37138a9806c7c011ab603ddd57d39802edebdbb8498bca4ac5654cec66a53ce3

Analysis

max time kernel
9s
max time network
135s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
11-07-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39db98bf76d30804474bb1091c783595_JaffaCakes118.apk
Size

19.2MB
MD5

39db98bf76d30804474bb1091c783595
SHA1

b2918b0b725c917c08f1785e880b09b6693916be
SHA256

37138a9806c7c011ab603ddd57d39802edebdbb8498bca4ac5654cec66a53ce3
SHA512

f70d62fad3c052f868436eb67c48f82cdfadc137cc4ba2e2ebf203bb34b88e40bf7722a39010f6c0c139e6c3d1b3ce1aaf71588ae7d19b20f1da9d95fcf4cc99
SSDEEP

393216:ojjQ9Zy1joIBB1uHRiNkr8scj+r2tF9Ymud3j7gfPdgZ7iiTrx55:ojjQW1oQ2PY9F96TcGZeiT1/

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xgbuy.xg/[email protected]	4961	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex	4961	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex	4961	com.xgbuy.xg

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg

com.xgbuy.xg
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4961

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xgbuy.xg/.jiagu/classes.dex

Filesize
8.2MB

MD5
2f7c2a545fabc42357818c4d35052eb0

SHA1
de52edb45f76a000f2be429ef0e7daf7245c35a8

SHA256
7dcc68dd4f94a23b6beffb924eca54ea4a9093534b34fb377d6b9ab5fbeffe78

SHA512
40b6cbbcbfe0771469f025a1a798c4bff6dbbf55426220486ecbe7654506d7a240aba9b4d76db29e54bc468e44b996bb324091315cf7b1702bc0fc0573879f34

Download Submit
/data/data/com.xgbuy.xg/.jiagu/libjiagu.so

Filesize
455KB

MD5
e5a53000766ebc433b27d6a66ec4f555

SHA1
2c8f53f1c03aec2005bcad67d731f07261dabde0

SHA256
78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

SHA512
370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ac

Filesize
32B

MD5
1264f30db5bc978090c891fc9ba97820

SHA1
22a1664ca5bac8af36bdaf8e4098c02c7fc9c1fc

SHA256
6383110e70c2cf20a67539bbf759d99229ac2dcd214cae6a3c5de840497bab2c

SHA512
f3ec53223344ea4763479b39ae62a3dde4b83e0db05d4707c9e2c914725943063706c6c53e6fc043ee13640ac98242775c901b84ec76eb3edf11615bd0084488

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
c43a9d1ec64fe0873de66523aedbe881

SHA1
a35d9aa6daeeb4d12c9659f56326139a8b2dd51e

SHA256
6f8bcbe0416ef14f8515015b709dfe85e86e9e6d83db65205d92f683f0b72510

SHA512
5611a6720e323a264d4884de224f9654947a5ec9dea4cdd155d76d2182b938d2f065658b14299cfc36954c6e44eded7b764b91a3f5336a05557879b2fe4f6764

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ic

Filesize
32B

MD5
9afbf0dc0b4a4fd0a874cfec2c55461a

SHA1
a42766499eef11be1120ff87588b7f715c1b2a7f

SHA256
75c6a927b6cffe50b1a48e8aff766f5d543dec5aec8010b835ab4c4d8dd3da37

SHA512
863cdc25dd26bc2db5a80480a5d5bd16965ce02afc94f732f31c24bdcd3daaae24d41504f0eefead9a8ecc402aa2e798ce100e8a225b13b38b05aa433456185d

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

Filesize
314B

MD5
195e0559f6df8ac9b4e43ffbf2d2a1b8

SHA1
b0c3f315f55850c616b4196a1cff5012cccb0588

SHA256
e11c9ef5cb0a74a39bbdc627c1017c65b13a7b365adaa3e6026e3ba8797609da

SHA512
b043f62b63d1619db7d5388bffec2a48c7c8526d6dd3f59e95af2f9d1d7344ff7655082720d5bf4c8294bde1c84e7d30e2472e7248a6b7667b93629769ac0fe8

Download Submit
/data/data/com.xgbuy.xg/files/.jiagu.lock

Filesize
27B

MD5
4082ab111e849ecc70887779c257eb99

SHA1
feccbce0c904a0749a93e0d20eca8c26ca9eaf40

SHA256
7d7607c2b8b6be5ae814597ebac46fa441d87ac1f19098e60f69175d57d33aa8

SHA512
7e3605c4d4b785aa8ae728a8c8c61dc498063ceaa12f869c05c6c7301e36cb55faad68e30627abe7b6584b02ceacc60e51e4b09944907768f55e0d9bfb29149f

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]

Filesize
6.5MB

MD5
3607e9bc414a499b1da47aeee45672f2

SHA1
04b39c1fad9bd8b87eb58520ef98c649b4864a26

SHA256
80b924b9cb646f78b355227c8c265a0e694c3b1b2b17bce5c992fc8399e475fa

SHA512
0b3733811437cc28a57930c5cf57aa692e8e18e55c1dd3ba534de00cc374b3d1618a40dd0bea185d369816e96c67fe5d6ba981a51142f5f436997f0bcd574771

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex

Filesize
6.5MB

MD5
2edb8333947a3cbbf4f2ad35404817fb

SHA1
22ae5219b5a313b13dc9d65590507fa01cb63b77

SHA256
c9f2509cab8c706548fa84a52ec17f7477666cc5d216e2751023c13c783658a8

SHA512
f90cb78128e059c587698697d88a20a101d08965c05b845382316dde2015a9674b975d68fea7f4a457cfb333c741248e2d84a39f4ce6db60f5497eb431f86026

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex

Filesize
2.4MB

MD5
26cfde3ec0e689982b8c2c01e0313830

SHA1
e79bfad35416572ed90b33106b0e4353f609d742

SHA256
450570e28912a1267aca4a1f0c7f28571da0a6c83cb711bf6c35f6a8b228b4b4

SHA512
431268d92e22fb0a819384434ac2bcf1a59d18cd3300e13524baaa517641ed6cb2eb0d8a8747b75d2aceb73fa9b026005fe6cff339a47c8a119329f198f7972e

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
4c4c5285293d5141f582aefa4e038669

SHA1
e01852a72e5a8e6f7d63a21426b515118196047b

SHA256
36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

SHA512
097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

Download Submit
/storage/emulated/0/360/.iddata

Filesize
32B

MD5
0e9aa0994028134f27f6d26a98790761

SHA1
f49a16e9391d78375ae6545ce7a6b77bd31b0274

SHA256
8c522e5ae2697c53083faabdd6392691a9f1d9db7d42b45d1fd365aac7e81b65

SHA512
4e1554eb568fd4ced5325b3596688419e069f26c0a0c9d2b56c7769d466ad102a4411b49571844967952bb7d7a7c99f99571c37a01d2bc1da94d0f45995b2199

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads