Analysis Overview
SHA256
46520ac104a09748c431dc9df444acda4c8fea165886061311799a9c7f07b74e
Threat Level: Shows suspicious behavior
The file a3974978d24fea1b0d9841c4744997b3_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped Dex/Jar
Queries information about running processes on the device
Requests dangerous framework permissions
Queries information about active data network
Queries information about the current Wi-Fi connection
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
Uses Crypto APIs (Might try to encrypt user data)
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-13 02:50
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 02:50
Reported
2024-06-13 02:53
Platform
android-x86-arm-20240611.1-en
Max time kernel
179s
Max time network
184s
Command Line
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
com.xgbuy.xg
chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
com.xgbuy.xg:pushcore
cat /sys/class/net/wlan0/address
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.204.74:443 | tcp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | api.exc.mob.com | udp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| US | 1.1.1.1:53 | api.sobot.com | udp |
| CN | 203.107.41.32:443 | api.sobot.com | tcp |
| US | 1.1.1.1:53 | log.reyun.com | udp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| US | 1.1.1.1:53 | api.share.mob.com | udp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| US | 1.1.1.1:53 | a.xgbuy.cc | udp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| US | 1.1.1.1:53 | s.jpush.cn | udp |
| CN | 1.92.70.140:19000 | s.jpush.cn | udp |
| CN | 203.107.41.32:443 | api.sobot.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| US | 1.1.1.1:53 | plbslog.umeng.com | udp |
| CN | 36.156.202.73:443 | plbslog.umeng.com | tcp |
| US | 1.1.1.1:53 | downt.ntalker.com | udp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 182.92.245.193:80 | downt.ntalker.com | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| GB | 216.58.201.110:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.179.238:443 | android.apis.google.com | tcp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | t.gdt.qq.com | udp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| US | 1.1.1.1:53 | update.sdk.jiguang.cn | udp |
| NL | 43.152.42.165:80 | t.gdt.qq.com | tcp |
| CN | 1.92.70.140:19000 | s.jpush.cn | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| US | 1.1.1.1:53 | sis.jpush.io | udp |
| CN | 1.94.119.240:19000 | sis.jpush.io | udp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| US | 1.1.1.1:53 | api.exc.mob.com | udp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| CN | 1.94.119.240:19000 | sis.jpush.io | udp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| US | 1.1.1.1:53 | api.share.mob.com | udp |
| US | 1.1.1.1:53 | api.share.mob.com | udp |
| CN | 203.107.41.32:443 | api.sobot.com | tcp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 203.107.41.32:443 | api.sobot.com | tcp |
| US | 1.1.1.1:53 | ulogs.umeng.com | udp |
| CN | 223.109.148.177:443 | ulogs.umeng.com | tcp |
| CN | 36.156.202.73:443 | plbslog.umeng.com | tcp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| US | 1.1.1.1:53 | downt.ntalker.com | udp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 182.92.245.193:80 | downt.ntalker.com | tcp |
| US | 1.1.1.1:53 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | api.exc.mob.com | udp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| CN | 113.31.17.108:19000 | udp | |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| US | 1.1.1.1:53 | tcp | |
| US | 1.1.1.1:53 | im64.jpush.cn | udp |
| CN | 139.9.135.156:7003 | im64.jpush.cn | tcp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| US | 1.1.1.1:53 | downt.ntalker.com | udp |
| CN | 182.92.245.193:80 | downt.ntalker.com | tcp |
| US | 1.1.1.1:53 | 139.9.135.156 | udp |
| US | 1.1.1.1:53 | 139.9.138.15 | udp |
| US | 1.1.1.1:53 | 119.3.188.193 | udp |
| CN | 139.9.135.156:7000 | im64.jpush.cn | tcp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 139.9.135.156:7002 | im64.jpush.cn | tcp |
| CN | 113.31.17.106:7000 | tcp | |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| CN | 1.92.70.140:19000 | easytomessage.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 223.109.148.178:443 | ulogs.umeng.com | tcp |
