Malware analysis https://github.com/dev-Ali2008/xanite/releases/download/0.1/Xanite.zip Malicious activity

Add for printing

URL:	https://github.com/dev-Ali2008/xanite/releases/download/0.1/Xanite.zip
Full analysis:	https://app.any.run/tasks/5f8f62ff-0ae2-4111-94ac-1e9654e9e6e2
Verdict:	Malicious activity
Analysis date:	August 11, 2025, 03:57:10
OS:	Android 14
Tags:	github
Indicators:
MD5:	F6401C2E11132FD57F83264A7AC9D4F1
SHA1:	446D8271594ABA084822D1FA1852C843C1A91C1C
SHA256:	8560E3977511A4B3B5E2DBDE0CA54A1847235C6FCB6B01E9E12A7B3B2807701E
SSDEEP:	3:N8tEdxAT3W/giMRA/MkCVPmLQr:2uAT3bvRA0Pr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Collects data about the device's environment (JVM version)
  - app_process64 (PID: 3285)
  - app_process64 (PID: 3249)
  - app_process64 (PID: 3188)
  - app_process64 (PID: 3313)
- Abuses foreground service for persistence
  - app_process64 (PID: 3249)
  - app_process64 (PID: 3188)
  - app_process64 (PID: 3285)
  - app_process64 (PID: 3313)
INFO
- Retrieves data from storage of application settings (SharedPreferences)
  - app_process64 (PID: 3285)
  - app_process64 (PID: 3188)
- Gets the display metrics associated with the device's screen
  - app_process64 (PID: 3188)
  - app_process64 (PID: 3285)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

158

Monitored processes

36

Malicious processes

0

Suspicious processes

4

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2214	org.chromium.chrome	/system/bin/app_process64		app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2241	com.android.settings	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2287	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2297	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
2338	org.chromium.chrome:privileged_process0	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2360	com.android.adservices.api	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2417	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 9
2487	com.android.documentsui	/system/bin/app_process64	—	app_process64
User: root Integrity Level: UNKNOWN Exit code: 0
2540	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0
2562	org.chromium.chrome_zygote	/system/bin/app_process64	—	app_process64
User: u0_a72 Integrity Level: UNKNOWN Exit code: 0

Add for printing

Total events

0

Read events

0

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

13

Suspicious files

67

Text files

6

Unknown types

0

Dropped files

PID	Process	Filename		Type
2540	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.clHT8n/list.pb		binary
		MD5:—	SHA256:—
2540	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.clHT8n/manifest.json		binary
		MD5:—	SHA256:—
2540	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.clHT8n/LICENSE		text
		MD5:—	SHA256:—
2540	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.clHT8n/_metadata/verified_contents.json		text
		MD5:—	SHA256:—
2540	app_process64	/data/data/org.chromium.chrome/app_chrome/component_crx_cache/cab4d1f0a6a2a1afecae808a520f6690dd2b9d58bf54762877f2dc9715d55461		binary
		MD5:—	SHA256:—
2562	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.K0RIlG/decoded_xz		binary
		MD5:—	SHA256:—
2562	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.K0RIlG/97b4e68a7a79ae5be44033dbc869b57b36884d4ba50887521547c98b08363638		binary
		MD5:—	SHA256:—
2582	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.71HhOx/privacy-sandbox-attestations.dat		binary
		MD5:—	SHA256:—
2582	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.71HhOx/manifest.json		binary
		MD5:—	SHA256:—
2582	app_process64	/data/data/org.chromium.chrome/cache/.org.chromium.Chromium.71HhOx/_metadata/verified_contents.json		text
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

17

TCP/UDP connections

23

DNS requests

25

Threats

16

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	142.250.186.99:80	http://connectivitycheck.gstatic.com/generate_204	unknown	—	—	whitelisted
2214	app_process64	GET	200	142.250.186.110:80	http://clients2.google.com/time/1/current?cup2key=9:vY-_Fro5EnbasUql2bafqDwulLJoMg3im1yYwsEvrI8&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acmmwq7dser4xm5sepzjv74g65vq_2023.7.28.10/cffplpkejcbdpfnfabnjikeicbedmifn_2023.07.28.10_all_acgbwixmcanakp2bkoppyszsbkrq.crx3	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gcmjkmgdlgnkkcocmoeiminaijmmjnii/284970dba1157444cf24e06eabcc032caacc9db8d2874ba5928165482c55e3f1	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/niikhdgajlphfehepabhhblakbdgeefj/97b4e68a7a79ae5be44033dbc869b57b36884d4ba50887521547c98b08363638	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acw66zgm43ukk33ii33pgnxbnorq_2025.7.30.0/kgdbnmlfakkebekbaceapiaenjgmlhan_2025.07.30.0_all_afknkgj7gscr5tgebq57c7xkuq.crx3	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/lpfsgoaj6joo7hjp2dz3kxszb4_9962/hfnkpimlhhgieaddgfemjhofmfblmnib_9962_all_poczuam4nyg4ufzyisyyyk7jyy.crx3	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/pmwjjzrzpgfwjodqqj542dn6kq_67/khaoiebndkojlmppeemjhbpbandiljpe_67_android_epp2f7wtecwsnk5eqcobxrqmyi.crx3	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gonpemdgkjcecdgbnaabipppbmgfggbe/5f34c9bf2b2538d819141934767ef38d10483a6b6d6130b8c21f741f6e2b89b2	unknown	—	—	whitelisted
2214	app_process64	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/0207e601312b7fda868f05461f68855ffb0ee024639ea7f521beb492bf7128af	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
445	mdnsd	224.0.0.251:5353	—	—	—	unknown
574	app_process64	216.239.35.8:123	time.android.com	—	—	whitelisted
—	—	216.58.206.68:443	www.google.com	GOOGLE	US	whitelisted
—	—	142.250.186.99:80	connectivitycheck.gstatic.com	GOOGLE	US	whitelisted
1760	app_process64	108.177.15.81:443	staging-remoteprovisioning.sandbox.googleapis.com	GOOGLE	US	whitelisted
2214	app_process64	142.250.186.110:80	clients2.google.com	GOOGLE	US	whitelisted
2214	app_process64	140.82.121.3:443	github.com	GITHUB	US	whitelisted
2214	app_process64	74.125.133.84:443	accounts.google.com	GOOGLE	US	whitelisted
2214	app_process64	216.58.206.68:443	www.google.com	—	—	whitelisted
2214	app_process64	185.199.111.133:443	release-assets.githubusercontent.com	FASTLY	US	whitelisted

DNS requests

Domain	IP	Reputation
www.google.com	216.58.206.68	whitelisted
connectivitycheck.gstatic.com	142.250.186.99	whitelisted
google.com	142.250.186.174	whitelisted
time.android.com	216.239.35.8 216.239.35.12 216.239.35.4 216.239.35.0	whitelisted
staging-remoteprovisioning.sandbox.googleapis.com	108.177.15.81	whitelisted
clients2.google.com	142.250.186.110	whitelisted
github.com	140.82.121.3	whitelisted
accounts.google.com	74.125.133.84	whitelisted
release-assets.githubusercontent.com	185.199.111.133 185.199.110.133 185.199.108.133 185.199.109.133	whitelisted
androidchromeprotect.pa.googleapis.com	142.250.185.74	whitelisted

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO Android Device Connectivity Check
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt
2214	app_process64	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access release user assets on GitHub
2214	app_process64	Generic Protocol Command Decode	SURICATA QUIC failed decrypt

Add for printing

No debug info

General Info

https://github.com/dev-Ali2008/xanite/releases/download/0.1/Xanite.zip

F6401C2E11132FD57F83264A7AC9D4F1

446D8271594ABA084822D1FA1852C843C1A91C1C

8560E3977511A4B3B5E2DBDE0CA54A1847235C6FCB6B01E9E12A7B3B2807701E

3:N8tEdxAT3W/giMRA/MkCVPmLQr:2uAT3bvRA0Pr

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Collects data about the device's environment (JVM version)

Abuses foreground service for persistence

INFO

Retrieves data from storage of application settings (SharedPreferences)

Gets the display metrics associated with the device's screen

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings