Overview

overview

7

Static

static

6

546a1a9e01...80.apk

android-9-x86

7

546a1a9e01...80.apk

android-11-x64

7

Analysis

  • max time kernel
    2603658s
  • max time network
    156s
  • platform
    android_x86
  • resource
    android-x86-arm-20231215-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
  • submitted
    23/12/2023, 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    546a1a9e0136416704a94b086187cb29805508bbc1a8d4f146c09146179a1f80.apk

  • Size

    19.2MB

  • MD5

    5f20eb0d22f1f8b34f76f7955eb0adeb

  • SHA1

    7d78292fe71541c467f11761c00df6b74084b2d4

  • SHA256

    546a1a9e0136416704a94b086187cb29805508bbc1a8d4f146c09146179a1f80

  • SHA512

    28b43b0184152280c0c0acd464c878b5f1045558a27592b1cf31f73b3de5053e52a13f58bc6c1c2541a866858581a1373b72468b3327e1831f312ff5941d2406

  • SSDEEP

    393216:ojjQ9Zy1joIBB1uHRiNkr8scj+r2tF9Ymud3j7gfPdgZ7iiTrx5r:ojjQW1oQ2PY9F96TcGZeiT1x

Score
7/10

Malware Config

Signatures

  • Loads dropped Dex/Jar 11 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

Processes

  • com.xgbuy.xg
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4266
    • chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
      2⤵
        PID:4298
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4325
      • cat /sys/class/net/wlan0/address
        2⤵
          PID:4370
      • com.xgbuy.xg:pushcore
        1⤵
        • Loads dropped Dex/Jar
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4394

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.xgbuy.xg/.jiagu/classes.dex
        Filesize

        8.2MB

        MD5

        2f7c2a545fabc42357818c4d35052eb0

        SHA1

        de52edb45f76a000f2be429ef0e7daf7245c35a8

        SHA256

        7dcc68dd4f94a23b6beffb924eca54ea4a9093534b34fb377d6b9ab5fbeffe78

        SHA512

        40b6cbbcbfe0771469f025a1a798c4bff6dbbf55426220486ecbe7654506d7a240aba9b4d76db29e54bc468e44b996bb324091315cf7b1702bc0fc0573879f34

        Download Submit

      • /data/data/com.xgbuy.xg/.jiagu/classes.dex
        Filesize

        6.5MB

        MD5

        3607e9bc414a499b1da47aeee45672f2

        SHA1

        04b39c1fad9bd8b87eb58520ef98c649b4864a26

        SHA256

        80b924b9cb646f78b355227c8c265a0e694c3b1b2b17bce5c992fc8399e475fa

        SHA512

        0b3733811437cc28a57930c5cf57aa692e8e18e55c1dd3ba534de00cc374b3d1618a40dd0bea185d369816e96c67fe5d6ba981a51142f5f436997f0bcd574771

        Download Submit

      • /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex
        Filesize

        6.5MB

        MD5

        2edb8333947a3cbbf4f2ad35404817fb

        SHA1

        22ae5219b5a313b13dc9d65590507fa01cb63b77

        SHA256

        c9f2509cab8c706548fa84a52ec17f7477666cc5d216e2751023c13c783658a8

        SHA512

        f90cb78128e059c587698697d88a20a101d08965c05b845382316dde2015a9674b975d68fea7f4a457cfb333c741248e2d84a39f4ce6db60f5497eb431f86026

        Download Submit

      • /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex
        Filesize

        2.4MB

        MD5

        26cfde3ec0e689982b8c2c01e0313830

        SHA1

        e79bfad35416572ed90b33106b0e4353f609d742

        SHA256

        450570e28912a1267aca4a1f0c7f28571da0a6c83cb711bf6c35f6a8b228b4b4

        SHA512

        431268d92e22fb0a819384434ac2bcf1a59d18cd3300e13524baaa517641ed6cb2eb0d8a8747b75d2aceb73fa9b026005fe6cff339a47c8a119329f198f7972e

        Download Submit

      • /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
        Filesize

        455KB

        MD5

        e5a53000766ebc433b27d6a66ec4f555

        SHA1

        2c8f53f1c03aec2005bcad67d731f07261dabde0

        SHA256

        78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

        SHA512

        370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

        Download Submit

      • /data/data/com.xgbuy.xg/.jiagu/tmp.dex
        Filesize

        284B

        MD5

        f1771b68f5f9b168b79ff59ae2daabe4

        SHA1

        0df6a835559f5c99670214a12700e7d8c28e5a42

        SHA256

        9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

        SHA512

        dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

        Download Submit

      • /data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-shm
        Filesize

