0b4585b1fdb2b7de4ed363614b8984279a11fe5c8c35d1df9c966817f26b8396

Analysis

max time kernel
173s
max time network
183s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
15/05/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

450982bab5607670e4b1bd55ae08762a_JaffaCakes118.apk
Size

19.2MB
MD5

450982bab5607670e4b1bd55ae08762a
SHA1

ea37acfee6ecc5bb010c6b05eb55292c084cacdc
SHA256

0b4585b1fdb2b7de4ed363614b8984279a11fe5c8c35d1df9c966817f26b8396
SHA512

dcbdc71ee1ed12808c442dad2ac46902b2c1431f50161254e9c767e3856d1a99a50a979e964b5d1d050fbb41bd24abec92f53e821699618654ed69e98a87d6b0
SSDEEP

393216:ojjQ9Zy1joIBB1uHRiNkr8scj+r2tF9Ymud3j7gfPdgZ7iiTrx5h:ojjQW1oQ2PY9F96TcGZeiT1f

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 11 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.xgbuy.xg/.jiagu/classes.dex	4277	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex	4277	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex	4277	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4277	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4361	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4277	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/classes.dex	4412	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex	4412	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex	4412	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4412	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4412	com.xgbuy.xg:pushcore

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xgbuy.xg
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xgbuy.xg:pushcore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg:pushcore

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg:pushcore

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg:pushcore

com.xgbuy.xg
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4277
- chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
  2⤵
  PID:4303
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4361

com.xgbuy.xg:pushcore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4412
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4579

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xgbuy.xg/.jiagu/classes.dex

Filesize
8.2MB

MD5
2f7c2a545fabc42357818c4d35052eb0

SHA1
de52edb45f76a000f2be429ef0e7daf7245c35a8

SHA256
7dcc68dd4f94a23b6beffb924eca54ea4a9093534b34fb377d6b9ab5fbeffe78

SHA512
40b6cbbcbfe0771469f025a1a798c4bff6dbbf55426220486ecbe7654506d7a240aba9b4d76db29e54bc468e44b996bb324091315cf7b1702bc0fc0573879f34

Download Submit
/data/data/com.xgbuy.xg/.jiagu/classes.dex

Filesize
6.5MB

MD5
3607e9bc414a499b1da47aeee45672f2

SHA1
04b39c1fad9bd8b87eb58520ef98c649b4864a26

SHA256
80b924b9cb646f78b355227c8c265a0e694c3b1b2b17bce5c992fc8399e475fa

SHA512
0b3733811437cc28a57930c5cf57aa692e8e18e55c1dd3ba534de00cc374b3d1618a40dd0bea185d369816e96c67fe5d6ba981a51142f5f436997f0bcd574771

Download Submit
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex

Filesize
6.5MB

MD5
2edb8333947a3cbbf4f2ad35404817fb

SHA1
22ae5219b5a313b13dc9d65590507fa01cb63b77

SHA256
c9f2509cab8c706548fa84a52ec17f7477666cc5d216e2751023c13c783658a8

SHA512
f90cb78128e059c587698697d88a20a101d08965c05b845382316dde2015a9674b975d68fea7f4a457cfb333c741248e2d84a39f4ce6db60f5497eb431f86026

Download Submit
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex

Filesize
2.4MB

MD5
26cfde3ec0e689982b8c2c01e0313830

SHA1
e79bfad35416572ed90b33106b0e4353f609d742

SHA256
450570e28912a1267aca4a1f0c7f28571da0a6c83cb711bf6c35f6a8b228b4b4

SHA512
431268d92e22fb0a819384434ac2bcf1a59d18cd3300e13524baaa517641ed6cb2eb0d8a8747b75d2aceb73fa9b026005fe6cff339a47c8a119329f198f7972e

Download Submit
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so

Filesize
455KB

MD5
e5a53000766ebc433b27d6a66ec4f555

SHA1
2c8f53f1c03aec2005bcad67d731f07261dabde0

SHA256
78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

SHA512
370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

Download Submit
/data/data/com.xgbuy.xg/.jiagu/tmp.dex

Filesize
284B

MD5
f1771b68f5f9b168b79ff59ae2daabe4

SHA1
0df6a835559f5c99670214a12700e7d8c28e5a42

SHA256
9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

SHA512
dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-wal

Filesize
112KB

MD5
58a14108c213bc40bd3623811406544c

SHA1
b195c7f462ce21b38e4820a6b9b5f9efcb4ebc64

SHA256
20786901e598faeb778c2a1f4455ad9ef0ac66a99d086d8fb371c228e04a164a

SHA512
102352237037531ae5565e971e8b56cdf6a8351b9e9048d2ad770aa3a2594f5a4d3b497a71992f5894f372e42e269f9c2d8555a2dad1fdbe54faadfbb8f9ef18

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ac

Filesize
32B

MD5
1264f30db5bc978090c891fc9ba97820

SHA1
22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc

SHA256
6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c

SHA512
f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
f1f833406332c0f593c5e4d386c5c7e5

SHA1
c03866ec5b5c97fcb8b7fcaa0df160764b968439

SHA256
4cc76a14c132997c411b47891aaf39fe4207d75daf021f4a1a4c7b81c36c8b96

SHA512
1913431d0e70dc31f9ba90e474016d0337f77a7b44e910b72fed899dc03ced5df816c5ec3d6ffa4e4fac79e7d13cb82a1d7726043236fc7e70367420208593b9

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ic

Filesize
32B

MD5
9afbf0dc0b4a4fd0a874cfec2c55461a

SHA1
a42766499eef11be1120ff87588b7f715c1b2a7f

SHA256
75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37

SHA512
863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

Filesize
314B

MD5
e1ef5c62da2d30a13d5b4d2f8b4c81f0

SHA1
ea7043adfe7cd504897f3bbeaa5903bea57d54c8

SHA256
3e9e6f45268f7285df0e13debc820459c9637d31ccda0dc814decbbc6e3d628d

SHA512
09e89efa0001bab2401023d00c958dcbe1330b8cc3ed67f9553a352223f2e522dc60b4d8d9ebf21582973af1278deedc51fa618ecd218e8c74fa69c26e2b947e

Download Submit
/data/data/com.xgbuy.xg/files/.jiagu.lock

Filesize
27B

MD5
deb17993cb5e5e7fb8377bddef5a4a3c

SHA1
f95919fff00e5c91669dd3747f98aa121f2fdd21

SHA256
77176a4b70d48e5d942b98c3aad6e1e73ba95b42d72cec6974e3756b8ea5f848

SHA512
3cae2e74358ad1e532234385d0a7871c07b07cf7e8e2496ab01dccd239b349232ac73f3bcf2a3a32678ab028221bb3871b9c4ad2f439f9f9a146568f23c1ee88

Download Submit
/data/data/com.xgbuy.xg/files/Mob/mob_commons_1

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.xgbuy.xg/files/sobot_chat_log/sobot_chat_20240515_log.txt

Filesize
201B

MD5
00f404f926e6b18edcd0d9bcdd213ff0

SHA1
2dd5494943fb7ca9d7a995015930f245a2561724

SHA256
67acb7ab32d3a3978784f57e6110686cc85da23995f726b3d77b93747d31e40b

SHA512
9732fc84f87406e6eef94f72aef9db983f40f002ae3365c714eeb9de6d0ba2ba5860ea116efefa9c4e8fa6ed4991c8d6841c52790206498c9b15ae79fe99dbe0

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
512B

MD5
e9e6eb40625ac90d903dfadaa2eefa83

SHA1
6ef2b725dfacdabc2bd4418f7db21a9bb7d9ff89

SHA256
7192b92fc0660d7df1987a98c4823394abb8d748cad969ebbbad389d779bd96b

SHA512
02af27a27c9708b37cf4fadd657bb875da1a34aa86f90ac3643edae87e706361049fa4a7f0a8411f57dc16f11f24baaa2a2a36f038766d635b771fd9e41367bf

Download Submit
/storage/emulated/0/360/.iddata

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/storage/emulated/0/Mob/.slw

Filesize
66B

MD5
19402718bfb1c685a726b4e1d846ad98

SHA1
02a7e30044a67085f2f1da24e16e4ecfede65b72

SHA256
079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0

SHA512
25254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
acc2a2f5cb76c41d2e97e0d409b53bdd

SHA1
ed06f22ff10e0912f50d53bc775ed2ae70f85d5a

SHA256
12ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448

SHA512
faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads