Malware Analysis Report

2024-12-07 19:08

Sample ID 241114-cxdbkawrbr
Target aethersx2-v1-5-4248.apk
SHA256 366dfa06ee3b58b13993052440b4fa1601a4ffda270f2de50f6604d0031922bb
Tags
collection credential_access discovery evasion impact
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

366dfa06ee3b58b13993052440b4fa1601a4ffda270f2de50f6604d0031922bb

Threat Level: Likely malicious

The file aethersx2-v1-5-4248.apk was found to be: Likely malicious.

Malicious Activity Summary

collection credential_access discovery evasion impact

Checks if the Android device is rooted.

Obtains sensitive information copied to the device clipboard

Queries information about running processes on the device

Loads dropped Dex/Jar

Queries information about active data network

Uses Crypto APIs (Might try to encrypt user data)

Checks CPU information

Checks memory information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 02:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 02:26

Reported

2024-11-14 02:29

Platform

android-x64-arm64-20240624-en

Max time kernel

84s

Max time network

134s

Command Line

xyz.aethersx2.android

Signatures

Checks if the Android device is rooted.

evasion
Description Indicator Process Target
N/A /system/app/Superuser.apk N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A
N/A /system_ext/framework/androidx.window.sidecar.jar N/A N/A
N/A /data/user/0/xyz.aethersx2.android/cache/1664557424545.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

xyz.aethersx2.android

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 googleads.g.doubleclick.net udp
GB 216.58.212.194:443 googleads.g.doubleclick.net tcp
GB 216.58.212.194:443 googleads.g.doubleclick.net tcp
GB 216.58.212.194:443 googleads.g.doubleclick.net tcp
US 1.1.1.1:53 www.googletagservices.com udp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/system_ext/framework/androidx.window.sidecar.jar

MD5 bdf3529e80318eb14e53a5bf3720c10d
SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b

/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-journal

MD5 4186e0e60f2a1363f53766ca7f5b5f90
SHA1 762d703773c21fe5befc24cbf1461380d3cae4e0
SHA256 7d228bcf56f7b4f34b80002cc71ddbfcf1c894dabb25d6a3c8e75a8c3b32f807
SHA512 0b387dae76a8446583a432146c6d0d0c5711f1ce8f9388a36f5e4afec3239065d5ae161f43ecfe97dbd31fb59b3e43cea6eeaf1f2201bf0b0ce6ce1be2bb84ba

/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-wal

MD5 577f2f5b250d95252722a19f91a98515
SHA1 4704d204a4dd512b884624938c06746173998143
SHA256 9df3b87863fcf4911f4c1ce89035f20733a43a22dd0138a0c5b4e54b6a62eda9
SHA512 90fcca95a4daaa9cea433d9db3fe029d10894f84a9968476ac684745db92c86cfa79a18d8696c2b4667bd0af44aa461306021ad615e3d38233542b29d8947cda

/data/data/xyz.aethersx2.android/no_backup/androidx.work.workdb-wal

MD5 75eabd5daf3406431d59ebf5ff07a57b
SHA1 9200b933557e75e169c73fef2c08c5749a69dcfd
SHA256 9b96031c07aa8e1a4c6ba1d2307012365c506fbc4178389c5bcf03c1946ebb92
SHA512 7cfc1033362c1b30129ed45bbd6aea88a09cb1599b06d51f1c733bb31a303a4d178b17e3f5e7dc520819851d03a11f8a09459e3d9c3989a91da3e52c5f5783c8

/data/data/xyz.aethersx2.android/cache/1664557424545.jar

MD5 dfb68e70e8eb84d844c9ce623ee069c1
SHA1 369e761858a904fe9fb89efcfc9bd3e6e56ee44f
SHA256 8ba015cb192f34326e6a46f765c6712d87c3797661541275c84b9a30ee449eec
SHA512 0d5f8ff91d3cd5c976cadf774b8d5cd6f276793b9eb9f3d8e7168eae122b0bfcffd833be9762de441d4b52f7bb3eb3850479aea37ac327be9b71910c6fdc566a

/data/user/0/xyz.aethersx2.android/cache/1664557424545.jar

MD5 722310b17c81cc3d780d23e1a63eb450
SHA1 0a0c1a939f923570e5da88aa5c7b105052f056e3
SHA256 9f2d7ff525ca785553557c351812252c0beface31440517e2f19929fe76472b1
SHA512 1a48e9383a0befb0c6b4755a8b56f352fba317910308f701e13ce8189c465cade6b0af510165d586745f1913a61cc68f91395949202394336a59c34596691a91

/data/data/xyz.aethersx2.android/cache/oat/1664557424545.jar.cur.prof

MD5 c6de14b21b772050623daa445ec51392
SHA1 fc5206bc178e104e6794e70cb7303f74f197b40f
SHA256 a194e09fedac7c8b10e91c9186392a68d0e604d43f8cf05a9d8a4e44b7cf58fd
SHA512 0bbfa1bc1bda88d9f3849183646ff0c94a54bf59be971c8e6cf83e070e9941107f03962c3f34c0d619240d1deb35c196adfa7b5504bab57ec32db4ee97786219