366dfa06ee3b58b13993052440b4fa1601a4ffda270f2de50f6604d0031922bb

Analysis

max time kernel
125s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
28-09-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xyz-aethersx2-android-15210-64551848-c98b0e4152d3b02fbfb9f62581abada5.apk
Size

19.9MB
MD5

c98b0e4152d3b02fbfb9f62581abada5
SHA1

db4f16818dd44be0f43265495329399a34919878
SHA256

366dfa06ee3b58b13993052440b4fa1601a4ffda270f2de50f6604d0031922bb
SHA512

fc32013738c398b84e08c063179906ae77b7e91270e3b7e531178c57126c272e9409e9437e54f462e472ed3c6f4c36a44d20b1148eaf12cba23a2f17794e7778
SSDEEP

196608:FPSxTxk+osnBEzvJBkN13Oz6mVHgJlsz9Tu34tCtwqp8qxqJ78fy21oAIPge:FPSxVk+ogizvXku60lqp89Wy3AIPz

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	xyz.aethersx2.android

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4504	xyz.aethersx2.android
/system_ext/framework/androidx.window.sidecar.jar	4504	xyz.aethersx2.android
/data/user/0/xyz.aethersx2.android/cache/1664557424545.jar	4504	xyz.aethersx2.android

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	xyz.aethersx2.android

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	xyz.aethersx2.android

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	xyz.aethersx2.android

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	xyz.aethersx2.android

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	xyz.aethersx2.android

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	xyz.aethersx2.android

xyz.aethersx2.android
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4504

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/xyz.aethersx2.android/cache/1664557424545.jar

Filesize
10KB

MD5
dfb68e70e8eb84d844c9ce623ee069c1

SHA1
369e761858a904fe9fb89efcfc9bd3e6e56ee44f

SHA256
8ba015cb192f34326e6a46f765c6712d87c3797661541275c84b9a30ee449eec

SHA512
0d5f8ff91d3cd5c976cadf774b8d5cd6f276793b9eb9f3d8e7168eae122b0bfcffd833be9762de441d4b52f7bb3eb3850479aea37ac327be9b71910c6fdc566a

Download Submit
/data/data/xyz.aethersx2.android/cache/oat/1664557424545.jar.cur.prof

Filesize
140B

MD5
1b4800b656aff7752993844a67bb06c0

SHA1
6694fcc39936db4408e4024242cafaacef7d8083

SHA256
d4937b1fa56bbf6cc0b3f3e2bbb5d9534b62266e9e010329a14454db213a133e

SHA512
33e6d62df45936e8ad037865fabfa710a21e7536c6d50f5e4decc818b3281d24cab35ebd5e7500e69847ab79553042aaadecf03b723a55f1a65330e029a3f018

Download Submit
/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb

Filesize
4KB

MD5
7e858c4054eb00fcddc653a04e5cd1c6

SHA1
2e056bf31a8d78df136f02a62afeeca77f4faccf

SHA256
9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

SHA512
d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

Download Submit
/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
c0f872cd9373a1e22cbe1e741c9373a3

SHA1
857f55f804c0b3858a73807e38ead82ca3d08db4

SHA256
b1281181612a96f53ba1993def9317f5f81a4bf80ff17dc6f9509678e66420a8

SHA512
cd50a317ead328964f9aaab11ce98bbb7bc83fb65b930cff8f50dc01fd95fa1e8cfb6cbd1719a73ef7318c48d4d23ca7aa4e51f5e561fc93eb027ab878d50d13

Download Submit
/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
d73917e1980d03312d02a2a4a1f0e345

SHA1
7a3df4a4257d6ccac75d7f4e87b0510cc99d491a

SHA256
a9ff69fe42a41113bee35132a4d05187c587257bd89dd24d68306f163c27fe5c

SHA512
35e0d2d26434fc2e4a4bd91b0c7f478f2467a0981b4021f5918daca7256b49ed5c02b31f6292c93c3bb2a96439849597cc2e4c7478939697576f45757f8bc4a6

Download Submit
/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
e66c88bf6a96e3314d5bc7458c58520d

SHA1
e78cb3a53c7d63cad5f3da3116b904e3a69c4ac0

SHA256
5ea6297fddf99ba06f4141e7f7cbead3f34c93bcb1169b5d5ef2c0e8d99141f0

SHA512
e921ce173f924defe62e2156435dcb852f038aafbf0c838ae86c4da7ee0fa40b886e6d2af3046423986aa360189a6ba001cdac6e7560cd273db4daeb27edb108

Download Submit
/data/user/0/xyz.aethersx2.android/cache/1664557424545.jar

Filesize
21KB

MD5
722310b17c81cc3d780d23e1a63eb450

SHA1
0a0c1a939f923570e5da88aa5c7b105052f056e3

SHA256
9f2d7ff525ca785553557c351812252c0beface31440517e2f19929fe76472b1

SHA512
1a48e9383a0befb0c6b4755a8b56f352fba317910308f701e13ce8189c465cade6b0af510165d586745f1913a61cc68f91395949202394336a59c34596691a91

Download Submit
/system_ext/framework/androidx.window.sidecar.jar

Filesize
12KB

MD5
bdf3529e80318eb14e53a5bf3720c10d

SHA1
25c9ace4b1af6e80ebb2572345972c56505969ba

SHA256
bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b

SHA512
48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads