Analysis

  • max time kernel
    174s
  • max time network
    182s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    18-06-2024 11:00

General

  • Target

    bb94141d0a56275a3a18611f7b1ca3f0_JaffaCakes118.apk

  • Size

    16.7MB

  • MD5

    bb94141d0a56275a3a18611f7b1ca3f0

  • SHA1

    8e4908f2351e3b0768be5ed46a76c0a54f1f4104

  • SHA256

    ad713c45a10941f5ac45f3d7468ed13a126053b286b33fa9767367699ff23a30

  • SHA512

    2fed03bd9c364a48848f4a872e9f4fbcb3577b244c91ae6e4dfab9eae9d448a4eb8285da2c7b03fe09b1ad4da5bdae7cb69c0a517c61f817f993ac9556d51c79

  • SSDEEP

    393216:RjIxaDCZEBoLxkNPmvcWo4Foyu2tlcBku1awFgfvi:RMxaDqCP6cWoyDul6S

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 11 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.xgbuy.xg
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    PID:4323
    • chmod 755 /data/data/com.xgbuy.xg/.jiagu/libjiagu.so
      2⤵
        PID:4348
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xgbuy.xg/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.xgbuy.xg/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4375
      • cat /sys/class/net/wlan0/address
        2⤵
          PID:4444
        • ls /sys/class/thermal
          2⤵
            PID:4506
        • com.xgbuy.xg:pushcore
          1⤵
          • Loads dropped Dex/Jar
          • Queries information about running processes on the device
          • Queries information about active data network
          • Registers a broadcast receiver at runtime (usually for listening for system events)
          • Uses Crypto APIs (Might try to encrypt user data)
          PID:4421

        Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.xgbuy.xg/.jiagu/classes.dex

          Filesize

          8.1MB

          MD5

          7a721ae9582f8c3dd4d25e2f850bb3f1

          SHA1

          603b497c3a6810192ffeb78ae9f8134bc5686702

          SHA256

          5333d3967ddd5ac789b4544ffcd80d2661202c01c04f01d9319813cfb0ceee50

          SHA512

          1c2d397e59956c96d41478473447d9f846c8eb6ef2a585322f98adc6cc4f3273605fc5728f608e8140bbe19c4c3f83201c09c51e85c90f7f6ac428f7f76d6ff6

        • /data/data/com.xgbuy.xg/.jiagu/classes.dex

          Filesize

          6.5MB

          MD5

          8294f2f81db54ee61aacbd082fd565ce

          SHA1

          0c726749fb05c8f687bb5274e097e0d33f4e3394

          SHA256

          f7e28f4705fcca718a9d973763928039e8f7df1bac4088d8b08cf356d366c115

          SHA512

          d3c45de73a5b8ce733dc29f1c390b7a14678079d67e94f4915b25f65bf538b206df3ccf5cfacbe4d0e011aa06a6dc0159fad407ca16af87b2bace230c54c754e

        • /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes2.dex

          Filesize

          6.6MB

          MD5

          5321485d5bc4b58bced4df4646e66c6f

          SHA1

          aed5f5694b4d1bddbebd77bff43e5c75f8b4f555

          SHA256

          44276d7e3c28fe84fe0de44f11124016846d0620be4be1ca82ebf835c6cce139

          SHA512

          29f57b81af94feca855d8af4191714e053de9f0f974246b32cf4856c88596fed0f7a31f47eb0fd2d48dd35f0f0f65eb6b9e596d2029f791346d923853469b2c7

        • /data/data/com.xgbuy.xg/.jiagu/classes.dex!classes3.dex

          Filesize

          1.9MB

          MD5

          c89a7bb0027122b831fcc546fe65183d

          SHA1

          7b0e11c1141539623648a051b6de07f3152045c9

          SHA256

          f6672688f527dc0e45ddfb3137055fe21029ac3124c50686c95913f8daf58f54

          SHA512

          1cf1bec0ab53d44c177f51e081caff59bd1a9e1fb4e020295a6d5d6a5c76e222b9ffaebf707be70ef328aa1d0ddc2e3ef87eb52ae68e88eb94f40116c3757166

        • /data/data/com.xgbuy.xg/.jiagu/libjiagu.so

          Filesize

          446KB

          MD5

          8f55d5deb281d8aa1a0b9f72f7185e58

          SHA1

          5ce262af6a74a11931bf4b1e92a59b9acab27f37

          SHA256

          b57aa883bd4a8241fe2ebbeec0988614da1ad453f5784f3439335a6f800c7944

          SHA512

          4d74f007dc4a19ac3a8ae3434f06d2509397301c0a9b0288475280801c8907ce48248459436416fb14fc5a3a6ce790d680b6b9c95d35afc49c2f0639199b56f6

        • /data/data/com.xgbuy.xg/.jiagu/tmp.dex

          Filesize

          284B

          MD5

          f1771b68f5f9b168b79ff59ae2daabe4

          SHA1

          0df6a835559f5c99670214a12700e7d8c28e5a42

          SHA256

          9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

          SHA512

          dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

        • /data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-shm

          Filesize

          32KB

          MD5

          bb7df04e1b0a2570657527a7e108ae23

          SHA1

          5188431849b4613152fd7bdba6a3ff0a4fd6424b

          SHA256

          c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

          SHA512

          768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

        • /data/data/com.xgbuy.xg/databases/xinggou-journal

          Filesize

          512B

          MD5

          056219a98b312041971cf9452ffa2087

          SHA1

          9101f71cf8e6b7dc44a069b0cc377700284fd464

          SHA256

          48872b616f65e83b1d5f1dfaaf11fb25003276ed132ba087b05152a8e36be6d0

          SHA512

          381355aa7d69c027504f2f1ba405a64da2de3e208d1bcec2d61f2869aeb17a9ad8537172de0f85fc723babfeeeba9e893ea77f0f308ba3f99315c2f7bc2ebaec

        • /data/data/com.xgbuy.xg/databases/xinggou-wal

          Filesize

          64KB

          MD5

          413c23145deaa4cbb1bfb9fc2899fb86

          SHA1

          6a60fb872e7f766de449960217269c5758691c23

          SHA256

          693f40dd99fe1135ea51d5b2709bc5ff679e712f3d532234f3ef96061846d21d

          SHA512

          eb7adb89fee4870fd5a90dbe5231d07dcdc2e6a73a8aa25ca73863ac9ba7d16229e698e6dede3237fe29c22f215c8365b6abdce8174f2cdaf1101c106659b8e3

        • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ac

          Filesize

          32B

          MD5

          1264f30db5bc978090c891fc9ba97820

          SHA1

          22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc

          SHA256

          6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c

          SHA512

          f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488

        • /data/data/com.xgbuy.xg/files/.jglogs/.jg.di

          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

        • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ic

          Filesize

          32B

          MD5

          9afbf0dc0b4a4fd0a874cfec2c55461a

          SHA1

          a42766499eef11be1120ff87588b7f715c1b2a7f

          SHA256

          75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37

          SHA512

          863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d

        • /data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

          Filesize

          314B

          MD5

          bad0bd1a47e89c40fda86a751c155da9

          SHA1

          2c3846b238e13355266581b4ede08dce07e7fbbc

          SHA256

          1d75db740861e5279a2f52cdef41f676151d63c547140c24c358a0daf730ed74

          SHA512

          f75752caa143516f7a116e84844f9e9d857e98a8b70bd8ec0e95ddfa464d4b7f2007ffe4c445eb52797bf661d54b6595b82fd05dade18b259d79ad2ed3c6e627

        • /data/data/com.xgbuy.xg/files/.jiagu.lock

          Filesize

          27B

          MD5

          00161c126de433fda9a31a0f587f36c5

          SHA1

          76e3e2d008ddcea107b84023150b1966699572e5

          SHA256

          3d1d130e50fbc28aa01bc8b63ddd3bedcc8a3d9d59fb2482df72f33dea7e82bd

          SHA512

          fc9eba9d541f3258b940a7fbd946e06317256738472dcedd8a4cdf4f2addf6052d667fdd85b04186233668c9e4a2238634a5d7487abf67dc67e96406973d7000

        • /data/data/com.xgbuy.xg/files/Mob/mob_commons_1

          Filesize

          2B

          MD5

          99914b932bd37a50b983c5e7c90ae93b

          SHA1

          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

          SHA256

          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

          SHA512

          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

        • /data/data/com.xgbuy.xg/files/Mob/share_sdk_1

          Filesize

          23B

          MD5

          8e24e79baab91c4d0604eaa9006a0cb3

          SHA1

          e427afc94a4b957a7096f73e395a10ea404c076b

          SHA256

          65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

          SHA512

          45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

        • /data/data/com.xgbuy.xg/files/sobot_chat_log/sobot_chat_20240618_log.txt

          Filesize

          201B

          MD5

          d5c6ffae56e2a049e4ec2d85394d8435

          SHA1

          0ddede99f97b39a66b31a9ecde366faeeda892e4

          SHA256

          15e30d231f19fb7b5178196fb1a159ed02f750fd2fd422294c55c410c05edfac

          SHA512

          a3712b88bd3c045f970d3e59bbe08df1fd09978e83394c755111d8f00b7ea192f22a6d9043415539f87fd8f0843d2f540a64c351884a8629d872e93ccdecf6ce

        • /storage/emulated/0/360/.deviceId

          Filesize

          112KB

          MD5

          aec0ebfa904a51996644781a781ebe91

          SHA1

          6a9e624363ac932a5914082e3613d5262d5a33ef

          SHA256

          33ef13223e41e3e5680b5f4fb8e2447a40dfd10f60716152de01123536c72222

          SHA512

          c747497c50683f88b6f215884451a026aacc66ff1c70a5fed90f2d2d725958f4ca1dc2f1d1a0160161ace90f773c3baca2361264a615a30dd14b7638d392e92b

        • /storage/emulated/0/360/.iddata

          Filesize

          512B

          MD5

          a28be37d818fc0e42acf6fa2abfdccaf

          SHA1

          7288b53842d42c16ee68ebf12abbbb8a0f7b34a7

          SHA256

          a64113f175a8ffaf5d37d78a9a11d20eb3cc2d87aa7f664703fd27754482cc60

          SHA512

          9f6b0ac23538d70267855d6c31b00cb80893842559263a34ed65bbae674e233e523eac74e562a6bcbdc2603deafdc0bdee455082d5d6afa3fcc444b8d7225393

        • /storage/emulated/0/Mob/.slw

          Filesize

          66B

          MD5

          19402718bfb1c685a726b4e1d846ad98

          SHA1

          02a7e30044a67085f2f1da24e16e4ecfede65b72

          SHA256

          079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0

          SHA512

          25254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b

        • /storage/emulated/0/Mob/comm/.di

          Filesize

          57B

          MD5

          acc2a2f5cb76c41d2e97e0d409b53bdd

          SHA1

          ed06f22ff10e0912f50d53bc775ed2ae70f85d5a

          SHA256

          12ee2ab25175281fd1efab755eb5a5b442e91d263646c52118e6b1e97856f448

          SHA512

          faed72411dfb1546a82a302b6aadf921bf66a09aa4641a6d1d523e5b58c063d5210089ca2d7dec8aadbe1efec4748a8abb36ab9fe1ab18539a92b76730b85419

        • /storage/emulated/0/Mob/comm/.di

          Filesize

          57B

          MD5

          70a42cba408700f9a6c01c7941a8829e

          SHA1

          eab01cc2c0671538795fb0b1146017dc099d0984

          SHA256

          499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

          SHA512

          8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

        • /storage/emulated/0/data/.push_deviceid

          Filesize

          32B

          MD5

          57f6e34b22b0652da441ca322ef78c9d

          SHA1

          13f2820abd4c5960864b8acdc2b8f4d1415325ca

          SHA256

          bdd8e831fc21c9638adb5a39a898fdc95524128600e7bbf52a558ec7436b4c08

          SHA512

          7c9e539f8b6b029e3fff8569033d29d1f8c011ef6cc94291a475c95548f6a7b28248d52adb2b369ae2b723841ea8f51e88140419f4f31cd596a0bc6eb9de127b