690ddc4f174c22d894684cce6f0de3a724c234721cde402a477d727a0092d93a2d7f51879
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/9FAiOLauK/6AUvkWlhhoR49blqYFlVmH/+/0Fl64v7:TLYpmzr0GSP/9PKary5txi499FrklF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 8ab67fdb24e817a8134404f799342e33a4a22b7f55db60bb149c4fb743e2f567
MD5 800a46928f738ee06462247e5abf8972
SHA1 8216378ec795b22083a6af19070130593258f287
SHA512 7567cee3171e876309b27e8f4aabb03a6891b24e76fecde27196c31968f8a6ef6b655fab7296f52c9a639a361d672e5597c11ca6a2c719ceb580dabb123a9605
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/sFAiOLauK/6AUvkWlhhoR49blqYFlVmH/+/0Fl64vv:TL6vpmzr0GSP/sPKary5txi499FrklFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 29110e626f8f49171d14a819b34492d094120f21ed7a963007fe95439d771d39
MD5 de82e2c94d2718988804b035a46d17b1
SHA1 705f5ff19093ad209f2a666085d6ccaed3bf58a4
SHA512 68f5f88e638e76cb5036dad6b320896f1735f64067ace152e0baea81e9ea0d153559f53bd5c608b397281369dafd14c5f5965f92f567dc89db157414a699023e
SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W:TLuEe9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/X.God.X/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/X.God.X/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 a07a2a4cfe964677819cb0a5daac29f65da6ff36ff525fe93056bd1857963584
MD5 b68b25fd21b6f2164ddab753f4a47a12
SHA1 7afe4b028b49699bc4f3f9f57cc3a72a74b4a218
SHA512 6cf45ffa021b9027a089f0f0dedf87e3808385f1c8fb406ef57abcf17a48b85f7739725d6cd46ea9df2a33188f6347111ece26e135a9d6ea4ea941b89910e44d
SSDEEP 6:7+/l9TKDqug9bNFluls1EnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK7n:7+tB8HqL8EA9zmzrfRmBEyPbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/X.God.X/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 dd1d1be926f84fa16c051adb97ab656a81625053a8113cfbc4d30c4b366a31d4
MD5 a0976798d5d57c575d1eb2359a2c43ba
SHA1 8565e1300cc378a83b4510e8d8df423760ba69fe
SHA512 fd2a5d433d38360efe35a6118d771d23a3651968eeb72d23ff8e74694900ae3f9f59c9672fb703ede1635c48609dccfce3d6512abe178968fe5f4d353e730fc0
SSDEEP 24:7+t7PKary5txi499FrklFeqL6vpmzr0GSK:7M7Saryzx/5rgeq2vArSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/X.God.X/databases/google_app_measurement_local.db-journal
Size 512B
SHA256 4268a61f465420b877b3dafe7567d3508cee9cf0ce7df7297d6b06af14906a54
MD5 68e49d21e99f8b7d44cc9585181323b3
SHA1 7bf3de10ff334ddf3c97d8cbfb324259e2893dc6
SHA512 29cdc0e41019eca5ee92e712afaeed0192d820bdb705436699fac638f720c58217dd1c086dab1d3a899a04d01538e6ac8bf1192ae91b39ac470615b9eef2bf6a
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db-journal

Path /data/data/X.God.X/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 2a5802cd030175da1bbb042de22d4248309bb5118d494d8f48a16cc910e4374a
MD5 4782c1616c8f79ff7c95046c8305028b
SHA1 0d8871c6862967a0efcbfd99d3820b0208148232
SHA512 ee54f9017b15d8832251152a8f535099cf7070663bf8980a537e9afde42aeca81da8b0e0615181dfd162f7dd3221ee09730a7a38d93199eb907eac145e6cc189
SSDEEP 6:7+/l9qn1rJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKe:7+tkqLiuWdYRmBEyPbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/X.God.X/databases/google_app_measurement_local.db-journal
Size 4KB
SHA256 7076437f63b719895b7fbab08445f9dfb28f765e9ff34954de385cc51ae2b98f
MD5 b2c69267e2794648c6540442d73b0f73
SHA1 7955f30c54b35f002ade58d8f556dfdb8eb98b07
SHA512 a87534f50b2446678ddf934288a43610e2b860b1c45b66a4368f98ca3553f1a4f93bc93d7310dd27aa24e6fb1b77801a54e9414c875323966a75268b4990aa0d
SSDEEP 6:7+/lTXtgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKn:7+tTyqLJdeWRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db-journal

Path /data/data/X.God.X/databases/google_app_measurement_local.db-journal
Size 8KB
SHA256 5e0b7e466f9f1d86bef76ae8cf57d389ccadff97e429c16217a320818fd2e6bf
MD5 02465573a706d7ea02963c404219601f
SHA1 07cd219009b0db8d96ae24eb3ac6e2b82567ee1a
SHA512 238910d3a2c957aa6eca255e15b04ee42ca86a263278afbd5dbd979f77f73c0beae31cf09124a6d81e257e0bd4e2a58bcc3af37b04feafca2bc80db33dded8af
SSDEEP 6:7+/l9pPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuK8d/y:7+tzqLmqKRmBEyPbdy
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation169866445362236739tmp

Path /data/data/X.God.X/files/PersistedInstallation169866445362236739tmp
Size 569B
SHA256 2b231b900e1b7b38bebd7ea7084f1adfc11125da8608d25f8af3e69057761854
MD5 8534a8594a04abefd94a75d2c2b6d3af
SHA1 1edb809a718eaa4ff32f39c9b3bc60eee25c7762
SHA512 408f0afe8c2373999abec4d353fb1a0af3add8bdf0fd4c3d50df05743e4f589708be98b81cbb3820f456b34d162c8a10f1f3213ec324bef9e0f359d0300c22a9
MD5 SHA1 SHA512

Submit Download

PersistedInstallation2704903497358340334tmp

Path /data/data/X.God.X/files/PersistedInstallation2704903497358340334tmp
Size 90B
SHA256 9c91c59e3180dcc9d5dd7a882198046619cd4f26172a809094e4de5a58b74ca4
MD5 394f648ddb4a6050bdc206c075e1466f
SHA1 03e59f1f9cab3b40ac25389aff743fe41855af58
SHA512 d62e5140ae06da7c4040d6729421af94e57cd25ed572490b8871e28ec6b42861f41b129331e4e47414266c67e3fb7c0ed58e176c797e27eb9e17931e89817577
MD5 SHA1 SHA512

Submit Download