        28KB

        MD5

        73784de28b0b8cd422a37741ada3a38a

        SHA1

        a958121858d251df5fa32f9c36a3276b2b8fb010

        SHA256

        0275288be4114edb664c60bb6e589e78c7a734a57b0b3c704687153843294b3f

        SHA512

        5b2aa5b55a496ec63d6763211e22da990e35b270c54bfd7f286faadb1cbb9420954e16bb3257f3b4f2c2ac22c7c12174f4a7e368ebf1eafc6a77b1ae583def9f

        Download Submit

      • /data/data/com.xgbuy.xg/files/.jglogs/.jg.di
        Filesize

        340B

        MD5

        17235f40abb2a606b365e0695ffa5d71

        SHA1

        e089087472858236a291371eef86ef12ed33e980

        SHA256

        e16844c84d7405043eb44fbed78b506883c59de82dea8f229ac00182a50092c0

        SHA512

        dd3d8cc0c70cf399507c0b3df7285544edea4de0a1872ff127d1a398c7ae8ec975ad8cbbda9e298e1dce65ccc6c22981a3c19369d50a1fd125ca40d4e797a46f

        Download Submit

      • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ri
        Filesize

        314B

        MD5

        466b79e925a5a84bfe8b482a8e4ffba4

        SHA1

        36a04f9be90d45c4e53dae14c03f9ef44ab327c6

        SHA256

        8034cbe67c5ad8f2a306768eece95ea20d485dc44f9b69b3da729f345ba3e9ef

        SHA512

        aa8d67b6b483f1e40f25429e817df543ec874df49bd60ac0af0caa8dbb4fc49099a40f271cc7e03e025264259faac661920c6a050dd7300d4946f46b5cc89a38

        Download Submit

      • /data/data/com.xgbuy.xg/files/.jiagu.lock
        Filesize

        27B

        MD5

        5353a98d0572d4b0cdbf7efadbd391d8

        SHA1

        f4e2f427cb7d53ee16ac0288dba1ca2d24336f91

        SHA256

        e0e276274713b96b8998f47773f579bf9131f48ed7d0f50f3967a721e01ddea1

        SHA512

        3fa61956f1802c47ea0757833ca46a5d1c3a4c0c7d3d3e70ddc1aa744d0d3de634177de19886e12084916d293966dcb5f8b8203f3f3e5633d75220475d998a74

        Download Submit

      • /data/data/com.xgbuy.xg/files/sobot_chat_log/sobot_chat_20231224_log.txt
        Filesize

        201B

        MD5

        dd7d16c9cbf92bf134c62df5ab9651d1

        SHA1

        e77a2d7563a513200ea066191fbc87bd7cd91874

        SHA256

        0eac80b8cf79d51eb5e10033c1a2cbe4d71d241df7427af3cabd8b8edaddd45b

        SHA512

        b1a3e1db259f05f44eb411bd567e7e4327b12b43b4aa7c8395e74ee4052dde875189894e53efb8f988436181677b36c86e36591174bbb28e9f03eda488f5cfdb

        Download Submit

      • /storage/emulated/0/360/.deviceId
        Filesize

        48B

        MD5

        1d8d16c4e3b19ebf18988530d9b9a757

        SHA1

        bc94c1cce05cd848a53271ecb9c5311e27ffebf5

        SHA256

        abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

        SHA512

        4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

        Download Submit

      • /storage/emulated/0/360/.iddata
        Filesize

        32B

        MD5

        75bc1c5fc446d0d39b42ab0dcddcd87a

        SHA1

        a946d232747836340e9e3de5e3e4dac985fc04da

        SHA256

        022ee48574ae3615bd5d2bb14f2b1cffa77104ff6390f47f9ab0bbdc1c84cafc

        SHA512

        7d131367b15bf3d351460637a55ad72cfd87834c1e865f470b0d22127d3f14814a12367d607227e215a8f29bb5cabe345e9914fe07d4f7c8b274d80cfba2a57c

        Download Submit

      • /storage/emulated/0/Mob/.slw
        Filesize

        66B

        MD5

        19402718bfb1c685a726b4e1d846ad98

        SHA1

        02a7e30044a67085f2f1da24e16e4ecfede65b72

        SHA256

        079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0

        SHA512

        25254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b

        Download Submit

      • /storage/emulated/0/Mob/comm/.di
        Filesize

        57B

        MD5

        70a42cba408700f9a6c01c7941a8829e

        SHA1

        eab01cc2c0671538795fb0b1146017dc099d0984

        SHA256

        499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

        SHA512

        8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

        Download Submit