| CN | 36.156.202.73:443 | plbslog.umeng.com | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 120.55.96.240:80 | a.xgbuy.cc | tcp |
| CN | 1.94.119.240:19000 | easytomessage.com | udp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | downt.ntalker.com | udp |
| CN | 182.92.245.193:80 | downt.ntalker.com | tcp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 113.31.17.108:19000 | udp | |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| US | 1.1.1.1:53 | log.reyun.com | udp |
| US | 1.1.1.1:53 | _im64._tcp.jpush.cn | tcp |
| CN | 139.9.135.156:7002 | im64.jpush.cn | tcp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 139.9.135.156:7003 | im64.jpush.cn | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 139.9.135.156:7000 | im64.jpush.cn | tcp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 223.109.148.179:443 | ulogs.umeng.com | tcp |
| CN | 113.31.17.106:7000 | tcp | |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | downt.ntalker.com | udp |
| CN | 182.92.245.193:80 | downt.ntalker.com | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 1.92.70.140:19000 | easytomessage.com | udp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| CN | 1.94.119.240:19000 | easytomessage.com | udp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 113.31.17.108:19000 | udp | |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 223.109.148.141:443 | ulogs.umeng.com | tcp |
| CN | 54.223.175.26:80 | log.reyun.com | tcp |
| US | 1.1.1.1:53 | _im64._tcp.jpush.cn | tcp |
| CN | 139.9.135.156:7003 | im64.jpush.cn | tcp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| CN | 139.9.135.156:7000 | im64.jpush.cn | tcp |
| CN | 139.9.135.156:7002 | im64.jpush.cn | tcp |
| CN | 113.31.17.106:7000 | tcp | |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 1.92.70.140:19000 | easytomessage.com | udp |
| CN | 223.109.148.130:443 | ulogs.umeng.com | tcp |
| CN | 1.94.119.240:19000 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 113.31.17.108:19000 | udp | |
| US | 1.1.1.1:53 | _im64._tcp.jpush.cn | tcp |
| CN | 139.9.135.156:7000 | im64.jpush.cn | tcp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 139.9.135.156:7002 | im64.jpush.cn | tcp |
| CN | 139.9.135.156:7003 | im64.jpush.cn | tcp |
| CN | 223.109.148.176:443 | ulogs.umeng.com | tcp |
| CN | 113.31.17.106:7000 | tcp |
Files
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so
| MD5 | e5a53000766ebc433b27d6a66ec4f555 |
| SHA1 | 2c8f53f1c03aec2005bcad67d731f07261dabde0 |
| SHA256 | 78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e |
| SHA512 | 370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d |
/data/data/com.xgbuy.xg/.jiagu/classes.dex
| MD5 | a838fff4fdf89930be6dd388fbd80659 |
| SHA1 | 14a327fb3b6029e6a4fbdf829615db18366337a0 |
| SHA256 | bca7fbb222a7bd8cb5d067c98640e4503b08e25b319c2962404ff958560560b6 |
| SHA512 | 84b15c21ac4a0ce0511b4aed2b759303e5b9044eddd117684e2d1762c6bf537198ffb229bd964decd3ab40a4abfc0774e4557c9a96da290693d9f9c434ba0598 |
/data/data/com.xgbuy.xg/.jiagu/classes.dex
| MD5 | aacdf68939a164cb8fb1f7aba60233ff |
| SHA1 | fdb0bd467ea9464193414daf0838c131bb494ce4 |
| SHA256 | d3decdf9ddd937c07ff0f8e00331cf3af484723a2d10ddadc98cae19a814d81f |
| SHA512 | 4deea43b8b2b8b234e9a05c4e41e8cd525b049ab549281e97310bca437e457409dd7028873f7745385aa7553f7e75c4f0a466079c7621f418f4806fb184e8ea4 |
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex
| MD5 | 4a44fc220c4e12fa64f6c957b7d541e7 |
| SHA1 | 965b965653d42a63069a07e3628452e97ba0a952 |
| SHA256 | e63677f9eeca7225447f60398d4831f27b6bd5c666d908329d7cb03f260b76ef |
| SHA512 | c2a3aef3e712ba0f2d961bf281ca4f6b0e50cf1f5dc051ba4f2d93e6d06c825a2396bd1b5ce446ed081d357625a1b44cfb0f4a55d4624bad26047e721ce7410c |
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex
| MD5 | 415589b5e032e13b9871b2d615c3c87b |
| SHA1 | 20aa8c0f50fb4eea5330cd30c4a2851479994f8b |
| SHA256 | 6aea01f6796ab45336d6763dc6bcad2dc452abd9e0d307b6b79cea6070209bf9 |
| SHA512 | 5f1c985cd2de55eeeb2f2ad742effeb6775d43d9ad812716b326035f5c8843c4c4cf08e1b131d5501ccbe2d9ab859a60ef406814f6c86f4cb57fc0c93858d4f6 |
/data/data/com.xgbuy.xg/.jiagu/tmp.dex
| MD5 | f1771b68f5f9b168b79ff59ae2daabe4 |
| SHA1 | 0df6a835559f5c99670214a12700e7d8c28e5a42 |
| SHA256 | 9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939 |
| SHA512 | dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d |
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri
| MD5 | e04901067f649e99c358d37ed5e43502 |
| SHA1 | e510b44a5234902cc695e58c3de256493ce54683 |
| SHA256 | dcb551a2d362e42a1c76ac067ab92cb8f485b28fdcf67fe87f45ebf92052914e |
| SHA512 | a788a532556e0e1bf7cf4bfb90976b88530e9856548341264f02f5d19533c08a40f2a5dcd5729bb1271c1feea90dd5018f8a634d47c5a7622d9388bc0b4794b0 |
/data/data/com.xgbuy.xg/files/.jiagu.lock
| MD5 | 4f2fb5ddccafc0cf74fbfbb0178ce769 |
| SHA1 | de7335601c78ccf658489ab49d283a36be14f9b0 |
| SHA256 | 7ac70d23e175a7cbf1c8d22f14921944ea86761c31e67b6a275eb13c1b044ac0 |
| SHA512 | b0d2ab772bcf2804425e4181d7f8502df140fdc88559e7bfacd6d7d6f19a582773e89619cf90bdc6c4e8be13fe04435d2b2e6d5272b57fcb7b9774d58a186336 |
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ac
| MD5 | 1264f30db5bc978090c891fc9ba97820 |
| SHA1 | 22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc |
| SHA256 | 6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c |
| SHA512 | f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488 |
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ic
| MD5 | 9afbf0dc0b4a4fd0a874cfec2c55461a |
| SHA1 | a42766499eef11be1120ff87588b7f715c1b2a7f |
| SHA256 | 75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37 |
| SHA512 | 863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d |
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di
| MD5 | 3a2a752388906eb7fc96383609afb19f |
| SHA1 | 19ec32a5a8fac54106eec99c9fa09c11e9f3dcae |
| SHA256 | c262b81f1145844df08e825bc7014e70d5de07dbafe89037e95fdbc02ca72e53 |
| SHA512 | e02c16ecc3ffc3396f115e05f5e96ab295a49914ecf53f4fc73a41070326780b15011a3061fa4ca0d91d0fcd981a192be1360c6721883414a32d310f2820488c |
/storage/emulated/0/360/.iddata
| MD5 | 05ca8139924d0df7a71497dce10d363b |
| SHA1 | 3ea0a594d027cd814cc921ed53cf579333740f79 |
| SHA256 | 5316fa31377f36855f0e98d236678b6d9b2f8996a8b427f99afaf05eac683426 |
| SHA512 | 57e07c432a81f41138f62876a1ac1a8c65fedb6e148e6939eca12f2dd7476deb7e2f8cd7cf4ed4e7deef343ad1674e2cee7e793bd8a9b7ea4654568e4123a85e |
/storage/emulated/0/360/.deviceId
| MD5 | 1c56df0a0870ed1c3273c17e476a6f03 |
| SHA1 | 865db3b9119dd6dc82187d525c8b6be494484a99 |
| SHA256 | 7c6359bd9670bf186ea39c6e8f08f4120d033077a6167ce7d1e76f3dca6bca5c |
| SHA512 | f07447e0c243df2dcf050b93609f339a1d5cb61cd7a240b5bcc02a2bfd160a5783e1a69ada604c72ac6fded56a9607c4624f92794a052e9f2cabbf2c334cc246 |
/storage/emulated/0/Mob/comm/.di
| MD5 | acc2a2f5cb76c41d2e97e0d409b53bdd |
| SHA1 | ed06f22ff10e0912f50d53bc775ed2ae70f85d5a |
| SHA256 | 12ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448 |
| SHA512 | faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419 |
/data/data/com.xgbuy.xg/files/sobot_chat_log/sobot_chat_20240613_log.txt
| MD5 | 711ab7f59fbda0984a63c27d8edecdee |
| SHA1 | 23e50edf653ec961a1e9037a0682ada55b3c4fb7 |
| SHA256 | e44d7c09750c797661cbde6ba2b437bfecd67ee29e6f77ba56262075e7ad1b24 |
| SHA512 | a257cbbf45df7305a10364d85a5ed336538638565413cf52c743741321e4516a7712afae4db3b3b0e4b484aa000be99e608f21b5a829ac55d609ebeab2e5c8cf |
/storage/emulated/0/Mob/.slw
| MD5 | 19402718bfb1c685a726b4e1d846ad98 |
| SHA1 | 02a7e30044a67085f2f1da24e16e4ecfede65b72 |
| SHA256 | 079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0 |
| SHA512 | 25254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b |
/storage/emulated/0/Mob/comm/.di
| MD5 | 70a42cba408700f9a6c01c7941a8829e |
| SHA1 | eab01cc2c0671538795fb0b1146017dc099d0984 |
| SHA256 | 499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f |
| SHA512 | 8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c |
/data/data/com.xgbuy.xg/files/Mob/share_sdk_1
| MD5 | 8e24e79baab91c4d0604eaa9006a0cb3 |
| SHA1 | e427afc94a4b957a7096f73e395a10ea404c076b |
| SHA256 | 65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d |
| SHA512 | 45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae |
/data/data/com.xgbuy.xg/files/Mob/mob_commons_1
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 02:50
Reported
2024-06-13 02:50
Platform
android-33-x64-arm64-20240611.1-en
Max time network
8s
Command Line
Signatures
Processes
Network
| Country | Destination | Domain | Proto |
| GB | 172.217.169.36:443 | udp | |
| GB | 172.217.169.36:443 | tcp | |
| BE | 173.194.76.188:5228 | tcp | |
| GB | 172.217.16.228:443 | tcp | |
| GB | 216.58.201.106:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.212.234:443 | udp |