2b1ec8a0d6ae6fcb1b525ee59aab58c9b9962a9ed73524a65c54f8d751b006d0

Analysis

max time kernel
10s
max time network
144s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
29/05/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

819760e3240527d98198cafff9ab7bfb_JaffaCakes118.apk
Size

19.2MB
MD5

819760e3240527d98198cafff9ab7bfb
SHA1

d9554e2a27c47fbb831b63b9a8546d0d65ea77e6
SHA256

2b1ec8a0d6ae6fcb1b525ee59aab58c9b9962a9ed73524a65c54f8d751b006d0
SHA512

ac3cd327e70d345da4be44898e369db71dba059f6b3b11596a27f45dc643582fb990e20f7cbf6ae34465bd98f9dfb25e906e45dc4384f59a62ee33738f01c958
SSDEEP

393216:ojjQ9Zy1joIBB1uHRiNkr8scj+r2tF9Ymud3j7gfPdgZ7iiTrx5t:ojjQW1oQ2PY9F96TcGZeiT1f

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xgbuy.xg/[email protected]	4619	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex	4619	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex	4619	com.xgbuy.xg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg

com.xgbuy.xg
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4619

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
1f30b825b6af64529a5e5fda4b39c8e0

SHA1
3d422bd08fb11bbf1d5fdfe35dd6661899e919a5

SHA256
b6501d29d8b95509fff01a6711fde5416e8c132116198cb4bdb6774de65f8083

SHA512
493971bb50fc511143c2d3ff9e2f8e5688866a9fbee22ac5dad54330fd04c1546a6e3b42d24b1c0854b592762887097dfc0a5de1abadd10dca15f5acb5d102e6

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

Filesize
314B

MD5
3325c5465888b1d1342f8882bc1a5a0e

SHA1
58955e0f749ca59736664c8dfc4b8648cec68360

SHA256
d52164d1795e7036709c1e0238b6adaae0104ebebd428f1ba554894cf5ab64ff

SHA512
5f3713b8d1ecadc8575f00be1f324681c58ec1404b7ebb6920bdf5fbee513d7ec1dc6eb2886e17fd3a571301aec452ec7be56f672e39c2791640107c66d956a8

Download Submit
/data/data/com.xgbuy.xg/files/.jiagu.lock

Filesize
27B

MD5
edb37c1cc207d133bbd67ed5d4fc3f40

SHA1
5124ac2d761af8ef6c65a55c3a8727ba0d766f4a

SHA256
c1a4b3586c330cc1b19c4890f4a4498210255f30afd8ce1b09f56efe379926e6

SHA512
5849d26cb7840b65fc426a8701e812bcca3d6799acb01f32cea9b4d7d63b5c19aed93f45ad2d3c3bffea905dd86d32257a4b11d7c8bb58edc516ef0e38cbde48

Download Submit
/data/user/0/com.xgbuy.xg/.jiagu/classes.dex

Filesize
8.2MB

MD5
2f7c2a545fabc42357818c4d35052eb0

SHA1
de52edb45f76a000f2be429ef0e7daf7245c35a8

SHA256
7dcc68dd4f94a23b6beffb924eca54ea4a9093534b34fb377d6b9ab5fbeffe78

SHA512
40b6cbbcbfe0771469f025a1a798c4bff6dbbf55426220486ecbe7654506d7a240aba9b4d76db29e54bc468e44b996bb324091315cf7b1702bc0fc0573879f34

Download Submit
/data/user/0/com.xgbuy.xg/.jiagu/libjiagu.so

Filesize
455KB

MD5
e5a53000766ebc433b27d6a66ec4f555

SHA1
2c8f53f1c03aec2005bcad67d731f07261dabde0

SHA256
78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

SHA512
370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]

Filesize
6.5MB

MD5
3607e9bc414a499b1da47aeee45672f2

SHA1
04b39c1fad9bd8b87eb58520ef98c649b4864a26

SHA256
80b924b9cb646f78b355227c8c265a0e694c3b1b2b17bce5c992fc8399e475fa

SHA512
0b3733811437cc28a57930c5cf57aa692e8e18e55c1dd3ba534de00cc374b3d1618a40dd0bea185d369816e96c67fe5d6ba981a51142f5f436997f0bcd574771

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex

Filesize
6.5MB

MD5
2edb8333947a3cbbf4f2ad35404817fb

SHA1
22ae5219b5a313b13dc9d65590507fa01cb63b77

SHA256
c9f2509cab8c706548fa84a52ec17f7477666cc5d216e2751023c13c783658a8

SHA512
f90cb78128e059c587698697d88a20a101d08965c05b845382316dde2015a9674b975d68fea7f4a457cfb333c741248e2d84a39f4ce6db60f5497eb431f86026

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex

Filesize
2.4MB

MD5
26cfde3ec0e689982b8c2c01e0313830

SHA1
e79bfad35416572ed90b33106b0e4353f609d742

SHA256
450570e28912a1267aca4a1f0c7f28571da0a6c83cb711bf6c35f6a8b228b4b4

SHA512
431268d92e22fb0a819384434ac2bcf1a59d18cd3300e13524baaa517641ed6cb2eb0d8a8747b75d2aceb73fa9b026005fe6cff339a47c8a119329f198f7972e

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
4c4c5285293d5141f582aefa4e038669

SHA1
e01852a72e5a8e6f7d63a21426b515118196047b

SHA256
36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

SHA512
097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
bc317b3abebee77b74c4a6237adb87f1

SHA1
9c0ee6e285d8a91749debbe85fd489f1e9f9b68e

SHA256
f8d808e6eaae530ffcf0c5b1701272a7e7f448b8c839a6ebd53be9bf3805d8fa

SHA512
65bce3fdbf8972a9e0595cc14246ff034d3ed34cf07da6c19fe057868c4d1bd5185e1a3f4c3bfdad2b239d58e4be2d8982ba8f69ae0712fa8cc81368d421e629

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads