Analysis

  • max time kernel
    148s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    07-05-2024 18:59

General

  • Target

    2146c7b5825d003d695b6df6222080b7_JaffaCakes118.apk

  • Size

    22.5MB

  • MD5

    2146c7b5825d003d695b6df6222080b7

  • SHA1

    1bbc8bfcc05351ec0416a4fcaad405477f69a7a7

  • SHA256

    8766cf0cc6d08c720ed329ae87c5f4ccb121d8c5a52e39d5933d81d33c9035c3

  • SHA512

    0f6b77c15f18a4b64404575fcb39ff68f86b06ab8f2c673817fb68712f560208195fa45ab4a0c8fba10eca22d46df40f4952dddec2cb49e74b3ad3346c67921d

  • SSDEEP

    393216:vQXmZVfO1+cVvpPPbUsMjSUylbz5Zmicp+r2tF9YM3c7gf/dgMRG4:vWmZpi+kFQjkp3mpF95sc2MA4

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu files. 1 TTPs 1 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 1 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.xgbuy.xg
    1⤵
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4266
    • cat /sys/class/net/wlan0/address
      2⤵
        PID:4325
    • com.xgbuy.xg:pushcore
      1⤵
      • Checks CPU information
      • Checks known Qemu files.
      • Checks known Qemu pipes.
      • Checks memory information
      • Loads dropped Dex/Jar
      • Queries information about running processes on the device
      • Queries information about the current Wi-Fi connection
      • Registers a broadcast receiver at runtime (usually for listening for system events)
      • Checks if the internet connection is available
      • Uses Crypto APIs (Might try to encrypt user data)
      PID:4304

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.xgbuy.xg/app_SGLib/libsgmainso-5.1.81.so.tmp

      Filesize

      591KB

      MD5

      c85e8919765cc22095d1b8e40601e34d

      SHA1

      22d48933b9f30a028cf4c9d993f59c767f9e8e35

      SHA256

      f4ab50b1188cc9913c106f1f661162cb7db90aa288a90fa6bb41c5938b6afa8e

      SHA512

      6715ed9290b868a5733f6c6001e9de1375a381b5f61552fc0adfd825c72977cbd34a347f7fecad8cbc798af7b5ef59f4a23bbe6fedb714e4dda65a1e5921c08e

    • /data/data/com.xgbuy.xg/app_SGLib/libsgsecuritybodyso-5.1.25.so.tmp

      Filesize

      225KB

      MD5

      10760142380b34e358c396ca8d606a91

      SHA1

      b8d7f379c3e25bef6f24636fcb243d3baf2cbe46

      SHA256

      8a25b66e15f4054d677ad667d8eeb4db31ad09188884ae20cff78bfcafdd042b

      SHA512

      72105e76a0b2252434453074a966bb0f2ba849399bd9b3093004f3af47663003af614ec87ee3dd6d12cce0de9816bc1504a9859ced15c389c18601c36d66f9c5

    • /data/data/com.xgbuy.xg/databases/ThrowalbeLog.db

      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

      Filesize

      512B

      MD5

      c5942db1242f45a47940fa918b980a20

      SHA1

      2782ee1eaca971540cfcf99d4b9b574e4dbdc147

      SHA256

      76baac3c61ccb391c744a4817fc9238224a55cd057f5b2695bde3182fd78d0d2

      SHA512

      462c84a0fc612ed6f043175cc5a59d906546dd34c104d6e5e9ee459653fcc726ba0315f69166787a48daff6aaabb01bc2b6a8da21b1bd9fa27d623426a9b0b4a

    • /data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-wal

      Filesize

      32KB

      MD5

      afb33d787d081544acbbd27a92f348c7

      SHA1

      81bbb5545125e20d8bb17c8c33f72fbce0e6d68b

      SHA256

      ec8c5bac9a310cf56d16b0c9ac794885b523f3a127e5bdaf5db19678266fd037

      SHA512

      45c948faea6763be7234fdac711a643e90776ca25efb0c2fb7a329b096526d007142e2273ef715a6e973af9552dce0f8d14de99737de023df08de2a2700cafe6

