bdf2ed321e200e7e28e03b40957c35561691a8aa0b9bd1a0e99861ab98ed0f73

Analysis

max time kernel
9s
max time network
148s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
30/05/2024, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84726daf777e8e86c5a46db63cb7b035_JaffaCakes118.apk
Size 19.2MB
Sample240530-rm6mpabd5x
SHA256 bdf2ed321e200e7e28e03b40957c35561691a8aa0b9bd1a0e99861ab98ed0f73
MD5 84726daf777e8e86c5a46db63cb7b035
SHA1 dbbd5207ba0f8e83beeab53e6f745d583b0b576f
SHA512 84b5c1bfe6f9fa358da39f498548e90f0d2f80e1a570bb15a8f1ead1ec60f286567f2703818ac9ecc837f22670b5ef79b30cabd8258d6e23239a3211602facb7
SSDEEP 393216:ojjQ9Zy1joIBB1uHRiNkr8scj+r2tF9Ymud3j7gfPdgZ7iiTrx5B:ojjQW1oQ2PY9F96TcGZeiT17
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xgbuy.xg/[email protected]	4625	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex	4625	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex	4625	com.xgbuy.xg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg

com.xgbuy.xg
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4625

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.jg.ac

Path /data/data/com.xgbuy.xg/files/.jglogs/.jg.ac
Size 32B
SHA256 6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c
MD5 1264f30db5bc978090c891fc9ba97820
SHA1 22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc
SHA512 f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488
MD5 SHA1 SHA512

Submit Download

.jg.di

Path /data/data/com.xgbuy.xg/files/.jglogs/.jg.di
Size 340B
SHA256 3aeaa92f4543497139a40ca4c537468e11684e4b1f9e2b05b35de0d45136a363
MD5 87ee63e80d02e10ee6ab36f43669bd8e
SHA1 3b619457c6d4a5f4d8f867ad15edd2e1da68735c
SHA512 212f2b9855ebe4a52b6ae79fd757a6dd4c1f5bc54e9aa3d672c5e73ea7cfade2fc6047642ae9f7ccb2d7bf2291a5123e8839b49db3dcba3bb917936ff2b95090
MD5 SHA1 SHA512

Submit Download

.jg.ic

Path /data/data/com.xgbuy.xg/files/.jglogs/.jg.ic
Size 32B
SHA256 75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37
MD5 9afbf0dc0b4a4fd0a874cfec2c55461a
SHA1 a42766499eef11be1120ff87588b7f715c1b2a7f
SHA512 863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d
MD5 SHA1 SHA512

Submit Download

.jg.ri

Path /data/data/com.xgbuy.xg/files/.jglogs/.jg.ri
Size 314B
SHA256 043c418a1f408fecf6f7b94eff149d8310f0444d873f9f4ea2cbb6bc4b374ac6
MD5 fb4aaade4de187342899d826d0174e60
SHA1 ab9ea9c6c86009e3cb89752f19674b8fd1762004
SHA512 01668b1f98162d7175498bb686e31f83693143059403ce48897c6c012cd8c8419d07fc50a16fcc4eafb31b6dc1a95e19a11afb540054a7fc9e209111085971ed
MD5 SHA1 SHA512

Submit Download

.jiagu.lock

Path /data/data/com.xgbuy.xg/files/.jiagu.lock
Size 27B
SHA256 5261a12741bb4ed72d1ade5c4f7cf7d5d289dfa79de3fff061b058067fa54b12
MD5 95b7eab315dfe91252b87e397bd6ea27
SHA1 6e69f3a30d8946c581fbd442819a160d36a741e9
SHA512 271b2a05d17cfd389ff48af3a7e8e3a3ca346c024713d9ff331c1c59c3cf5e4f1711b8837546b6c1100fb0309b2dc85f149a4fbd7910e4bcdf18124902752c34
MD5 SHA1 SHA512

Submit Download

classes.dex

Path /data/user/0/com.xgbuy.xg/.jiagu/classes.dex
Size 8.2MB
SHA256 7dcc68dd4f94a23b6beffb924eca54ea4a9093534b34fb377d6b9ab5fbeffe78
MD5 2f7c2a545fabc42357818c4d35052eb0
SHA1 de52edb45f76a000f2be429ef0e7daf7245c35a8
SHA512 40b6cbbcbfe0771469f025a1a798c4bff6dbbf55426220486ecbe7654506d7a240aba9b4d76db29e54bc468e44b996bb324091315cf7b1702bc0fc0573879f34
SSDEEP 196608:c4i8qBlXToppkSUFK955xBqH+Slh5lgvLX8:2BF841FK955xBqH+SPOr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjiagu.so

Path /data/user/0/com.xgbuy.xg/.jiagu/libjiagu.so
Size 455KB
SHA256 78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e
MD5 e5a53000766ebc433b27d6a66ec4f555
SHA1 2c8f53f1c03aec2005bcad67d731f07261dabde0
SHA512 370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d
SSDEEP 12288:XfCZt8eDxO+LCDA89hC2KL/MqEvnapbMt6hVPZWJ:Xfw/O0Cc8zCD/MVvUHnRWJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path /data/user/0/com.xgbuy.xg/[email protected]
Size 6.5MB
SHA256 80b924b9cb646f78b355227c8c265a0e694c3b1b2b17bce5c992fc8399e475fa
MD5 3607e9bc414a499b1da47aeee45672f2
SHA1 04b39c1fad9bd8b87eb58520ef98c649b4864a26
SHA512 0b3733811437cc28a57930c5cf57aa692e8e18e55c1dd3ba534de00cc374b3d1618a40dd0bea185d369816e96c67fe5d6ba981a51142f5f436997f0bcd574771
SSDEEP 49152:FBBYKkhgqILirAK623W0nJnUc5DrkaqUI8iSR4++IuOSumAuz87Amf/UHcXD74qk:FYhhIjK627ltbRRqvAuoUdHP
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes2.dex

Path /data/user/0/com.xgbuy.xg/[email protected]!classes2.dex
Size 6.5MB
SHA256 c9f2509cab8c706548fa84a52ec17f7477666cc5d216e2751023c13c783658a8
MD5 2edb8333947a3cbbf4f2ad35404817fb
SHA1 22ae5219b5a313b13dc9d65590507fa01cb63b77
SHA512 f90cb78128e059c587698697d88a20a101d08965c05b845382316dde2015a9674b975d68fea7f4a457cfb333c741248e2d84a39f4ce6db60f5497eb431f86026
SSDEEP 98304:O/GhmR8JMTR91mZwYgtFK955xBqH+Slh7B:O/G2VWDUFK955xBqH+Slh1
MD5 SHA1 SHA512 SSDEEP

Download

[email protected]!classes3.dex

Path /data/user/0/com.xgbuy.xg/[email protected]!classes3.dex
Size 2.4MB
SHA256 450570e28912a1267aca4a1f0c7f28571da0a6c83cb711bf6c35f6a8b228b4b4
MD5 26cfde3ec0e689982b8c2c01e0313830
SHA1 e79bfad35416572ed90b33106b0e4353f609d742
SHA512 431268d92e22fb0a819384434ac2bcf1a59d18cd3300e13524baaa517641ed6cb2eb0d8a8747b75d2aceb73fa9b026005fe6cff339a47c8a119329f198f7972e
SSDEEP 49152:8X0XIySJy/Axunz3jbsMe7zvC91T3OI775sLoGv9q5:G0+MN5fT5
MD5 SHA1 SHA512 SSDEEP

Download

.deviceId

Path /storage/emulated/0/360/.deviceId
Size 48B
SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
MD5 4c4c5285293d5141f582aefa4e038669
SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
MD5 SHA1 SHA512

Submit Download

.iddata

Path /storage/emulated/0/360/.iddata
Size 32B
SHA256 f8d808e6eaae530ffcf0c5b1701272a7e7f448b8c839a6ebd53be9bf3805d8fa
MD5 bc317b3abebee77b74c4a6237adb87f1
SHA1 9c0ee6e285d8a91749debbe85fd489f1e9f9b68e
SHA512 65bce3fdbf8972a9e0595cc14246ff034d3ed34cf07da6c19fe057868c4d1bd5185e1a3f4c3bfdad2b239d58e4be2d8982ba8f69ae0712fa8cc81368d421e629
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads