005885ab40e64b4532b2556d48b37a68ab4f9da57f218bf2126813282561a0af

Analysis

user interaction
yes
max time kernel
628s
max time network
1808s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
02/10/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Grok_v1.1.62_release.00_MOD.apk
Size 58.5MB
Sample261002-sa44rsts2q
SHA256 005885ab40e64b4532b2556d48b37a68ab4f9da57f218bf2126813282561a0af
MD5 ae58aee7eee23ad277c265d959f925cb
SHA1 b86635dd0b59a2dbce8b89379d9aa447d5acaaa3
SHA512 7a40154b8b1fc5b0ec0249a866efbf7a3f7dc8d69e1784b1ba8985bc36fd65e17b51981f04dc109b87e4a00655d3e772ae9f988eef528f49e660d8c6c49809d3
SSDEEP 786432:di1wz8VhcwjkaA7q5H7utYzU/Xcir84cN1pl/u001NEvNm+xpTd04iuZ:dswz8Dcwjkaht7uY8hr84P8NjnJ
TLSH
T18ED7F188638CEC25EDB26879890D3635B3393C74A751E3D1183576396CB7AF0832A7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	ai.x.grok
/system/xbin/su	ai.x.grok

Loads dropped Dex/Jar 1 TTPs 8 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4068	ai.x.grok
/system_ext/framework/androidx.window.extensions.jar	4068	ai.x.grok
/system_ext/framework/androidx.window.sidecar.jar	4068	ai.x.grok
/system_ext/framework/androidx.window.sidecar.jar	4068	ai.x.grok
/data/user/0/ai.x.grok/[email protected]	4068	ai.x.grok
/data/user/0/ai.x.grok/[email protected]	4068	ai.x.grok
/data/user/0/ai.x.grok/[email protected]	4068	ai.x.grok
/data/user/0/ai.x.grok/[email protected]	4068	ai.x.grok

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	ai.x.grok

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ai.x.grok

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ai.x.grok

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ai.x.grok

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	ai.x.grok

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ai.x.grok

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ai.x.grok

ai.x.grok
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events
Size 56KB
SHA256 6c3ffbc7e0983c66a82841c4f5034fb9887c6b80973468562f318be7c839eaff
MD5 a9f60c020201ffa56ce1092ce965c10e
SHA1 d6fb54b17776073b1e780ff7d44621d41b660d26
SHA512 f04f3a03f5d8475cd4deb586a2c9a1a93493a83762c0453c8ec3325d1e0fd7562995895304484dece93756bf758d0e45be01e115ceede0412a0c5ef5bd9ea015
SSDEEP 48:TV59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSKquFXfbSFTkpFItFXfbTI:tMEqzAiwIyNjaKqUbnMjbTI
TLSH
T19C43758D4A3C2321C66D647DD7E143A32B7C87DF531E976139A44CEACCC20667C258AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 781077a38c9ca5ffa613c2e6e194e56b5429bb1ca40b8cefc0cc6bf34d969013
MD5 912eb3e16e4fd1a796c6d8913f79b1be
SHA1 097b495ceb136bd158cfdfc110d63c28e25d1a14
SHA512 3af83268842b6f42812421a5dfb8756dcfe3ad5e56581e15967e0f6061e25579e91e3dbf42a9ea85762af3e5b9421760c743781a1b440c0f893cec6cbdda4f7b
SSDEEP 6:7+/l9it74n1WDg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKo6:7+totPqLiuWd7RmBEyPbU
TLSH
T15402C0DCA7C10823C81D5677D0E893820D00F7188377CB2705500C943C434CEF4A0D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b758553d0b10bfb0ed4263f9a241452fb43b8c9787d0e256afecb83cf065d57d
MD5 677840e2004e365f4d950387d511857c
SHA1 326bbde8530325745c46d0ea2a6f874e5a12a5e0
SHA512 a325c2e4be74fab4373b699856041765ca34a87e32271ad236d3e5fc8607c6007f55236a7a1ebf0c5b3a97c42c2169a31143c0bb8bd4fb60acb08dccf2ddb7ad
SSDEEP 6:7+/l9rCGPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKcV/O:7+tY6qLJdKBRmBEyPbVO
TLSH
T11302129967410963C9195B77A4D983941F10A715C363CB579B6008556D466CCE8A0DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 7a6a76b959afa3bd967fbcdabb5f7f0fbf46add7d6f2e8e06fbfd6b007cac26d
MD5 bc897c275d16e7095e7f13ad1860820a
SHA1 22b3cff71c3ca0765393b814141606b2d9a52414
SHA512 d0caec0470097f2b2f0ced0ae77c3073b93098c7d09b49f7e0c6d6ebfddd9939c38f75fede0228385d12be74824a93666c7842a6dab75e02ba4f1e387d5bb85d
SSDEEP 48:7MK0KqF59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSnG:7/0KyMEqzAiwIyNjaG
TLSH
T151B2635C5D3C2611C6BE283ED7E142635E3C53DF572392603EE48CEA8DC256EB0355AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 343a5f6485a9f690b284e435ca92fdca3715058215d578ebcbb57996b9503d07
MD5 81389df3f5daa76869fb0b3e5d3367d1
SHA1 5277e50ae75f2a5b5143e6eaf2d795d8a23febb8
SHA512 eed6742e38580fd94049e30f458b6f0d0c9e0e9c52d2f4032ed959807560185c7542d06a15545214c20c451fa4b23a2c0d046b4e961b305e1ec2a0e3d9639d42
SSDEEP 48:7M+MtFXfbCVVFXfbCszdLOC6b2Fw6zNhSWyiqV59MENkMwABdU9dndVd/729Ivdq:7PMjbCpbCsRLx/rDvPCMEqzAiwIyNjau
TLSH
T197B2B75E5D3C2221C17DB4BEE7E207A32E3C53CF971261203A945DE98DC156974219F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 3592cab8d4b68b956e6e800b9154ba3c0c509e996e7b7cad95985db60c9d9a28
MD5 30d8a66fb0c1f5eae0ef7a2fc5516ef3
SHA1 d28d150d84795490e733121eb7517f19a8467e97
SHA512 78c1ed118e59e3a759a03cc8b26fadae781bb65bc236c554aa5f6bf2319d5d66267352d84d3de069ebc09e5d0c7f19c29e497170d96024af678a2d57c8138019
SSDEEP 96:765beyMEqzAiwIyNjatpiMEqzAiwIyNjaA:765bee3Cpu3p
TLSH
T18C92869D5D3C2311C67E683ED7E243A35E3C53DF572391603EA48CEACDC246AB0255AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/ai.x.grok/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 726e7830f2c2ef664a5c6a416c1d443f5c9e9ca38292e215d60b6ad030058561