    • /data/data/com.xgbuy.xg/databases/ut.db

      Filesize

      20KB

      MD5

      38616785cca0600a03205f84fe330b4b

      SHA1

      6ac41a6bdcae297d56dac5fdde70be5faccf0832

      SHA256

      b05c698d5827005da5e04b4fbdcac53cfc83405247353f8e9e145969a820a4e8

      SHA512

      7ff2901c032607f5fa1f24a48056ae85fe8d67b6c5649233fdad7b66950d359b2fb933344bf1e2fe6255a00c593de7bcf959d201fe8b6ad214249bb31f855a08

    • /data/data/com.xgbuy.xg/databases/ut.db

      Filesize

      20KB

      MD5

      897ea27b49f1a3fbdaad510febd3dc53

      SHA1

      ade965b45f001b57f0bc47866c559412a3bf1048

      SHA256

      277a79070021986c3b037a8c14288c6287091408059ee57e19d37753c3f788ff

      SHA512

      d1adcf72a32ff3dcddeb2f846e8b5fc1ce05fef375d83468cb87235b3274e6cbb0668546c9c9f1390ea1004367370ea59f883bd063bf2dd6a197cf97cebfe104

    • /data/data/com.xgbuy.xg/databases/ut.db

      Filesize

      28KB

      MD5

      72feecdc96e502f6eb1729c1c69b7af4

      SHA1

      5cea9240c985078a0b7540320c3073a89cb9a83a

      SHA256

      afaa857982c496fd8855c90f9c304c4e83ffc3082608bd6176eeb413af56215c

      SHA512

      6087fe6aeb83d2446aaefa48be285afc742b9c92dd9d9ccff40e2bf44a0e14ee6317c42ebffa82782aef4c9feddf858c9855fa47bad62c66c16d240147b48c5d

    • /data/data/com.xgbuy.xg/databases/ut.db-journal

      Filesize

      512B

      MD5

      8561d51ca846bdad5c96ec9c34c2104a

      SHA1

      7595cf7fc67335aa416010b49f4b3948757d0488

      SHA256

      80f31c901f17ca45f36f61fb04342c6b646fe419c5f029443c7aab9dcbe7460a

      SHA512

      7640f56ff4eaf979f860fe4adabc3cb02774a6f5d6b4f3df5d0538a00560b3283d37f7c9edf2fbe8b6cac81fb5acce91fd8f39bf6fef0ee3dc434d347c576feb

    • /data/data/com.xgbuy.xg/databases/ut.db-shm

      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    • /data/data/com.xgbuy.xg/databases/ut.db-wal

      Filesize

      32KB

      MD5

      d3fc6905a2118f8a2a08da1a329fc87a

      SHA1

      f019fedb09976dd0d16bd6a21542b80a4052dddf

      SHA256

      9e178de73e918a7cc1644774b1c67f3eb89c9ab3595d7b9573f0c524f26866cb

      SHA512

      7f80f742195e295ff181f5a0c69ceb093d2cbbd3b5b0298d8d247d354b6d582978894de7f0c2553e0fe7210b77a51eeffe03023535e538f80d25de362e4a8583

    • /data/data/com.xgbuy.xg/databases/ut.db-wal

      Filesize

      8KB

      MD5

      42dcac1741c956c98bda63c2c2042480

      SHA1

      44be922a82c8e2681d318eee853a1559fce5cac1

      SHA256

      471230570242a889205ea85bc664511866c7501b37590f1fdda675aa1a1f70f9

      SHA512

      f24c1c54151d4709e5d3253f6d66e42d8f47b351b60e3563a22e55517f42f7643a3dd41d8512735b41cbee1d449287e5f9689fa5e5faf2cd5714c2d8611fc089

    • /data/data/com.xgbuy.xg/databases/ut.db-wal

      Filesize

      24KB

      MD5

      8c707997441350d881fd7b767e29bb39

      SHA1

      73e854414aee2c83566e849e2b989b88b23b9181

      SHA256

      a761735c0d883de2c36e486179b633f5c9a59aa2e060f80bbac0a6a3ebddfe54

      SHA512

      f226e9ccce1a16b2548ddd48c9f15f2477084b50c19cdf468cae0ab6a31cb7ad24c4b0e1e6f65d1632731b036c75239a56ccff047be5991c372b7b8319d8a789

    • /data/data/com.xgbuy.xg/files/0a231bd8575dcf72.txt

      Filesize

      40B

      MD5

      56521ed41b17876919db0ed0f97cb726

      SHA1

      bddbb407c4cc180d0657df8bec5f3c237c54e002

      SHA256

      3b794419b4c0a353194d0a592ab99eef34fb866983f4a67fcf8e588d22dfac18

      SHA512

      7e24619f1df0b6841cadd9da238c8dd9680f3d1024802a903496f301d3bd9539cd57f7e40de0f249a025929231cf2b008cfa405d2c2d9dc6fa6a42318bbd0ca2

    • /data/data/com.xgbuy.xg/files/21c22f492aba3de8.lock

      Filesize

      16B

      MD5

      48dbb51526246a07367897f5c36f9789

      SHA1

      ce155b88a4c47292b019d05d2b15c2f189d8e212

      SHA256

      9f219f077bbf64e09be1a0c18c9e31454f1d60f4609dcb265c2f66db46f42814

      SHA512

      70aaeb0bf631b8b5eb6211d9693a5c18b4a6d43c185018d1cb84c0660e311dd9800bf9dc12b8a01e1fb1884141701e7654b7463566677b782fc2066d57902acf

    • /data/data/com.xgbuy.xg/files/SGMANAGER_DATA2.tmp

      Filesize

      72B

      MD5

      f58f13d0fc991322df1eec4c68481464

      SHA1

      fac54fd6dfb4fa6e0b0f548eb024573dca8cd259

      SHA256

      1d3ba112a38305e67ffb1aa4a0e0e70b3a22809904675efecec0c949d0b76396

      SHA512

      e1ef5bbe84095b5ed02d1d9b23bc7e034b67715b3535473553a2d797b86ddbb81028e0cd5ccc457be1828893413eb368e04f29b7c3a2878f933a025153cca535

    • /data/data/com.xgbuy.xg/files/SGMANAGER_DATA2.tmp

      Filesize

      143B

      MD5

      e226bf9446849dc009baa24a537ac74c

      SHA1

      b6b4de6d0febe5a29c94656ddbf85823f20d6204

      SHA256

      f4748057d8d507d1ff277a03fdef8184f0e215e4be2de5315b48c647fb0d8a19

      SHA512

      0acf633e9b926ee1c43ba5f11357a9f31524a62e7487fe95b70feee27740197a4cf725c3a0aaeadb2fdc441ce4af69e0800ae23bb7a64c7525e7044ed49c6541

    • /data/data/com.xgbuy.xg/files/SGMANAGER_DATA2.tmp

      Filesize

      189B

      MD5

      6a8863dd4be7802445180fb86132a879

      SHA1

      318b6be6ca08b4edd3c0e949f0c4ee34b1b1b768

      SHA256

      003384a9be52ac8b293ce45c557533b3e72efebf1165f128bc9dcaee5b414e08

      SHA512

      21c52dbe0c216efc38950433e9601102dbb0abfc1bcf844e24da21e047cface75f0fabacb07bc38042bd46638611dbd6b7cc7a41e25c824725ec8112f0094780

    • /data/data/com.xgbuy.xg/files/SGMANAGER_DATA2.tmp

      Filesize

      262B

      MD5

      0438489e26550304ace8e365664531ae

      SHA1

      cb4e150d8a2f36dcffb61bf28f01f2c6313f30e4

      SHA256

      a179e2d846f440a85be5d1837704df7092888784914b38b61067568308ec76bb

      SHA512

      6e0782109933287e1fc72b2da6db675e4ec1b0d3cd17e95e2769fe362b4a880664d2159c5521f7b15d7287cf2671d8e73a93b570d16888cc4280a90c38072dd4

    • /data/data/com.xgbuy.xg/files/SGMANAGER_DATA2.tmp

      Filesize

      334B

      MD5

      be2c0f9391c1d15b9e58f3ccc0a09b5c

      SHA1

      97d3471d9abce38a4a86a7a19432fe514851efb6

      SHA256

      cdd833724d41c698cbeea6229e4076875e2acd12bf7e229523d63261c31a78c8

      SHA512

      014c388971aec3af78b4a205ea970a3f43ed212989f9431b16dada2011fad0c9bae92764bc09677bccec1459fe40e84c9217d66bf365a53eaf7320ccd4f04137

    • /data/data/com.xgbuy.xg/files/SGMANAGER_DATA2.tmp

      Filesize

      980B

      MD5

      db444a0db3b9719def61f7da317a0caa

      SHA1

      6653cc831cf49a32a1466bb2e399f3c903e1673c

      SHA256

      e124a3d1991990b0bedd279b66c1b925ad168eb1d7aeb31d35037c1fc8fd6555

      SHA512

      4d423b3b1729ea6a17cc814fb0d7548e6f8ed6912c70095b02d330bc6342cd1722f1d2f35ef4be621d09cbc100f8cdee0fd717942802201dfecf96da97d777bc

    • /data/data/com.xgbuy.xg/files/jpush_stat_history_pushcore/normal/nowrap/98de1d3b-6fc1-4f8f-8d82-e1f969006863

      Filesize

      202B

      MD5

      afa0f006a4c90001e8b8bb3446f3aca2

      SHA1

      8bdf008f9f8723504aacc3796cb902b94dd45f90

      SHA256

      ba3408001ec91668f896c7408775abfc647c1d50e4c136f2ea4ed61578e1cda1

      SHA512

      683e968b19274aada7700c7ad4c2da4a021fbe59b1d86b242302c5e998e7c5ce73730b33ca2803a4f79571881a8ac05ee95369381209ea8dedb463c3d9c085f8

    • /data/user/0/com.xgbuy.xg/app_SGLib/libsgmain_312768000000.zip

      Filesize

      65KB

      MD5

      522947eaa37b029a247e3973f3be3621

      SHA1

      31c88e0d7c9b51904c0f598e80245bba41b1c7d9

      SHA256

      d06601f9eb8d8c991f00426ad30bada9d2bb7886a6de21d78cd0ccb7b7e62156

      SHA512

      f5eaa9ccf08096bf0df8f004fbfc1b893ae08fed3e6722e0adea1fdea2719a45876314b765134905841f440c27216c897876e3ac6c8903fc44b697854eb02c0c

    • /data/user/0/com.xgbuy.xg/app_SGLib/libsgsecuritybody_312768000000.zip

      Filesize

      10KB

      MD5

      f59597732a9069b73e16c027faf78d05

      SHA1

      e3558f4e5041a6c6d4372001bed847f2ef77958c

      SHA256

      9e416ffbeda9461f3efca490dfaaee955f68fbc1f3e455f2394bf4c4310b83d6

      SHA512

      7a8dae723cf5fff494cb2fc16a75bf347732ee3da99f1cbda99d8c6d26a47e4a7526c5340fa33bf9ee98463a84c1fe276a3683ca8e7bfbc50206e589a82aa6d2

    • /storage/emulated/0/.DataStorage/ContextData.xml

      Filesize

      213B

      MD5

      551893e07c925ffd19cb4c5fd59a6d67

      SHA1

      987b70ffbd260a00443278e83fbfd2c02d63e8ee

      SHA256

      23195c39413ad31fa66e8dcc976e62d7568d758be64a2d0a2662e1efae352a9d

      SHA512

      b0c39f891133c024399ea285029a94c2a1042adc0ea5224901c73e30fba2bed365676f0229e7870e0a5c1887e8b8ee05d9ab6f0d7337216a8bae9e43e43d1fd4

    • /storage/emulated/0/.DataStorage/ContextData.xml

      Filesize

      111B

      MD5

      0ffda7e7bce9005b5339c916995a1789

      SHA1

      c999b6f9dccd5ff1e0872f24c6e4cb72f01c4da7

      SHA256

      ade55194f184ed9b97dd0b51acde4f662ae467eeb4b2d1712be7194ae75d8487

      SHA512

      e044ec32128778ab1e1ffec2c95174810dd883a8c8ae50a883a8996117a716e73053a2c87144e377f120201c6a2c3b2ae3fb5467efb33a65dd830a030a846978

    • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

      Filesize

      65B

      MD5

      9781ca003f10f8d0c9c1945b63fdca7f

      SHA1

      4156cf5dc8d71dbab734d25e5e1598b37a5456f4

      SHA256

      3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

      SHA512

      25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

    • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

      Filesize

      167B

      MD5

      d266e76a71f4be23a950a1b5c7305213

      SHA1

      50ceed18f74ddf3a13659b032dc8aa09f2ecb8ff

      SHA256

      6a617c6a06e115050fc1b67b2de8af9327a92dcf68901ff1a89720d94de30979

      SHA512

      56dd41d9c2126f2b8af7e6b24337c9c281e73b073f7ca3af2a79211c9a61db881ddc83d4d1a67ceb6422fd663f3aefd5059bd8e7701c34189dd999dfc761ac82

    • /storage/emulated/0/.com.taobao.dp/dd7893586a493dc3

      Filesize

      512B

      MD5

      f3a5786f163e5fc7ce1c69c9ff761213

      SHA1

      3d9d174c065c64b8fd2fa59db1d2f7e9b2097cf7

      SHA256

      cd254eb9e3cedc6e8af647f6e9d19b8af3a858200418fa2a95f8cc468d63072e

      SHA512

      591fc8d3d07a9ad505ea42c5ca29cfd0382a53bc3217e361abbc30cce612c0a2332dfa5015837c037151b1fc666b64774796c546ccf50a82fcc4a6c3952f8542

    • /storage/emulated/0/Mob/.slw

      Filesize

      167B

      MD5

      3be8a9d07c70d85838f843914bc53170

      SHA1

      1cd8b3f3fe28b62201378ea82dd08c2ad605d910

      SHA256

      c2b9d86ff1d737c19aa8fbaa773a32d12c352cc3523e635627c4e131be49c334

      SHA512

      61c08db365453d737408df144d246389bd9f6f26d777b31daabaa728443f2aa22ffd4d24246fe1f4c5aa020d3556cd7246874ee68d165bc30ba47a518ec3cb14

    • /storage/emulated/0/Mob/comm/.di

      Filesize

      57B

      MD5

      70a42cba408700f9a6c01c7941a8829e

      SHA1

      eab01cc2c0671538795fb0b1146017dc099d0984

      SHA256

      499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

      SHA512

      8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

    • /storage/emulated/0/Mob/comm/.di

      Filesize

      111B

      MD5

      1e133f1696c6338f4d74683fa24ed18a

      SHA1

      11de53d384631f27c66c1c55b0b242f59752f60f

      SHA256

      56d1d54d3536b7d2c26fadeddade267a855c960f8462d93aa80db8afec158e23

      SHA512

      c33e6031a49b2ec16c9156fd3b298995e785d30ce0740f8f620ba0feabd14378a60387d07e72b684c8f0656faf9ef3e72b0097f0cbfb6bdb9b095d5e43181436

    • /storage/emulated/0/data/.push_deviceid

      Filesize

      32B

      MD5

      3bfa0a755c1051a229723209741eb4bb

      SHA1

      5774f2d770b3f7010715a43a3e5dac8805ef9828

      SHA256

      7d5250148d3f8c291af5299cc4bab73849b9e15185d7e63c5e7564e882a78454

      SHA512

      ac5da61c9a6df72c89eb9b35e98e2610cb899e1e70db3ef796ba9cc1f4390254359a4415f05cbd7cab17e642e401e28499475d8fcc337b874a05960a3331ea6d