Analysis
-
max time kernel
148s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system -
submitted
07-05-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
2146c7b5825d003d695b6df6222080b7_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
2146c7b5825d003d695b6df6222080b7_JaffaCakes118.apk
Resource
android-x64-arm64-20240506-en
General
-
Target
2146c7b5825d003d695b6df6222080b7_JaffaCakes118.apk
-
Size
22.5MB
-
MD5
2146c7b5825d003d695b6df6222080b7
-
SHA1
1bbc8bfcc05351ec0416a4fcaad405477f69a7a7
-
SHA256
8766cf0cc6d08c720ed329ae87c5f4ccb121d8c5a52e39d5933d81d33c9035c3
-
SHA512
0f6b77c15f18a4b64404575fcb39ff68f86b06ab8f2c673817fb68712f560208195fa45ab4a0c8fba10eca22d46df40f4952dddec2cb49e74b3ad3346c67921d
-
SSDEEP
393216:vQXmZVfO1+cVvpPPbUsMjSUylbz5Zmicp+r2tF9YM3c7gf/dgMRG4:vWmZpi+kFQjkp3mpF95sc2MA4
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.xgbuy.xg:pushcore -
Checks known Qemu files. 1 TTPs 1 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /sys/qemu_trace com.xgbuy.xg:pushcore -
Checks known Qemu pipes. 1 TTPs 1 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/qemu_pipe com.xgbuy.xg:pushcore -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.xgbuy.xg:pushcore -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.xgbuy.xg/app_SGLib/libsgmain_312768000000.zip 4304 com.xgbuy.xg:pushcore /data/user/0/com.xgbuy.xg/app_SGLib/libsgsecuritybody_312768000000.zip 4304 com.xgbuy.xg:pushcore -
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.xgbuy.xg Framework service call android.app.IActivityManager.getRunningAppProcesses com.xgbuy.xg:pushcore -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.xgbuy.xg:pushcore -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.xgbuy.xg Framework service call android.app.IActivityManager.registerReceiver com.xgbuy.xg:pushcore -
Checks if the internet connection is available 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xgbuy.xg Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xgbuy.xg:pushcore -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.xgbuy.xg Framework API call javax.crypto.Cipher.doFinal com.xgbuy.xg:pushcore
Processes
-
com.xgbuy.xg1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4266 -
cat /sys/class/net/wlan0/address2⤵PID:4325
-
-
com.xgbuy.xg:pushcore1⤵
- Checks CPU information
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4304
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
591KB
MD5c85e8919765cc22095d1b8e40601e34d
SHA122d48933b9f30a028cf4c9d993f59c767f9e8e35
SHA256f4ab50b1188cc9913c106f1f661162cb7db90aa288a90fa6bb41c5938b6afa8e
SHA5126715ed9290b868a5733f6c6001e9de1375a381b5f61552fc0adfd825c72977cbd34a347f7fecad8cbc798af7b5ef59f4a23bbe6fedb714e4dda65a1e5921c08e
-
Filesize
225KB
MD510760142380b34e358c396ca8d606a91
SHA1b8d7f379c3e25bef6f24636fcb243d3baf2cbe46
SHA2568a25b66e15f4054d677ad667d8eeb4db31ad09188884ae20cff78bfcafdd042b
