c16de6dd0e8c317960b4d8d9798bf7bc0078e4417ca91c0c0f34ca4b7ccd6697

Analysis

max time kernel
21s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
13/06/2024, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3dc92f199e42cfc32917137a76af620_JaffaCakes118.apk
Size 5.4MB
Sample240613-fdg27avclb
SHA256 c16de6dd0e8c317960b4d8d9798bf7bc0078e4417ca91c0c0f34ca4b7ccd6697
MD5 a3dc92f199e42cfc32917137a76af620
SHA1 386d188c63fef38589a047d0dfba2637727cd202
SHA512 39f1d0a674af543c44324529661288b7ae8c5cafd9b883f16a7a0fa31dfc652a7c11c092547224f6de90b82d89e07377ab23aac5e1c77503e6b739821a115e5e
SSDEEP 98304:wE7M+YdWFBw6fVmvSnAMltxoP2wDBDqhZi6P1rCHGCHybv:wEg+lI6fQOiewdDeo6P1rCmCe
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.rxwy.xun

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.rxwy.xun/mix.dex	4700	com.rxwy.xun
/data/data/com.rxwy.xun/mix.dex	4700	com.rxwy.xun

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rxwy.xun

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rxwy.xun

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rxwy.xun

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.rxwy.xun

com.rxwy.xun
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4700

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mix.dex

Path /data/data/com.rxwy.xun/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.rxwy.xun/app_bugly/rqd_record.eup
Size 346B
SHA256 9967d5fabbddc5b93fc58e2b98febc5769f3e4218e52ef9979e2369eb43192b3
MD5 6044bb6e517b1ef4a922aefeb23d0d79
SHA1 9e637156f6ec9bca8383ef7df75f348076431d90
SHA512 db6db3c6dc302d679ec499fd66a356a6f0a44ca505ddec5b4b978031813fa3388e47de0580a262d95bb4ee2f6a895474d463c24f2fe6167904c17ffbe12c0b41
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.rxwy.xun/app_bugly/rqd_record.eup
Size 1KB
SHA256 9237a4cfe70bd04cb86472a00b78318750eaf1b5b7c1b778543a9152923e14ad
MD5 e7d51b6a3db3a83bb03d9632f00ae5aa
SHA1 bd76d9e26d6817ddf82fec6524fce2e35150932f
SHA512 f266067a63ec5701935a75b678c0c6fa71c0ec72977356f15a76b7bbddf875548c5d31646f22b8f1388cb5e746521cbf346fd8e26c5baeb847ded09063d68ea2
MD5 SHA1 SHA512

Submit Download

tomb_1718253941361.txt

Path /data/user/0/com.rxwy.xun/app_bugly/tomb_1718253941361.txt
Size 23KB
SHA256 955f005ba0b86c51e959bf5424cd36c2c96089c8f6c078f18f3515e305c3e6c0
MD5 3bc9dc58e98681205aabd002ccab913a
SHA1 181dc1dd82270849e622aeeb2c2f6e58b4cccb3d
SHA512 f7e4fec9c817d76045aa5bdc66985e03d220c2b5dd44012bb8efa2e70d7f02822a628ad992394c91c020f66e8266059711f80a0787b0116b4c76d4e9341f8b38
SSDEEP 384:HCIdKtVulzTVSUX5iCLzSmJEMxyaHEmZTPTTTA:D4VuFJNXsCL+mTxyaHEmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

