cb4c4523ac16e1d8928221c3a8dcff8b735ee38666ea664248a5f20ff720cb92

Analysis

max time kernel
170s
max time network
180s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
05/06/2024, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9789d7fe0e5d03ddadf4c54974e48878_JaffaCakes118.apk
Size

17.9MB
MD5

9789d7fe0e5d03ddadf4c54974e48878
SHA1

859ba70a7e57bc4a9089a05e0e9bf049f7771ba4
SHA256

cb4c4523ac16e1d8928221c3a8dcff8b735ee38666ea664248a5f20ff720cb92
SHA512

022a8a2b74a26a5f91fff6b88ac689b239b82e07a311f02fb4fde8a8713aff867b5154a8affe9b5fb3a4f809d9af32edbbb1be0b2d4640089bcab9f5bdc2f586
SSDEEP

393216:Z6jAdZ5D9opbZBIPerHcV+r2tF9YC307gf/dgXRJX94+:Z6jAdXDAZBIPeryF9/Ec2XzXK+

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 11 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.xgbuy.xg/.jiagu/classes.dex	4284	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex	4284	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex	4284	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4284	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4336	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4284	com.xgbuy.xg
/data/data/com.xgbuy.xg/.jiagu/classes.dex	4382	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex	4382	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex	4382	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4382	com.xgbuy.xg:pushcore
/data/data/com.xgbuy.xg/.jiagu/tmp.dex	4382	com.xgbuy.xg:pushcore

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xgbuy.xg:pushcore
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xgbuy.xg

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg:pushcore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg:pushcore
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg:pushcore

com.xgbuy.xg
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4284
- chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
  2⤵
  PID:4309
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4336

com.xgbuy.xg:pushcore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4382
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4482

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xgbuy.xg/.jiagu/classes.dex

Filesize
8.0MB

MD5
5e99738dac60d8528303c05236b49521

SHA1
09defe8e673554d1fbfb6818d7f6b06926ef21e3

SHA256
e4d0cea4069552ea69782c90b6d51278d0f422dfe2052e7f78c992e07186b109

SHA512
7291923d241870717b7ea2d2f8672dc37248b3bb8070056ad923465e55e347a3da20620e79edc8ce0939083e2d3efb3d574ab9cdf4ef88364d1164dfbb49f49a

Download Submit
/data/data/com.xgbuy.xg/.jiagu/classes.dex

Filesize
6.5MB

MD5
343543170cadbcad918429d62ea0b7a2

SHA1
9a55aefb843427a4fa43fb62e9fff30ee674b04b

SHA256
d2c01fef1bee484e1ee39420ba919522325c02eb4809c799fbc2b3262f2c447a

SHA512
d07071e13fcc2c80e2ae4bca90e9b4b23ff7a212353050ea600b3bccfa6f1ed93584d6c5ef84addb07fa418214a1b7431c8fd037edf3c7de44391ad8bffc04bb

Download Submit
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex

Filesize
6.5MB

MD5
09623bd5b2ce2e506e8dffcb2cbc3e8c

SHA1
e49e1b0d7af536becc5e4701b663ca1923b09c80

SHA256
e671a6a2653b372037b959916daf955753b4cef04d60fca7a2728c60cc5656a1

SHA512
c5ffb5d4b6e41531768e4635626b1ff26d8b676166d5eba1baf195d92cdad8c0ab4ccae5236897e9eaeaeb2e2cf2116d3a62790ebdbff45ede9e201139c70450

Download Submit
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex

Filesize
2.0MB

MD5
668702b0562aaaae77078af0889b6745

SHA1
eb46db301936ec7c0433aec9512786468d593988

SHA256
744961b59ffd06c0769febccd0c634a0bbc36a16c8ad8715d177b4a737fa3123

SHA512
00d36a6f14c526c5524ff1cf13eb46364397b464def62f99df58716f49b4b80e448cc3c16b056a1d4f3c2cd888dd1b31636cd56e86adad286643dafa3526df62

Download Submit
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so

Filesize
455KB

MD5
e5a53000766ebc433b27d6a66ec4f555

SHA1
2c8f53f1c03aec2005bcad67d731f07261dabde0

SHA256
78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

SHA512
370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

Download Submit
/data/data/com.xgbuy.xg/.jiagu/tmp.dex

Filesize
284B

MD5
f1771b68f5f9b168b79ff59ae2daabe4

SHA1
0df6a835559f5c99670214a12700e7d8c28e5a42

SHA256
9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

SHA512
dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
af44cd93012c299c11aa7bcf9be273b6

