Analysis Overview
score
7/10
SHA256
331cbe6da7b22814686c7ada05610fd037ac81ab6e9327df7b86a69fd8019497
Threat Level: Shows suspicious behavior
The file a48ecc3e114500d1431e46a6ced8bdad_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped Dex/Jar
Queries information about running processes on the device
Queries information about active data network
Queries information about the current Wi-Fi connection
Reads information about phone network operator.
Requests dangerous framework permissions
Registers a broadcast receiver at runtime (usually for listening for system events)
Uses Crypto APIs (Might try to encrypt user data)
MITRE ATT&CK Matrix
N/A
Analysis: static1
Detonation Overview
Reported
2024-06-13 08:08
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE | N/A | N/A |
| Allows an application to record audio. | android.permission.RECORD_AUDIO | N/A | N/A |
| Required to be able to access the camera device. | android.permission.CAMERA | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION | N/A | N/A |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION | N/A | N/A |
| Allows an application to read or write the system settings. | android.permission.WRITE_SETTINGS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 08:08
Reported
2024-06-13 08:12
Platform
android-x86-arm-20240611.1-en
Max time kernel
173s
Max time network
184s
Command Line
com.xgbuy.xg
Signatures
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
| N/A | /data/data/com.xgbuy.xg/.jiagu/tmp.dex | N/A | N/A |
Queries information about running processes on the device
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
| Framework service call | android.app.IActivityManager.getRunningAppProcesses | N/A | N/A |
Queries information about active data network
| Description | Indicator | Process | Target |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
| Framework service call | android.net.IConnectivityManager.getActiveNetworkInfo | N/A | N/A |
Queries information about the current Wi-Fi connection
| Description | Indicator | Process | Target |
| Framework service call | android.net.wifi.IWifiManager.getConnectionInfo | N/A | N/A |
Reads information about phone network operator.
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Processes
com.xgbuy.xg
chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
com.xgbuy.xg:pushcore
cat /sys/class/net/wlan0/address
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | api.exc.mob.com | udp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| US | 1.1.1.1:53 | api.sobot.com | udp |
| CN | 203.107.41.32:443 | api.sobot.com | tcp |
| US | 1.1.1.1:53 | log.reyun.com | udp |
| CN | 54.223.95.86:80 | log.reyun.com | tcp |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.187.206:443 | android.apis.google.com | tcp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| US | 1.1.1.1:53 | update.sdk.jiguang.cn | udp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| US | 1.1.1.1:53 | api.share.mob.com | udp |
| US | 1.1.1.1:53 | s.jpush.cn | udp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| CN | 180.188.25.42:80 | api.share.mob.com | tcp |
| CN | 123.60.31.166:19000 | s.jpush.cn | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| US | 1.1.1.1:53 | sis.jpush.io | udp |
| CN | 120.46.84.108:19000 | sis.jpush.io | udp |
| US | 1.1.1.1:53 | api.exc.mob.com | udp |
| CN | 180.188.25.46:80 | api.exc.mob.com | tcp |
| US | 1.1.1.1:53 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 113.31.17.108:19000 | udp | |
| US | 1.1.1.1:53 | tcp | |
| US | 1.1.1.1:53 | im64.jpush.cn | udp |
| CN | 1.94.2.18:7003 | im64.jpush.cn | tcp |
| US | 1.1.1.1:53 | 139.9.135.156 | udp |
| US | 1.1.1.1:53 | 139.9.138.15 | udp |
| US | 1.1.1.1:53 | 119.3.188.193 | udp |
| CN | 1.94.2.18:7000 | im64.jpush.cn | tcp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 1.94.2.18:7002 | im64.jpush.cn | tcp |
| CN | 113.31.17.106:7000 | tcp | |
| CN | 123.60.31.166:19000 | easytomessage.com | udp |
| CN | 120.46.84.108:19000 | easytomessage.com | udp |
| US | 1.1.1.1:53 | easytomessage.com | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 113.31.17.108:19000 | udp | |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| US | 1.1.1.1:53 | _im64._tcp.jpush.cn | tcp |
| CN | 1.94.2.18:7000 | im64.jpush.cn | tcp |
| CN | 1.94.2.18:7002 | im64.jpush.cn | tcp |
| CN | 1.94.2.18:7003 | im64.jpush.cn | tcp |
| CN | 113.31.17.106:7000 | tcp | |
| CN | 123.60.31.166:19000 | easytomessage.com | udp |
| CN | 120.46.84.108:19000 | easytomessage.com | udp |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 113.31.17.108:19000 | udp | |
| US | 1.1.1.1:53 | tcp | |
| CN | 1.94.2.18:7003 | im64.jpush.cn | tcp |
| CN | 1.94.2.18:7000 | im64.jpush.cn | tcp |
| CN | 1.94.2.18:7002 | im64.jpush.cn | tcp |
| CN | 113.31.17.106:7000 | tcp | |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| US | 1.1.1.1:53 | s.jpush.cn | udp |
| CN | 1.92.70.140:19000 | s.jpush.cn | udp |
| CN | 120.46.84.108:19000 | s.jpush.cn | udp |
| CN | 123.60.89.60:19000 | easytomessage.com | udp |
| CN | 113.31.17.108:19000 | udp | |
| US | 1.1.1.1:53 | m.data.mob.com | udp |
| CN | 180.188.25.47:80 | m.data.mob.com | tcp |
| US | 1.1.1.1:53 | _im64._tcp.jpush.cn | tcp |
| CN | 1.94.2.18:7000 | im64.jpush.cn | tcp |
| CN | 1.94.2.18:7002 | im64.jpush.cn | tcp |
Files
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so
| MD5 | 8f55d5deb281d8aa1a0b9f72f7185e58 |
| SHA1 | 5ce262af6a74a11931bf4b1e92a59b9acab27f37 |
| SHA256 | b57aa883bd4a8241fe2ebbeec0988614da1ad453f5784f3439335a6f800c7944 |
| SHA512 | 4d74f007dc4a19ac3a8ae3434f06d2509397301c0a9b0288475280801c8907ce48248459436416fb14fc5a3a6ce790d680b6b9c95d35afc49c2f0639199b56f6 |
/data/data/com.xgbuy.xg/.jiagu/classes.dex
| MD5 | 7a721ae9582f8c3dd4d25e2f850bb3f1 |
| SHA1 | 603b497c3a6810192ffeb78ae9f8134bc5686702 |
| SHA256 | 5333d3967ddd5ac789b4544ffcd80d2661202c01c04f01d9319813cfb0ceee50 |
| SHA512 | 1c2d397e59956c96d41478473447d9f846c8eb6ef2a585322f98adc6cc4f3273605fc5728f608e8140bbe19c4c3f83201c09c51e85c90f7f6ac428f7f76d6ff6 |
/data/data/com.xgbuy.xg/.jiagu/classes.dex
| MD5 | 8294f2f81db54ee61aacbd082fd565ce |
| SHA1 | 0c726749fb05c8f687bb5274e097e0d33f4e3394 |
| SHA256 | f7e28f4705fcca718a9d973763928039e8f7df1bac4088d8b08cf356d366c115 |
| SHA512 | d3c45de73a5b8ce733dc29f1c390b7a14678079d67e94f4915b25f65bf538b206df3ccf5cfacbe4d0e011aa06a6dc0159fad407ca16af87b2bace230c54c754e |
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex
| MD5 | 5321485d5bc4b58bced4df4646e66c6f |
| SHA1 | aed5f5694b4d1bddbebd77bff43e5c75f8b4f555 |
| SHA256 | 44276d7e3c28fe84fe0de44f11124016846d0620be4be1ca82ebf835c6cce139 |
| SHA512 | 29f57b81af94feca855d8af4191714e053de9f0f974246b32cf4856c88596fed0f7a31f47eb0fd2d48dd35f0f0f65eb6b9e596d2029f791346d923853469b2c7 |
/data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex
| MD5 | c89a7bb0027122b831fcc546fe65183d |
| SHA1 | 7b0e11c1141539623648a051b6de07f3152045c9 |
| SHA256 | f6672688f527dc0e45ddfb3137055fe21029ac3124c50686c95913f8daf58f54 |
| SHA512 | 1cf1bec0ab53d44c177f51e081caff59bd1a9e1fb4e020295a6d5d6a5c76e222b9ffaebf707be70ef328aa1d0ddc2e3ef87eb52ae68e88eb94f40116c3757166 |
/data/data/com.xgbuy.xg/.jiagu/tmp.dex
| MD5 | f1771b68f5f9b168b79ff59ae2daabe4 |
| SHA1 | 0df6a835559f5c99670214a12700e7d8c28e5a42 |
| SHA256 | 9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939 |
| SHA512 | dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d |
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri
| MD5 | bf64435267f283664866d9487e150967 |
| SHA1 | 9d3dacc98a4f96a52dcc2629d410f712767cd9c1 |
| SHA256 | 56a696e4aa76b2c6cd10416b579eabf36416f2fb00571b45312cbd2099e4e465 |
| SHA512 | b32a26b38646cdb1b881376906f09ef7e26a6c0036322c968d311a6d348dd976d381fe6c8309826adcdfbfdf385809d17347fef342e38217e3b180dbfb915e3f |
/data/data/com.xgbuy.xg/files/.jiagu.lock
| MD5 | e19bfab1acb409b8ef16fc4fc936d8af |
| SHA1 | 6a7910e1039a3dfd775eb42d373efbf4b0f6973c |
| SHA256 | 8981476255ef57722c858cc67f44c141b3283b84e1e4f07913caeaed9f8aac5e |
| SHA512 | e35567fbccb6c38b19dd2c6c2792bca86e48864966c521ebfbf9e11376627d02aaa7196901a9501d4b3345369426aeef28001d2927e2af7daa6bfefdf077e2d5 |
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di
| MD5 | 8c9c7683ff7a9a15423704ea2c4c8994 |
| SHA1 | d135d33a85e8bc81ea02ad4df6d782dcf74184d0 |
| SHA256 | eb7778665aa6ee408bfd143389e2232b8e453c314dbdad097960ca9bcbdf9f45 |
| SHA512 | 953e2a3a5d7aaa27256ca4fec68289edf5c42ae248b84e810dfd16cc2b3deffd7c4fb38c6eec46d8e8683da80b57f2dd65ba5c3f8874550b61ab70d0d3a7ca20 |
/storage/emulated/0/360/.iddata
| MD5 | b0f92190d0288550093ff4222e616ef4 |
| SHA1 | 135695d21898345cd27a2be5212e46a019492a37 |
| SHA256 | 49b24a748aa4dcf023a6ff9ad3a31349437094efafe7f8cc6b16f8041523f774 |
| SHA512 | 7cf5a8e2047b11ab94fc88f77034ae605fd7bfde2b592f3a24425d5687d0493e00be854f28d72f0ef0d993e0f0fbe16fc4bd3354ed76be9fb01f1af27c1e2933 |
/storage/emulated/0/360/.deviceId
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/storage/emulated/0/Mob/comm/.di
| MD5 | acc2a2f5cb76c41d2e97e0d409b53bdd |
| SHA1 | ed06f22ff10e0912f50d53bc775ed2ae70f85d5a |
| SHA256 | 12ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448 |
| SHA512 | faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419 |
/storage/emulated/0/Mob/comm/.di
| MD5 | 70a42cba408700f9a6c01c7941a8829e |
| SHA1 | eab01cc2c0671538795fb0b1146017dc099d0984 |
| SHA256 | 499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f |
| SHA512 | 8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c |
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal
| MD5 | 844d1a28997ac1c37e361b6147735363 |
| SHA1 | d76e501f6ace3b762d057d33cf2a4fd842d9702d |
| SHA256 | 34acc94b9bb22868ef9ae8d5287f5c29bf2239d5b18f72327c6a07ba39141980 |
| SHA512 | a152ae2bd5496642ba071d9e049c4d956938bf1ddde6abbd9bdbc5a30bd8158a4e8b39b9d7bbe0f40b0ff736a8f9ecd48e496c8cca4e8746822ec7261cb026ce |
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-wal
| MD5 | 8ca7c0bf108f1cb7ac9d4ba70f17c646 |
| SHA1 | 482be9402aba494ec98b7ab9655686b5c1787479 |
| SHA256 | 32f570564741f2311507f7cf3fe6211669da115960aacf30d97815c1f50a8e6c |
| SHA512 | ec7a57e509cda83da6000e4b370a01188766b80d80d282f5c99618d98340dd66a19a553ba84e520b7c06f8b1abd3ff598bd4f71aa5211e39c4402ef17f0cc19f |
/data/data/com.xgbuy.xg/files/Mob/share_sdk_1
| MD5 | 8e24e79baab91c4d0604eaa9006a0cb3 |
| SHA1 | e427afc94a4b957a7096f73e395a10ea404c076b |
| SHA256 | 65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d |
| SHA512 | 45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae |
/data/data/com.xgbuy.xg/files/Mob/mob_commons_1
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 08:08
Reported
2024-06-13 08:12
Platform
android-x64-20240611.1-en
Max time kernel
6s
Max time network
131s
Command Line
com.xgbuy.xg
Signatures
N/A
Processes
com.xgbuy.xg
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 172.217.16.232:443 | ssl.google-analytics.com | tcp |
| GB | 172.217.169.10:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.212.238:443 | android.apis.google.com | tcp |
| GB | 172.217.169.78:443 | tcp | |
| GB | 142.250.179.226:443 | tcp | |
| GB | 142.250.187.196:443 | tcp | |
| GB | 142.250.187.196:443 | tcp | |
| GB | 172.217.169.10:443 | tcp | |
| GB | 172.217.169.14:443 | tcp |
Files
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so
| MD5 | 8f55d5deb281d8aa1a0b9f72f7185e58 |
| SHA1 | 5ce262af6a74a11931bf4b1e92a59b9acab27f37 |
| SHA256 | b57aa883bd4a8241fe2ebbeec0988614da1ad453f5784f3439335a6f800c7944 |
| SHA512 | 4d74f007dc4a19ac3a8ae3434f06d2509397301c0a9b0288475280801c8907ce48248459436416fb14fc5a3a6ce790d680b6b9c95d35afc49c2f0639199b56f6 |
/data/data/com.xgbuy.xg/.jiagu/classes.dex
| MD5 | 7a721ae9582f8c3dd4d25e2f850bb3f1 |
| SHA1 | 603b497c3a6810192ffeb78ae9f8134bc5686702 |
| SHA256 | 5333d3967ddd5ac789b4544ffcd80d2661202c01c04f01d9319813cfb0ceee50 |
| SHA512 | 1c2d397e59956c96d41478473447d9f846c8eb6ef2a585322f98adc6cc4f3273605fc5728f608e8140bbe19c4c3f83201c09c51e85c90f7f6ac428f7f76d6ff6 |