Overview

overview

7

Static

static

6

6aa5d9bc6f...18.apk

android-9-x86

7

6aa5d9bc6f...18.apk

android-11-x64

7

Analysis

  • max time kernel
    177s
  • max time network
    184s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    23-05-2024 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6aa5d9bc6f6d71ddec8c0ed738d19c75_JaffaCakes118.apk

  • Size

    17.9MB

  • MD5

    6aa5d9bc6f6d71ddec8c0ed738d19c75

  • SHA1

    3e8ff09f0dd4e76e74ec95ee2de372ed973cf2e3

  • SHA256

    d7a2619791e5ff6f880139c92f772c066f01ef32df245f9bb8980926e8186e50

  • SHA512

    04d079d1b637b231e564a03c8271a42581de9326c869b1ccb29cbc2896067ec6e12d602879f541e68de974972d9123a559cd729f66b9724fb2875123dd36ce51

  • SSDEEP

    393216:Z6jAdZ5D9opbZBIPerHcV+r2tF9YC307gf/dgXRJX94F:Z6jAdXDAZBIPeryF9/Ec2XzXKF

Score
7/10
discoveryevasionimpactpersistence

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 11 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
    persistence
  • Checks if the internet connection is available 1 TTPs 2 IoCs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact

Processes

  • com.xgbuy.xg
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4310
    • chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
      2⤵
        PID:4338
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4426
    • com.xgbuy.xg:pushcore
      1⤵
      • Loads dropped Dex/Jar
      • Queries information about running processes on the device
      • Registers a broadcast receiver at runtime (usually for listening for system events)
      • Checks if the internet connection is available
      • Uses Crypto APIs (Might try to encrypt user data)
      PID:4521
      • cat /sys/class/net/wlan0/address
        2⤵
          PID:4766

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.xgbuy.xg/.jiagu/classes.dex
        Filesize

        8.0MB

        MD5

        5e99738dac60d8528303c05236b49521

        SHA1

        09defe8e673554d1fbfb6818d7f6b06926ef21e3

        SHA256

        e4d0cea4069552ea69782c90b6d51278d0f422dfe2052e7f78c992e07186b109

        SHA512

        7291923d241870717b7ea2d2f8672dc37248b3bb8070056ad923465e55e347a3da20620e79edc8ce0939083e2d3efb3d574ab9cdf4ef88364d1164dfbb49f49a

        Download Submit
      • /data/data/com.xgbuy.xg/.jiagu/classes.dex
        Filesize

        6.5MB

        MD5

        343543170cadbcad918429d62ea0b7a2

        SHA1

        9a55aefb843427a4fa43fb62e9fff30ee674b04b

        SHA256

        d2c01fef1bee484e1ee39420ba919522325c02eb4809c799fbc2b3262f2c447a

        SHA512

        d07071e13fcc2c80e2ae4bca90e9b4b23ff7a212353050ea600b3bccfa6f1ed93584d6c5ef84addb07fa418214a1b7431c8fd037edf3c7de44391ad8bffc04bb

        Download Submit
      • /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex
        Filesize

        6.5MB

        MD5

        09623bd5b2ce2e506e8dffcb2cbc3e8c

        SHA1

        e49e1b0d7af536becc5e4701b663ca1923b09c80

        SHA256

        e671a6a2653b372037b959916daf955753b4cef04d60fca7a2728c60cc5656a1

        SHA512

        c5ffb5d4b6e41531768e4635626b1ff26d8b676166d5eba1baf195d92cdad8c0ab4ccae5236897e9eaeaeb2e2cf2116d3a62790ebdbff45ede9e201139c70450

        Download Submit
      • /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex
        Filesize

        2.0MB

        MD5

        668702b0562aaaae77078af0889b6745

        SHA1

        eb46db301936ec7c0433aec9512786468d593988

        SHA256

        744961b59ffd06c0769febccd0c634a0bbc36a16c8ad8715d177b4a737fa3123

        SHA512

        00d36a6f14c526c5524ff1cf13eb46364397b464def62f99df58716f49b4b80e448cc3c16b056a1d4f3c2cd888dd1b31636cd56e86adad286643dafa3526df62

        Download Submit
      • /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
        Filesize

        455KB

        MD5

        e5a53000766ebc433b27d6a66ec4f555

        SHA1

        2c8f53f1c03aec2005bcad67d731f07261dabde0

        SHA256

        78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

        SHA512

        370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

        Download Submit
      • /data/data/com.xgbuy.xg/.jiagu/tmp.dex
        Filesize

        284B

        MD5

        f1771b68f5f9b168b79ff59ae2daabe4

        SHA1

        0df6a835559f5c99670214a12700e7d8c28e5a42

        SHA256

        9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

        SHA512

        dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

        Download Submit
      • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ac
        Filesize

        32B

        MD5

        1264f30db5bc978090c891fc9ba97820

        SHA1

        22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc

        SHA256

        6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c

        SHA512

        f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488

        Download Submit
      • /data/data/com.xgbuy.xg/files/.jglogs/.jg.di
        Filesize

        340B

        MD5

        6b3237efa6443d0d4cb612dc5db80678

        SHA1

        27160110a3065a67fcb28ced312f747b1d4f0d0b

        SHA256

        73b42d21d4e5f5dbb6d3474f7f2fc88bd8168baf80395f19db875edfdfaaf3cf

        SHA512

        c9362e3c4616a799a877b2c98bea7a0192502371bb994e3e7f99e5c119716a5542b79a37c15884921b67472da6ecf24d00a72fec37a82567b953d152ad281be6

        Download Submit
      • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ic
        Filesize

        32B

        MD5

        9afbf0dc0b4a4fd0a874cfec2c55461a

        SHA1

        a42766499eef11be1120ff87588b7f715c1b2a7f

        SHA256

        75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37

        SHA512

        863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d

        Download Submit
      • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ri
        Filesize

        314B

        MD5

        1dcb58d4d0d8e3e98516aee1d976b259

        SHA1

        040eb8866c492c893d18daf82ca3291c5bb53234

        SHA256

        f1b0822eff758763db0140c0979a36e82c4612db0c61852d176b67bae7b8bde1

        SHA512

        76209ba34266d1993284746e0b77fa45e9726b183cb9a99605f6f9e637d67dea4641d00a390c9c6f0f37fe5cb7daa0e9ab382cd3e60dae6ca542b962985aa04c

        Download Submit
      • /data/data/com.xgbuy.xg/files/.jiagu.lock
        Filesize

        27B

        MD5

        f4c32458af5fc664ecaf61772e9e92de

        SHA1

        547ae24ac2b543c3ead5fd2899c2b4217e885801

        SHA256

        ec61063002cb18c6d354ce3c3b166da5f476d4f37e0d0567ebe52fc87097fa28

        SHA512

        a47188ecdbfb69fd130f117b5cbf7d9496163ddf7d849481236c507ece7ec4b73f94a14b3e1222dccae13484030e68a3264871a6ebaa4b409c1b0a3260dbb335

        Download Submit
      • /data/data/com.xgbuy.xg/files/Mob/mob_commons_1
        Filesize

        2B

        MD5

        99914b932bd37a50b983c5e7c90ae93b

        SHA1

        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

        SHA256

        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

        SHA512

        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

        Download Submit
      • /data/data/com.xgbuy.xg/files/Mob/share_sdk_1
        Filesize

        23B

        MD5

        8e24e79baab91c4d0604eaa9006a0cb3

        SHA1

        e427afc94a4b957a7096f73e395a10ea404c076b

        SHA256

        65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

        SHA512

        45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

        Download Submit
      • /storage/emulated/0/360/.deviceId
        Filesize

        48B

        MD5

        1d8d16c4e3b19ebf18988530d9b9a757

        SHA1

        bc94c1cce05cd848a53271ecb9c5311e27ffebf5

        SHA256

        abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

        SHA512

        4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

        Download Submit
      • /storage/emulated/0/360/.iddata
        Filesize

        92KB

        MD5

        d93e59bcc5acb5cc1dd857a00a0312f7

        SHA1

        ef864a49deb56145dbde3b148359b963875fbee9

        SHA256

        e7e555a66c8fadfd59e8a1bea452f6440763b490a02a2208f587e29e46427cef

        SHA512

        8f6a84542564f05595defa3d4286952f26bf151751ec44900766000057c6d7161889088d5d532e5dfb325944dcd55507e4d97bab8e590ede226d1b58765ead97

        Download Submit
      • /storage/emulated/0/Mob/comm/.di
        Filesize

        57B

        MD5

        70a42cba408700f9a6c01c7941a8829e

        SHA1

        eab01cc2c0671538795fb0b1146017dc099d0984

        SHA256

        499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

        SHA512

        8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

        Download Submit