Analysis
-
max time kernel
174s -
max time network
182s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
18-06-2024 11:00
Static task
static1
Behavioral task
behavioral1
Sample
bb94141d0a56275a3a18611f7b1ca3f0_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
General
-
Target
bb94141d0a56275a3a18611f7b1ca3f0_JaffaCakes118.apk
-
Size
16.7MB
-
MD5
bb94141d0a56275a3a18611f7b1ca3f0
-
SHA1
8e4908f2351e3b0768be5ed46a76c0a54f1f4104
-
SHA256
ad713c45a10941f5ac45f3d7468ed13a126053b286b33fa9767367699ff23a30
-
SHA512
2fed03bd9c364a48848f4a872e9f4fbcb3577b244c91ae6e4dfab9eae9d448a4eb8285da2c7b03fe09b1ad4da5bdae7cb69c0a517c61f817f993ac9556d51c79
-
SSDEEP
393216:RjIxaDCZEBoLxkNPmvcWo4Foyu2tlcBku1awFgfvi:RMxaDqCP6cWoyDul6S
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.xgbuy.xg -
Loads dropped Dex/Jar 1 TTPs 11 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.xgbuy.xg/.jiagu/classes.dex 4323 com.xgbuy.xg /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex 4323 com.xgbuy.xg /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex 4323 com.xgbuy.xg /data/data/com.xgbuy.xg/.jiagu/tmp.dex 4323 com.xgbuy.xg /data/data/com.xgbuy.xg/.jiagu/tmp.dex 4323 com.xgbuy.xg /data/data/com.xgbuy.xg/.jiagu/tmp.dex 4375 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.xgbuy.xg/.jiagu/classes.dex 4421 com.xgbuy.xg:pushcore /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex 4421 com.xgbuy.xg:pushcore /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex 4421 com.xgbuy.xg:pushcore /data/data/com.xgbuy.xg/.jiagu/tmp.dex 4421 com.xgbuy.xg:pushcore /data/data/com.xgbuy.xg/.jiagu/tmp.dex 4421 com.xgbuy.xg:pushcore -
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.xgbuy.xg:pushcore Framework service call android.app.IActivityManager.getRunningAppProcesses com.xgbuy.xg -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.xgbuy.xg -
Queries information about active data network 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xgbuy.xg Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.xgbuy.xg:pushcore -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.xgbuy.xg -
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.xgbuy.xg -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.xgbuy.xg Framework service call android.app.IActivityManager.registerReceiver com.xgbuy.xg:pushcore -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.xgbuy.xg Framework API call javax.crypto.Cipher.doFinal com.xgbuy.xg:pushcore -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.xgbuy.xg
Processes
-
com.xgbuy.xg1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4323 -
chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so2⤵PID:4348
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4375
-
-
cat /sys/class/net/wlan0/address2⤵PID:4444
-
-
ls /sys/class/thermal2⤵PID:4506
-
-
com.xgbuy.xg:pushcore1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4421
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.1MB
MD57a721ae9582f8c3dd4d25e2f850bb3f1
SHA1603b497c3a6810192ffeb78ae9f8134bc5686702
SHA2565333d3967ddd5ac789b4544ffcd80d2661202c01c04f01d9319813cfb0ceee50
SHA5121c2d397e59956c96d41478473447d9f846c8eb6ef2a585322f98adc6cc4f3273605fc5728f608e8140bbe19c4c3f83201c09c51e85c90f7f6ac428f7f76d6ff6
-
Filesize
6.5MB
MD58294f2f81db54ee61aacbd082fd565ce
SHA10c726749fb05c8f687bb5274e097e0d33f4e3394
SHA256f7e28f4705fcca718a9d973763928039e8f7df1bac4088d8b08cf356d366c115
SHA512d3c45de73a5b8ce733dc29f1c390b7a14678079d67e94f4915b25f65bf538b206df3ccf5cfacbe4d0e011aa06a6dc0159fad407ca16af87b2bace230c54c754e
-
Filesize
6.6MB
MD55321485d5bc4b58bced4df4646e66c6f
SHA1aed5f5694b4d1bddbebd77bff43e5c75f8b4f555
SHA25644276d7e3c28fe84fe0de44f11124016846d0620be4be1ca82ebf835c6cce139
SHA51229f57b81af94feca855d8af4191714e053de9f0f974246b32cf4856c88596fed0f7a31f47eb0fd2d48dd35f0f0f65eb6b9e596d2029f791346d923853469b2c7
-
Filesize
1.9MB
MD5c89a7bb0027122b831fcc546fe65183d
SHA17b0e11c1141539623648a051b6de07f3152045c9
SHA256f6672688f527dc0e45ddfb3137055fe21029ac3124c50686c95913f8daf58f54
SHA5121cf1bec0ab53d44c177f51e081caff59bd1a9e1fb4e020295a6d5d6a5c76e222b9ffaebf707be70ef328aa1d0ddc2e3ef87eb52ae68e88eb94f40116c3757166
-
Filesize
446KB
MD58f55d5deb281d8aa1a0b9f72f7185e58
SHA15ce262af6a74a11931bf4b1e92a59b9acab27f37
SHA256b57aa883bd4a8241fe2ebbeec0988614da1ad453f5784f3439335a6f800c7944
SHA5124d74f007dc4a19ac3a8ae3434f06d2509397301c0a9b0288475280801c8907ce48248459436416fb14fc5a3a6ce790d680b6b9c95d35afc49c2f0639199b56f6
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
512B
MD5056219a98b312041971cf9452ffa2087
SHA19101f71cf8e6b7dc44a069b0cc377700284fd464
SHA25648872b616f65e83b1d5f1dfaaf11fb25003276ed132ba087b05152a8e36be6d0
SHA512381355aa7d69c027504f2f1ba405a64da2de3e208d1bcec2d61f2869aeb17a9ad8537172de0f85fc723babfeeeba9e893ea77f0f308ba3f99315c2f7bc2ebaec
-
Filesize
64KB
MD5413c23145deaa4cbb1bfb9fc2899fb86
SHA16a60fb872e7f766de449960217269c5758691c23
SHA256693f40dd99fe1135ea51d5b2709bc5ff679e712f3d532234f3ef96061846d21d
SHA512eb7adb89fee4870fd5a90dbe5231d07dcdc2e6a73a8aa25ca73863ac9ba7d16229e698e6dede3237fe29c22f215c8365b6abdce8174f2cdaf1101c106659b8e3
-
Filesize
32B
MD51264f30db5bc978090c891fc9ba97820
SHA122a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc
SHA2566383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c
SHA512f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
32B
MD59afbf0dc0b4a4fd0a874cfec2c55461a
SHA1a42766499eef11be1120ff87588b7f715c1b2a7f
SHA25675c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37
SHA512863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d
-
Filesize
314B
MD5bad0bd1a47e89c40fda86a751c155da9
SHA12c3846b238e13355266581b4ede08dce07e7fbbc
SHA2561d75db740861e5279a2f52cdef41f676151d63c547140c24c358a0daf730ed74
SHA512f75752caa143516f7a116e84844f9e9d857e98a8b70bd8ec0e95ddfa464d4b7f2007ffe4c445eb52797bf661d54b6595b82fd05dade18b259d79ad2ed3c6e627
-
Filesize
27B
MD500161c126de433fda9a31a0f587f36c5
SHA176e3e2d008ddcea107b84023150b1966699572e5
SHA2563d1d130e50fbc28aa01bc8b63ddd3bedcc8a3d9d59fb2482df72f33dea7e82bd
SHA512fc9eba9d541f3258b940a7fbd946e06317256738472dcedd8a4cdf4f2addf6052d667fdd85b04186233668c9e4a2238634a5d7487abf67dc67e96406973d7000
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
23B
MD58e24e79baab91c4d0604eaa9006a0cb3
SHA1e427afc94a4b957a7096f73e395a10ea404c076b
SHA25665ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d
SHA51245bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae
-
Filesize
201B
MD5d5c6ffae56e2a049e4ec2d85394d8435
SHA10ddede99f97b39a66b31a9ecde366faeeda892e4
SHA25615e30d231f19fb7b5178196fb1a159ed02f750fd2fd422294c55c410c05edfac
SHA512a3712b88bd3c045f970d3e59bbe08df1fd09978e83394c755111d8f00b7ea192f22a6d9043415539f87fd8f0843d2f540a64c351884a8629d872e93ccdecf6ce
-
Filesize
112KB
MD5aec0ebfa904a51996644781a781ebe91
SHA16a9e624363ac932a5914082e3613d5262d5a33ef
SHA25633ef13223e41e3e5680b5f4fb8e2447a40dfd10f60716152de01123536c72222
SHA512c747497c50683f88b6f215884451a026aacc66ff1c70a5fed90f2d2d725958f4ca1dc2f1d1a0160161ace90f773c3baca2361264a615a30dd14b7638d392e92b
-
Filesize
512B
MD5a28be37d818fc0e42acf6fa2abfdccaf
SHA17288b53842d42c16ee68ebf12abbbb8a0f7b34a7
SHA256a64113f175a8ffaf5d37d78a9a11d20eb3cc2d87aa7f664703fd27754482cc60
SHA5129f6b0ac23538d70267855d6c31b00cb80893842559263a34ed65bbae674e233e523eac74e562a6bcbdc2603deafdc0bdee455082d5d6afa3fcc444b8d7225393
-
Filesize
66B
MD519402718bfb1c685a726b4e1d846ad98
SHA102a7e30044a67085f2f1da24e16e4ecfede65b72
SHA256079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0
SHA51225254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b
-
Filesize
57B
MD5acc2a2f5cb76c41d2e97e0d409b53bdd
SHA1ed06f22ff10e0912f50d53bc775ed2ae70f85d5a
SHA25612ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448
SHA512faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419
-
Filesize
57B
MD570a42cba408700f9a6c01c7941a8829e
SHA1eab01cc2c0671538795fb0b1146017dc099d0984
SHA256499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
SHA5128900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c
-
Filesize
32B
MD557f6e34b22b0652da441ca322ef78c9d
SHA113f2820abd4c5960864b8acdc2b8f4d1415325ca
SHA256bdd8e831fc21c9638adb5a39a898fdc95524128600e7bbf52a558ec7436b4c08
SHA5127c9e539f8b6b029e3fff8569033d29d1f8c011ef6cc94291a475c95548f6a7b28248d52adb2b369ae2b723841ea8f51e88140419f4f31cd596a0bc6eb9de127b