MD5 342bedcee5dbb81a6bf2ecbf14d1ca39
SHA1 246708a62ad0a244b5f9bb4c59a4ab1013e50452
SHA512 d6b92015077219ffa62df35a470ce03442dc07028503c877f82ad2ede8a9819a3506900d99beb3e67af5f5ef223ba13a2c5795e14fd8f0c6b8c05e0ac2e77e49
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/ai.x.grok/databases/google_app_measurement_local.db
Size 16KB
SHA256 2a340388f145288c8867ecda5c58991d8dd97363ac730d5a0251136491461a20
MD5 8226b5c8e42bf2eb5cf43ad049baee4b
SHA1 2b9e16b59135c2a51275c60a1258a0e3af8a0e51
SHA512 a3da4d57f315e982a474cad7a762812b7461e3f8e83b49edff8afcd4ffc4d527557f5018e25c8549454b30dc7ea56144524008be4b373f53ac306e769c0dfd8e
SSDEEP 6:l9bNFleLIls1mP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK0DqiOwVQ:TLDEm7LzmzsRmBEyPbBvOwVQ
TLSH
T10372D8CD8F10A206C617033770CAD3950F78551E83679647166408615E52198B051E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ai.x.grok/databases/google_app_measurement_local.db
Size 16KB
SHA256 a2480770910e5bf080ee5a8070f1366a929914d676fb97ecd926114aa80e76f9
MD5 b7ac32cc2146141ef9e72aec25806764
SHA1 7745afd93274d4cc3178b17b65708ef18a315f3a
SHA512 4b4cd8ae65b37faf115fc5afd921e7752bf650f42e653bb69aceebd4ddedfeb866ea6ab90ef9e229dae934dfea72d9054c3b3cd054ec3ae8e35874b785a11fdc
SSDEEP 12:TL6Esu7LzmzsRmBEyPbP/DvJ+/0Fl6M2mL:TLzHmz3GSP/DvJlFLB
TLSH
T1A6722BCD5E10E703E127473A70CB93D71E38611E4367D65B3A640969DD532C8B152FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ai.x.grok/databases/google_app_measurement_local.db
Size 16KB
SHA256 e90244bc9354d02425a043ffae7c29ac14066fb40134355993c9c01b7ae9f01b
MD5 019e0580ac70a4359dba64f80720244f
SHA1 e790f6834f449b43cba363555e6b9a58fb880e1f
SHA512 11ad59de596a5ae679c94f65f368c6da4dd6a6143b594625bb196045a85cc87a7b91cc9c3a79b7a41d81e721a50a0976c3946de87c4d882117d9092940c9eec9
SSDEEP 12:TL6UE87LzmzsRmBEyPbP/h1V49blqYFlXybvJ+/0Fl6M2mL:TL6gHmz3GSP/h1V499FivJlFLB
TLSH
T114722B89BE24D753E267473960C7E3D32D38312B0767D61679150B2CAD433C8A461F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ai.x.grok/databases/google_app_measurement_local.db
Size 16KB
SHA256 0c4f4e0eb0e9cbbc8178090bdca98204f2b6c34d0dfdd907296ea733d37ab145
MD5 70e2157e4edb1ed379e9197c7ee5d906
SHA1 f36925eda2e0d38bc1534ff8a0cd87f21488ed8d
SHA512 4f50a18cd23270252aaf75f91c579a92d3ab3840938de376df09f8c479f6f3c38eafd3927ae3cb2d02ba42df6d62fb68216cffafcc2738fb0fa0d2d66c23aeff
SSDEEP 12:TLUEgu7LzmzsRmBEyPbP/O0/XOLabCAUIQUyWlLaIA49blqYFlXybvJ+/0Fl6M2e:TLQCHmz3GSP/RKabCsc7499FivJlFLB
TLSH
T145724789BD78DB93F2674B3D60CBD7D22A38306B0727E25379191B2D6C83384A561F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ai.x.grok/databases/google_app_measurement_local.db
Size 16KB
SHA256 8a4dc1ddf2f5ad90cc0a01b422bdce672cc6de2dea21cc2b31d87599c7cc9cd9
MD5 e00faf57d29713c3feb24b34434c20eb
SHA1 047c6473a99105417bc28bdbbb509e57e8d60dac
SHA512 2c801a2127415aadc4e2b9c0c6c85ea48a06987361803ba633eb5a6efa6da872cb99e170ad31ea46bf877d09cacdb4cb21ad0f7fcac4c37c884aad98a992dc68
SSDEEP 24:TL0bCHmz3GSP/IxKabCsc7499FivJlFLX:TPGKSP/IsabCsc8521T
TLSH
T1BC722885BD68DB92F1774B3D60C7E7D2293830670727D21279161B2D6C433C4A161F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/ai.x.grok/databases/google_app_measurement_local.db
Size 16KB
SHA256 7e929e88e0110216154d08871b5664bf7c5fc5a1438d99f76d44e5b9cec92678
MD5 df95d8195fe35113558ee7ab8b058d7f
SHA1 ec7364b3dd61b9882175a5c26b51a32f08ec74af
SHA512 f454c07c32a082920259338a75026b078e1aceaa6729702dddd953bb94228c9ac7b6560b1be42737b4c64114a66472cfe46e34ba38359eaeedc1d2086a20f7b8
SSDEEP 6:l9bNFlils1muP0QHzyAgLusi2JLnGLNyL1ERX4PBX4ogLugMBX4suuK+/WBC//I:TLIEmu7LzmzsRmBEyPbP/WYI
TLSH
T1007226CD8E106203C167473B74CA63960F28911E8377AA531EB408649E53288F091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download