SHA51272105e76a0b2252434453074a966bb0f2ba849399bd9b3093004f3af47663003af614ec87ee3dd6d12cce0de9816bc1504a9859ced15c389c18601c36d66f9c5
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c5942db1242f45a47940fa918b980a20
SHA12782ee1eaca971540cfcf99d4b9b574e4dbdc147
SHA25676baac3c61ccb391c744a4817fc9238224a55cd057f5b2695bde3182fd78d0d2
SHA512462c84a0fc612ed6f043175cc5a59d906546dd34c104d6e5e9ee459653fcc726ba0315f69166787a48daff6aaabb01bc2b6a8da21b1bd9fa27d623426a9b0b4a
-
Filesize
32KB
MD5afb33d787d081544acbbd27a92f348c7
SHA181bbb5545125e20d8bb17c8c33f72fbce0e6d68b
SHA256ec8c5bac9a310cf56d16b0c9ac794885b523f3a127e5bdaf5db19678266fd037
SHA51245c948faea6763be7234fdac711a643e90776ca25efb0c2fb7a329b096526d007142e2273ef715a6e973af9552dce0f8d14de99737de023df08de2a2700cafe6
-
Filesize
20KB
MD538616785cca0600a03205f84fe330b4b
SHA16ac41a6bdcae297d56dac5fdde70be5faccf0832
SHA256b05c698d5827005da5e04b4fbdcac53cfc83405247353f8e9e145969a820a4e8
SHA5127ff2901c032607f5fa1f24a48056ae85fe8d67b6c5649233fdad7b66950d359b2fb933344bf1e2fe6255a00c593de7bcf959d201fe8b6ad214249bb31f855a08
-
Filesize
20KB
MD5897ea27b49f1a3fbdaad510febd3dc53
SHA1ade965b45f001b57f0bc47866c559412a3bf1048
SHA256277a79070021986c3b037a8c14288c6287091408059ee57e19d37753c3f788ff
SHA512d1adcf72a32ff3dcddeb2f846e8b5fc1ce05fef375d83468cb87235b3274e6cbb0668546c9c9f1390ea1004367370ea59f883bd063bf2dd6a197cf97cebfe104
-
Filesize
28KB
MD572feecdc96e502f6eb1729c1c69b7af4
SHA15cea9240c985078a0b7540320c3073a89cb9a83a
SHA256afaa857982c496fd8855c90f9c304c4e83ffc3082608bd6176eeb413af56215c
SHA5126087fe6aeb83d2446aaefa48be285afc742b9c92dd9d9ccff40e2bf44a0e14ee6317c42ebffa82782aef4c9feddf858c9855fa47bad62c66c16d240147b48c5d
-
Filesize
512B
MD58561d51ca846bdad5c96ec9c34c2104a
SHA17595cf7fc67335aa416010b49f4b3948757d0488
SHA25680f31c901f17ca45f36f61fb04342c6b646fe419c5f029443c7aab9dcbe7460a
SHA5127640f56ff4eaf979f860fe4adabc3cb02774a6f5d6b4f3df5d0538a00560b3283d37f7c9edf2fbe8b6cac81fb5acce91fd8f39bf6fef0ee3dc434d347c576feb
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
32KB
MD5d3fc6905a2118f8a2a08da1a329fc87a
SHA1f019fedb09976dd0d16bd6a21542b80a4052dddf
SHA2569e178de73e918a7cc1644774b1c67f3eb89c9ab3595d7b9573f0c524f26866cb
SHA5127f80f742195e295ff181f5a0c69ceb093d2cbbd3b5b0298d8d247d354b6d582978894de7f0c2553e0fe7210b77a51eeffe03023535e538f80d25de362e4a8583
-
Filesize
8KB
MD542dcac1741c956c98bda63c2c2042480
SHA144be922a82c8e2681d318eee853a1559fce5cac1
SHA256471230570242a889205ea85bc664511866c7501b37590f1fdda675aa1a1f70f9
SHA512f24c1c54151d4709e5d3253f6d66e42d8f47b351b60e3563a22e55517f42f7643a3dd41d8512735b41cbee1d449287e5f9689fa5e5faf2cd5714c2d8611fc089
-
Filesize
24KB
MD58c707997441350d881fd7b767e29bb39
SHA173e854414aee2c83566e849e2b989b88b23b9181
SHA256a761735c0d883de2c36e486179b633f5c9a59aa2e060f80bbac0a6a3ebddfe54
SHA512f226e9ccce1a16b2548ddd48c9f15f2477084b50c19cdf468cae0ab6a31cb7ad24c4b0e1e6f65d1632731b036c75239a56ccff047be5991c372b7b8319d8a789
-
Filesize
40B
MD556521ed41b17876919db0ed0f97cb726
SHA1bddbb407c4cc180d0657df8bec5f3c237c54e002
SHA2563b794419b4c0a353194d0a592ab99eef34fb866983f4a67fcf8e588d22dfac18
SHA5127e24619f1df0b6841cadd9da238c8dd9680f3d1024802a903496f301d3bd9539cd57f7e40de0f249a025929231cf2b008cfa405d2c2d9dc6fa6a42318bbd0ca2
-
Filesize
16B
MD548dbb51526246a07367897f5c36f9789
SHA1ce155b88a4c47292b019d05d2b15c2f189d8e212
SHA2569f219f077bbf64e09be1a0c18c9e31454f1d60f4609dcb265c2f66db46f42814
SHA51270aaeb0bf631b8b5eb6211d9693a5c18b4a6d43c185018d1cb84c0660e311dd9800bf9dc12b8a01e1fb1884141701e7654b7463566677b782fc2066d57902acf
-
Filesize
72B
MD5f58f13d0fc991322df1eec4c68481464
SHA1fac54fd6dfb4fa6e0b0f548eb024573dca8cd259
SHA2561d3ba112a38305e67ffb1aa4a0e0e70b3a22809904675efecec0c949d0b76396
SHA512e1ef5bbe84095b5ed02d1d9b23bc7e034b67715b3535473553a2d797b86ddbb81028e0cd5ccc457be1828893413eb368e04f29b7c3a2878f933a025153cca535
-
Filesize
143B
MD5e226bf9446849dc009baa24a537ac74c
SHA1b6b4de6d0febe5a29c94656ddbf85823f20d6204
SHA256f4748057d8d507d1ff277a03fdef8184f0e215e4be2de5315b48c647fb0d8a19
SHA5120acf633e9b926ee1c43ba5f11357a9f31524a62e7487fe95b70feee27740197a4cf725c3a0aaeadb2fdc441ce4af69e0800ae23bb7a64c7525e7044ed49c6541
-
Filesize
189B
MD56a8863dd4be7802445180fb86132a879
SHA1318b6be6ca08b4edd3c0e949f0c4ee34b1b1b768
SHA256003384a9be52ac8b293ce45c557533b3e72efebf1165f128bc9dcaee5b414e08
SHA51221c52dbe0c216efc38950433e9601102dbb0abfc1bcf844e24da21e047cface75f0fabacb07bc38042bd46638611dbd6b7cc7a41e25c824725ec8112f0094780
-
Filesize
262B
MD50438489e26550304ace8e365664531ae
SHA1cb4e150d8a2f36dcffb61bf28f01f2c6313f30e4
SHA256a179e2d846f440a85be5d1837704df7092888784914b38b61067568308ec76bb
SHA5126e0782109933287e1fc72b2da6db675e4ec1b0d3cd17e95e2769fe362b4a880664d2159c5521f7b15d7287cf2671d8e73a93b570d16888cc4280a90c38072dd4
-
Filesize
334B
MD5be2c0f9391c1d15b9e58f3ccc0a09b5c
SHA197d3471d9abce38a4a86a7a19432fe514851efb6
SHA256cdd833724d41c698cbeea6229e4076875e2acd12bf7e229523d63261c31a78c8
SHA512014c388971aec3af78b4a205ea970a3f43ed212989f9431b16dada2011fad0c9bae92764bc09677bccec1459fe40e84c9217d66bf365a53eaf7320ccd4f04137
-
Filesize
980B
MD5db444a0db3b9719def61f7da317a0caa
SHA16653cc831cf49a32a1466bb2e399f3c903e1673c
SHA256e124a3d1991990b0bedd279b66c1b925ad168eb1d7aeb31d35037c1fc8fd6555
SHA5124d423b3b1729ea6a17cc814fb0d7548e6f8ed6912c70095b02d330bc6342cd1722f1d2f35ef4be621d09cbc100f8cdee0fd717942802201dfecf96da97d777bc
-
/data/data/com.xgbuy.xg/files/jpush_stat_history_pushcore/normal/nowrap/98de1d3b-6fc1-4f8f-8d82-e1f969006863
Filesize202B
MD5afa0f006a4c90001e8b8bb3446f3aca2
SHA18bdf008f9f8723504aacc3796cb902b94dd45f90
SHA256ba3408001ec91668f896c7408775abfc647c1d50e4c136f2ea4ed61578e1cda1
SHA512683e968b19274aada7700c7ad4c2da4a021fbe59b1d86b242302c5e998e7c5ce73730b33ca2803a4f79571881a8ac05ee95369381209ea8dedb463c3d9c085f8
-
Filesize
65KB
MD5522947eaa37b029a247e3973f3be3621
SHA131c88e0d7c9b51904c0f598e80245bba41b1c7d9
SHA256d06601f9eb8d8c991f00426ad30bada9d2bb7886a6de21d78cd0ccb7b7e62156
SHA512f5eaa9ccf08096bf0df8f004fbfc1b893ae08fed3e6722e0adea1fdea2719a45876314b765134905841f440c27216c897876e3ac6c8903fc44b697854eb02c0c
-
Filesize
10KB
MD5f59597732a9069b73e16c027faf78d05
SHA1e3558f4e5041a6c6d4372001bed847f2ef77958c
SHA2569e416ffbeda9461f3efca490dfaaee955f68fbc1f3e455f2394bf4c4310b83d6
SHA5127a8dae723cf5fff494cb2fc16a75bf347732ee3da99f1cbda99d8c6d26a47e4a7526c5340fa33bf9ee98463a84c1fe276a3683ca8e7bfbc50206e589a82aa6d2
-
Filesize
213B
MD5551893e07c925ffd19cb4c5fd59a6d67
SHA1987b70ffbd260a00443278e83fbfd2c02d63e8ee
SHA25623195c39413ad31fa66e8dcc976e62d7568d758be64a2d0a2662e1efae352a9d
SHA512b0c39f891133c024399ea285029a94c2a1042adc0ea5224901c73e30fba2bed365676f0229e7870e0a5c1887e8b8ee05d9ab6f0d7337216a8bae9e43e43d1fd4
-
Filesize
111B
MD50ffda7e7bce9005b5339c916995a1789
SHA1c999b6f9dccd5ff1e0872f24c6e4cb72f01c4da7
SHA256ade55194f184ed9b97dd0b51acde4f662ae467eeb4b2d1712be7194ae75d8487
SHA512e044ec32128778ab1e1ffec2c95174810dd883a8c8ae50a883a8996117a716e73053a2c87144e377f120201c6a2c3b2ae3fb5467efb33a65dd830a030a846978
-
Filesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
Filesize
167B
MD5d266e76a71f4be23a950a1b5c7305213
SHA150ceed18f74ddf3a13659b032dc8aa09f2ecb8ff
SHA2566a617c6a06e115050fc1b67b2de8af9327a92dcf68901ff1a89720d94de30979
SHA51256dd41d9c2126f2b8af7e6b24337c9c281e73b073f7ca3af2a79211c9a61db881ddc83d4d1a67ceb6422fd663f3aefd5059bd8e7701c34189dd999dfc761ac82
-
Filesize
512B
MD5f3a5786f163e5fc7ce1c69c9ff761213
SHA13d9d174c065c64b8fd2fa59db1d2f7e9b2097cf7
SHA256cd254eb9e3cedc6e8af647f6e9d19b8af3a858200418fa2a95f8cc468d63072e
SHA512591fc8d3d07a9ad505ea42c5ca29cfd0382a53bc3217e361abbc30cce612c0a2332dfa5015837c037151b1fc666b64774796c546ccf50a82fcc4a6c3952f8542
-
Filesize
167B
MD53be8a9d07c70d85838f843914bc53170
SHA11cd8b3f3fe28b62201378ea82dd08c2ad605d910
SHA256c2b9d86ff1d737c19aa8fbaa773a32d12c352cc3523e635627c4e131be49c334
SHA51261c08db365453d737408df144d246389bd9f6f26d777b31daabaa728443f2aa22ffd4d24246fe1f4c5aa020d3556cd7246874ee68d165bc30ba47a518ec3cb14
-
Filesize
57B
MD570a42cba408700f9a6c01c7941a8829e
SHA1eab01cc2c0671538795fb0b1146017dc099d0984
SHA256499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
SHA5128900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c
-
Filesize
111B
MD51e133f1696c6338f4d74683fa24ed18a
SHA111de53d384631f27c66c1c55b0b242f59752f60f
SHA25656d1d54d3536b7d2c26fadeddade267a855c960f8462d93aa80db8afec158e23
SHA512c33e6031a49b2ec16c9156fd3b298995e785d30ce0740f8f620ba0feabd14378a60387d07e72b684c8f0656faf9ef3e72b0097f0cbfb6bdb9b095d5e43181436
-
Filesize
32B
MD53bfa0a755c1051a229723209741eb4bb
SHA15774f2d770b3f7010715a43a3e5dac8805ef9828
SHA2567d5250148d3f8c291af5299cc4bab73849b9e15185d7e63c5e7564e882a78454
SHA512ac5da61c9a6df72c89eb9b35e98e2610cb899e1e70db3ef796ba9cc1f4390254359a4415f05cbd7cab17e642e401e28499475d8fcc337b874a05960a3331ea6d