tomb.zip

Path /data/user/0/com.rxwy.xun/cache/tomb.zip
Size 4KB
SHA256 211516af4c78fde582cd061aa0483f23dbc26c09764c813ca30cfed6956a3e28
MD5 b7d1680602d8f2805a32c0c221e2abc1
SHA1 f637a2811811bcecaac35eb0f188997aafe500df
SHA512 041ca41db5c9efcf221525b5703ae96f43d817bab100794be2841d80fd5066659cca7827e9ee4eddb00ce087d71eb63820797624f31ab6da9f8a63a42155a90a
SSDEEP 96:Ei582yQaRw+9JH23dKQpx/VoJoEboox7tcSZ9nOTvWpMiHEDP7L1zpSMcLfs6fyU:Pl1aRw+99Udhpx/+Jo+oox7tFOziHKPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu
Size 180KB
SHA256 c68a946afa371919e5efca7e8df2a3af7c98dfe634009bf69a75f50e08fff093
MD5 0bd9277620edf31d9bf923040b959928
SHA1 ec794b740a6d8caf8577f6296e9b69131fcdf8f8
SHA512 2af875fb6ada28be55ffcfe63c8be2de1ae8d5530ece2402e075f4f0694d79a8e779ce445c57ec94a9569b0275f7b88ea3c5dae3fb94d10649f279420f66b836
SSDEEP 768:iqfxynFZi9USNsF1Zb2KdoicHclKyqLJ4dBAdNaMrn94nTmcKericsnJjzmIDwLo:ioYkYK7CEiGsq8ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu-journal
Size 12KB
SHA256 936f01874f09634a7cf22c6c915c9de4bb3e019d89175033d44079b16074bbcc
MD5 a85b51d9c23ff2257b72d6266ef5a4f8
SHA1 b9883baa37d2da874db04ed8fafa620e48df97a6
SHA512 106020429074b4bf7c98b27ce162a01679df76f740036fe76371f464db2d9c95c9d21e40f1dbdfeded4e80d89f4638bafe0ef7bfbef933218778d4c73bca19a1
SSDEEP 48:7M0qTZfrQiw6uMg6/YBg72meposSQJVgohL0bP8pKcqYKcqC5KcqCKcFc:7RY4m7g/6cKqKgKQKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu-journal
Size 512B
SHA256 2d247df54858e94c28d6ce89aa2b461509002d77269455cc7deddb4e3138dfb6
MD5 6ef13278c7f675264c81b44deba01591
SHA1 4030c624275b8c9e9dde2bb9b77fe6726b1afbd4
SHA512 7bc326ecd06321926e9d57965f349c8eabe3de855aded14520f13729ca32849d8677d4e4fc22b98f4f13efc0c90c13e4ec31a8f2fa196d2423e658b3f7c7ad89
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu-journal
Size 8KB
SHA256 5eb674a3433133aa5414fe29884931f9bd1ebdc66643a3a6b06c71434d828e82
MD5 ba14d7d254161a8d5f6ccd4fdee041f2
SHA1 14a3f359c5b2de6a0b0287043d32f75cd3c67030
SHA512 50f24d77b2edaed799261db10b9c976a84113a4682ebd7b9a333bea06fcaa0cc4e06f5ffc8d46bd5aae3613280e1ffc70e131d0f08d87360f0254047177db56e
SSDEEP 6:7+/l9xe3n1gUg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKq5:7+tTUqLiuWdYRmBEyPbb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu-journal
Size 8KB
SHA256 16035faec6c837bd2118432f09b115fda488c9c884210fb5c66c4d6cf897d8ed
MD5 5175b3d38754a2179595d7a322d24543
SHA1 88d9fbbeaee646cb0332bb96eb971b2b46e7cec5
SHA512 f504653b91b819ce32b2816dbbccb1c2fbd27c2984e10649cb9004afc9802ece6489ded94a0e174f105a66a7a33aae3e7d193ceed9dd374c3616ce830a1190ca
SSDEEP 6:7+/l98ZGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK7K//Exn:7+tE6qLJdeWRmBEyPb8KXExn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu-journal
Size 8KB
SHA256 b34b903354685f24c8b8470b1f3c87cafe9abe6d75a8e9251b64b9b44e34976c
MD5 8d0efba1043094ff401694953825d49d
SHA1 633b85ed0bbe313891f0b16626c3b5dbf328eb72
SHA512 35b8534f09b0dcf0d6b8a2e0e0373b5ab4d3ffc5df79d6572a54fbd347099a73e0cd46cecbed3bfbf5c87df47b3d83b052b4a43b52ea6fc565ecb1abe083fc97
SSDEEP 24:7+tjxqLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS5:7M9qVZfrQiw6uMg6/YBg72meposS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.rxwy.xun/databases/bugly_db_legu-journal
Size 12KB
SHA256 9b541c7271e1a7ada35ac1968d7e6a3c70f221c1403e525eabd2a5e7c5b7da80
MD5 5a4704074e79cd4f5d0ce32b3023167f
SHA1 ee37f34656a0a121058c32304afbdbda041baa9f
SHA512 d87cad29573dea5e0433aad3eabcd0f0e3af63ded6d533a17540b842e493eae8ce7ea39a4d6b76c6d316b9296554ba3c13eca5ab4670827c7bbf143a9e885433
SSDEEP 24:7+tNyovqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSl:7MNyovqlZfrQiw6uMg6/YBg72meposSl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads