19390c5069814743cf75a979e733e54846b26c38fef6e6063d2127d8fcd6dc25

Analysis

max time kernel
20s
max time network
168s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
26-08-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19390c5069814743cf75a979e733e54846b26c38fef6e6063d2127d8fcd6dc25.apk
Size

2.8MB
MD5

a9c325de4633252138fb2892717feffd
SHA1

c6e2cecf49e761cae125c8a7f1469535cc71d5a6
SHA256

19390c5069814743cf75a979e733e54846b26c38fef6e6063d2127d8fcd6dc25
SHA512

52a665c9016c4351bb59ef3a215895132d2e879b46cf4d3977bc6ae550a450f65d7860f7d99665d174ef54a5846f81d7ed2269a333290b1617d89b87c8d5e995
SSDEEP

49152:DTbdsl35rnglmqdJy2WTx8Xt8VaamfvXV+1tda1Mt54OLkf2fbFfNTeMv0HDHN:DHy0mqTy2UU8ViQv+Mt54CjRFTeMvWHN

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4927

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7ed2b6c8c3a1c1add1b9eef5f27ba149

SHA1
84ec2ed1cf9b3ca5a7ddabd66697075d8de9d59d

SHA256
04b253774e95699897435808de07e01bce36133f390d2f6379cc4efe7f2f349e

SHA512
b5df4be5fdda43c9b4dc126252aaea69690011539307e8ecd73c405bf9a76c0e1851aa6b601dc5207eff3e85aefe570e5721e234a94c1c9ffe3bd6a17b65837f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb87e8c9c09aee1b6f20dcad75ef39c6

SHA1
a74c1099cce76ba2a808a206c0820e700bf85666

SHA256
d1030a311f9c346c34be9cc013acf6f985d305ff24437ac610d8afe48e7a0ea2

SHA512
95645536437b27b912c2b0447a9471244abc83cbde85ac40d84211066565a7406716278aa645c884cf5875565ab5be91d1b5bc84010d3ced872812c0b888f8e5

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
05376907613c42980ef338215f1f9572

SHA1
fd0c963cba344402142f18f4d2620f7b553763c1

SHA256
771f7662e3ca0f2a3b6ee9e6505c57d9d4c570a61acd663c0c1c5d82d74c1b11

SHA512
3dcdf4a7dab044db74a615e4a2bfac274dc50e8c6cd0025eec93d88c8f24f2d45c7cad0fac6db8a569b740defb8d3431aa499b6dbb77f9fc100dc86f1985832d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eec686e1d2c0129cd7453c79e984a86b

SHA1
08a874d919f9a56f87c3943f6f3c1b40a222ed5d

SHA256
096c2d4b85ef4d64e9cb5913a4f3020e5c682cdc6422b20ed1a04133c0e26955

SHA512
5ba1095fa702ce5f392831a0135609745f6a231e607cc7e35b84bc264b92947881fa4309dc2c45a74e005e3fc16f47f9c4025d169d322899df4a7c2ba1c754cf

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
0676af0953d12f26c361a63cf8111fbf

SHA1
991a654c4d21b7918bab77c2f24cfb37a996ebd3

SHA256
062dd66f65201c7904d688d57dde79cef8947f19bfa4d67134899de80ede3cb3

SHA512
f9607f69de99520bb4d3827c94b154f864484c627768ada45e418510683968c8635ceb5a9f8e791a1b48dbec6f28664bae918abf48e247bd413c696e4eb77c19

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
518743dbea7bd8451919fa3b86860f79

SHA1
cabbf6555b6d78cb51ceb6058d78c115e9dc0975

SHA256
3a0969ff511517cb1fbed9d84a19a4a9c96dc271dc0cff0abe617d86cc881a1f

SHA512
afca44dea0f9ac33ab175475efe8a369fe2035084ac9e69166a060f015d00d5c4b36507012439fad93996a4e2cf7e1a5550dba5173d93f9f61c257b309631b63

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
8838be5da27610344046099ba11d9781

SHA1
2f10a111029b12c872b62d9811787da3584a1d68

SHA256
5c728624ec7008b883fadc035e2e709fb55ec025529f0f7c593dc59adede1028

SHA512
1e3af28ae35b508447d84bceb7d8d16fedbd3df034d2d9b384db9bb967922fab8900bd7630112f034ba8c9ee4a835db8d52ffeaee331e8e7840008ecd3827e4e

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
e9dfc11de766733790686616177f0b06

SHA1
503856f1d93611fcf8609dcf2834f9be104be9fa

SHA256
14e9d70aea77d5a456e18af7ffa227715b0f6b40a88d582c4af233e70f49057e

SHA512
aeb020ac9b5eee1d1668357adddb874ca50342a98496fef48ab10a13e166c48777fd48870ad2ea4abfe4a5aa7d2936d465d69e39c350a0ebb2327952fe4f3247

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
5e8d2846eb37d3df21bfe8e01fb4f7b3

SHA1
87d5cfbdc02eb2fec1546c60146d6ba9c82ff119

SHA256
294e3bdae8bc0b08869494dd706eb22f2d046c2f04a653c10d297cc7be738345

SHA512
d392495ff03643211374c7b876bd49eca982a2e5e658b546cddb4a0fc550bc24fa3c3755c36275048cf15c4fb501776f22d8d0af26b30b9b84c76d285662046b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
0998e8ede7182d1d721fad8bfaa8a2ed

SHA1
09b7337ccae00632733e7a9ca03badd70718eca9

SHA256
f62eb416e2f2e7a77feb1af5dea3c928bd42f3c24fa8716a8627923d5680cf1e

SHA512
1741d795df9328c15d9a92d9c3920810871ee58b0909b81db513c26d4b2e87904f6ba26feaa5f1603e6fd96a17cc3968dbe4c6792ca2b76df54a2c2babf900bf

Download Submit
/data/data/X.God.X/files/PersistedInstallation1688584937477160981tmp

Filesize
569B

MD5
570e81e1352fa09550bf976d3f14249b

SHA1
9f84396b33e6a70a90e3e356b54ab3c4b40dd8b4

SHA256
d567557efa1e6a5ae898cd0f4191155d72fe17e5422a7976f5678ade94daf922

SHA512
0a8b686b41b1203b9cfc17f407309900745bfd6060e779c0ff2b6d1707723f91fb353fb6b66a77f80d8033a87d588d1adbaaf53d99d3232a5c1c3d004e39d8bb

Download Submit
/data/data/X.God.X/files/PersistedInstallation5977697576494860022tmp

Filesize
90B

MD5
40f7198df8683d87f290cc089db3c88d

SHA1
4b2c61839a1770a8de16108ba8a82ec33ecc76e1

SHA256
03a9d2807824983f34249d26e4f58f6b2657669a867a2ba05b46d54995043b8a

SHA512
f28556c8a317d16f3cbff02e64cff5471344a15a8f3187e9fd5ed62b261d1e125e4051b604838b0c8e0a5f21c54735955e61945988c732789cff5a84dc664f9e

Download Submit