SHA1
df1a5997b8764beaa5c5af534d82b4fb2bf66d7f

SHA256
c13be18c8960bfd7742cc4b1adc52d1f078ebdcc7be6825b028c3ff2000b26ea

SHA512
6a4c60ab8dc03af2c802ac73d168e85653663e726dcb69eaf09c352c6acfc0c98ab5f37ec0acffdea451b5914075f2c8657c9515848e9e3afaef2c5a1cbf32d0

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-wal

Filesize
112KB

MD5
08110969b8dfffb4b792da7914a2f779

SHA1
7bbdb353d2bdd1178283ed8464e8abeb27cb74f1

SHA256
a7c1574f27a3bbe8bb0921fbccdbfb266a67087382a77517b8560b37c08e99ea

SHA512
16e6e04a0e4ca7009c47aa0702daf7a1e52ab6310e032e4e1eeb4ae6141c83c1220c5df48f2c4a6cf063154865a37a53e88899bc10e4c4a2fc6c0b69f128fe6e

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
0983dca33504182b1e145288f43dd17a

SHA1
5117418984d4079a48b210966e892b8f6b8e6128

SHA256
f40883f3a177d21a2776565a6f13449781bc023234b9666a2b36a007df73c87c

SHA512
79ee5336bb760f777573f32568287605b5b5f09fcf53fd9eda7da2b52d2776d523651c8185b45eee4390aca651eff7160468d88ae1e522c36ff9b43d76dae9f9

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ic

Filesize
32B

MD5
e96f71068effa2e4c2c3a6abc3408922

SHA1
d4ba894022c21ad2c5e5f4cdc3f33ce38a372832

SHA256
2defb051411d42ff1e2ba6d526f038e27c0023a77df14a212d598368caf88468

SHA512
4c724b9add574803336d007c773e19016fb8fd79245d89671568be403b3675939645d7adc70b8102c2985566907836383af7f083ff838610b6bb1fdcab8d2708

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

Filesize
314B

MD5
c41d6e1953c6f501d12f005bc8147737

SHA1
b5b7e2854c11b65b5124a309064b53c4c1d5d95c

SHA256
0c19643ca52ff7a223b1039de6c32f3e70194bf3ce8c1f78d900744dfbeb3abf

SHA512
60d19a60e4ddb35e7ae321cc92f9fd7e7734f689cabd496d3a1e63feb8db000b119095042330ff936ae2270c8c791edfc0bac008f7b5e0b2c725c0a5cb59e4d7

Download Submit
/data/data/com.xgbuy.xg/files/.jiagu.lock

Filesize
27B

MD5
f94131df2900393ac444aa0e117d918f

SHA1
7e5d96a31474e2966fbdb8f3d7d4bc6519bc1263

SHA256
1bf50216bd40edabc9e52ba1cb9f4a1c50b6b4a275ac418fcb858130dfda55da

SHA512
636de2c89d5755402e706754935def4f6494af52a4a0da44146c4b167988c3b802b89a19c6533f0b2b3b8fe68a0dff65322e48268bbbeb47efeb40162e40287c

Download Submit
/data/data/com.xgbuy.xg/files/Mob/mob_commons_1

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.xgbuy.xg/files/Mob/share_sdk_1

Filesize
23B

MD5
8e24e79baab91c4d0604eaa9006a0cb3

SHA1
e427afc94a4b957a7096f73e395a10ea404c076b

SHA256
65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

SHA512
45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
e0d65d2e00554e68c3aa56a8db07ceb9

SHA1
c175fa94b4bd21efd211ce8d1273a8f2178787f2

SHA256
564421dcec85ee3aca3b26f1198bdc09daffd0a2fde1aa8dfc62aa38afabd223

SHA512
6b9df88ebe0b763093a122fca43d9c639a6f218511ac2f942078f1dca778dc3bbc7a3a7108753636248e3ed9fc31d0dff34769c8f8254483634dc3875a59e14b

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
acc2a2f5cb76c41d2e97e0d409b53bdd

SHA1
ed06f22ff10e0912f50d53bc775ed2ae70f85d5a

SHA256
12ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448

SHA512
faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads