e75d9213c3e7003233ae9a6360cc1a5813e7cbb793426ac94bf70d8a79366883

Analysis

max time kernel
12s
max time network
142s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
09/05/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c3dda3492c8770e6c3e118ffc937ab3_JaffaCakes118.apk
Size

17.9MB
MD5

2c3dda3492c8770e6c3e118ffc937ab3
SHA1

68f70461ad17bf4cfbece53fab1ba17f77746c2c
SHA256

e75d9213c3e7003233ae9a6360cc1a5813e7cbb793426ac94bf70d8a79366883
SHA512

cabd7ea8102bf066e3b4605c5a5025268f7bf0fcab28374c696b94a5ce234eef5fb868c13fbfb7385d4f70cd23db81135781eead1a0bafcb3f0016c58267acf4
SSDEEP

393216:Z6jAdZ5D9opbZBIPerHcV+r2tF9YC307gf/dgXRJX94Y:Z6jAdXDAZBIPeryF9/Ec2XzXKY

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xgbuy.xg/[email protected]	5045	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex	5045	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex	5045	com.xgbuy.xg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.xgbuy.xg
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5045

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xgbuy.xg/.jiagu/classes.dex

Filesize
8.0MB

MD5
5e99738dac60d8528303c05236b49521

SHA1
09defe8e673554d1fbfb6818d7f6b06926ef21e3

SHA256
e4d0cea4069552ea69782c90b6d51278d0f422dfe2052e7f78c992e07186b109

SHA512
7291923d241870717b7ea2d2f8672dc37248b3bb8070056ad923465e55e347a3da20620e79edc8ce0939083e2d3efb3d574ab9cdf4ef88364d1164dfbb49f49a

Download Submit
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so

Filesize
455KB

MD5
e5a53000766ebc433b27d6a66ec4f555

SHA1
2c8f53f1c03aec2005bcad67d731f07261dabde0

SHA256
78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

SHA512
370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ac

Filesize
32B

MD5
1264f30db5bc978090c891fc9ba97820

SHA1
22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc

SHA256
6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c

SHA512
f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
afde5354966be113108499e2f6866b3d

SHA1
e91af3704405be8a6a9a25cea088bde9845b173a

SHA256
4bd748aacd6389916bae36e31a77003170aac0b32030cce941ea5a020545ed66

SHA512
c528abef660ef69737a4a8cb55e33e82bcb57c43c2faaf90edf5ac50cc967debbf09468a3ad9e420f0c3a4fb651585f11456212457bf22065c30c3e09b3e09b9

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ic

Filesize
32B

MD5
9afbf0dc0b4a4fd0a874cfec2c55461a

SHA1
a42766499eef11be1120ff87588b7f715c1b2a7f

SHA256
75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37

SHA512
863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

Filesize
314B

MD5
583a7b829813e6650293684a9856592f

SHA1
66adddfb0fde24b0e41eb9fb41810832550865c9

SHA256
914b744d955f11f9d1d9616a8918389e1cb95c3555e52c7f7305ea93e0e0bfc1

SHA512
7a1793833093ae39e2696a0317c120848c06060b70e2caaefef42ee8c0d16531923bb169b08b0069701e37cc52643402f5aa7510e19a0ef4a9e792a8d16c6700

Download Submit
/data/data/com.xgbuy.xg/files/.jiagu.lock

Filesize
27B

MD5
1584d02126af0e10cc5ce8e501288178

SHA1
808f65304e33d63851acfd7944a8d5457fd8e3fc

SHA256
7dae8f332e453223de9de2e336056b6e898ee4ba3f49a8d3efdf57dbc4aae9cd

SHA512
df847ff55a705bd3a1bc2d3eff062f82a98135da7730e309577dc7c37215ea5f91242db231c9a1d214ae06631b9617155d8d8ed5586761120659e259022b0ca5

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]

Filesize
6.5MB

MD5
343543170cadbcad918429d62ea0b7a2

SHA1
9a55aefb843427a4fa43fb62e9fff30ee674b04b

SHA256
d2c01fef1bee484e1ee39420ba919522325c02eb4809c799fbc2b3262f2c447a

SHA512
d07071e13fcc2c80e2ae4bca90e9b4b23ff7a212353050ea600b3bccfa6f1ed93584d6c5ef84addb07fa418214a1b7431c8fd037edf3c7de44391ad8bffc04bb

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex

Filesize
6.5MB

MD5
09623bd5b2ce2e506e8dffcb2cbc3e8c

SHA1
e49e1b0d7af536becc5e4701b663ca1923b09c80

SHA256
e671a6a2653b372037b959916daf955753b4cef04d60fca7a2728c60cc5656a1

SHA512
c5ffb5d4b6e41531768e4635626b1ff26d8b676166d5eba1baf195d92cdad8c0ab4ccae5236897e9eaeaeb2e2cf2116d3a62790ebdbff45ede9e201139c70450

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex

Filesize
2.0MB

MD5
668702b0562aaaae77078af0889b6745

SHA1
eb46db301936ec7c0433aec9512786468d593988

SHA256
744961b59ffd06c0769febccd0c634a0bbc36a16c8ad8715d177b4a737fa3123

SHA512
00d36a6f14c526c5524ff1cf13eb46364397b464def62f99df58716f49b4b80e448cc3c16b056a1d4f3c2cd888dd1b31636cd56e86adad286643dafa3526df62

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
4c4c5285293d5141f582aefa4e038669

SHA1
e01852a72e5a8e6f7d63a21426b515118196047b

SHA256
36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

SHA512
097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
c7b7efd2c1efff10ca0ca000670fc63e

SHA1
3eb8bb21129e6b32eaa548d86b33f059d81cb697

SHA256
4dd5bdb36e970e86f6c8d90e53d785bead1418f5e3c67e4939d1f3e74f59030f

SHA512
3c19f19e0f3d915402ef4b9e8001e4090262e823c1370ebbe9bdf49ba34458ce3d685cd2ea5a2e15a2c8d769ff35d98488f41dfcbc10e5262c0767cb9c01d777

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads