56551e6c7165676ca50e715824ec06a8b6677ca0ae5c5698acc7238e03740c68

Analysis

max time kernel
148s
max time network
154s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
19-09-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabf8e7146360040dbfddd2757b7b7fe_JaffaCakes118.apk
Size

17.9MB
MD5

eabf8e7146360040dbfddd2757b7b7fe
SHA1

250377b7c9d85c8d9878a9acd5c40f2c447e37b5
SHA256

56551e6c7165676ca50e715824ec06a8b6677ca0ae5c5698acc7238e03740c68
SHA512

905f6ac1dac1513a0688d324652315c02b6830da3d2beb533d546b6a3ad1d7ae58b518fd388b09dcb1314fc41c13acccb58c810210eed37e81e93bd864d1c491
SSDEEP

393216:ZONPXBL3FFxnm1ucDS+N6cP+r2tF9Y83E7gf/dgmRYtj6:ZO5xpm1dbNLF9RUc2mWtO

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 5 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.xgbuy.xg
/data/local/su	com.xgbuy.xg
/data/local/bin/su	com.xgbuy.xg
/data/local/xbin/su	com.xgbuy.xg
/sbin/su	com.xgbuy.xg

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xgbuy.xg/[email protected]	4964	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex	4964	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex	4964	com.xgbuy.xg
/data/user/0/com.xgbuy.xg/[email protected]	5074	com.xgbuy.xg:pushcore
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex	5074	com.xgbuy.xg:pushcore
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex	5074	com.xgbuy.xg:pushcore

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xgbuy.xg
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.xgbuy.xg:pushcore

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.xgbuy.xg

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
58	s.appjiagu.com
105	b.appjiagu.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.xgbuy.xg:pushcore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.xgbuy.xg

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.xgbuy.xg

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg
Framework service call	android.app.IActivityManager.registerReceiver	com.xgbuy.xg:pushcore

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg
Framework API call	javax.crypto.Cipher.doFinal	com.xgbuy.xg:pushcore

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xgbuy.xg

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xgbuy.xg

com.xgbuy.xg
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4964

com.xgbuy.xg:pushcore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5074

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xgbuy.xg/.jiagu/libjiagu.so

Filesize
485KB

MD5
015df5724b50b4fbc6dd0caf7ccb817c

SHA1
980780e98c9958aec97ab7a0de8d28a4c5fd9429

SHA256
183990718a96d742bc6f1bb04c313e04db6dc62d445ecb294a7f15babd3281c6

SHA512
fda8f5343cac8102aade5f1aeac7c5b028ea5d8c92e3d12de92e1ffce30bab47a446f215c9cff7dd1e1bb88980ee0d27b5241e856719fcc1f6a5c25e062e9d40

Download Submit
/data/data/com.xgbuy.xg/cache/image_manager_disk_cache/1b980bbc765294097260c5501e33520cf79efb2e8ca5547693e262f223514bf9.0.tmp

Filesize
106KB

MD5
7459aff7652a92bd0f6067f2d6e82f00

SHA1
df17e66aaa9218124c14a31c0b4830f1e3d85bdd

SHA256
57c17ee898ccd959646b900c6d4f21645a96ae816134de1d067ad1c776940935

SHA512
58a15b84a2a49e0bfd07ba29d3c0a4590c67c83867e11664ab53519b54afaf5e95266972ea503b4c480df4971dd138afaeaab9c25f3d4747aeed9f8211bdabae

Download Submit
/data/data/com.xgbuy.xg/cache/image_manager_disk_cache/journal

Filesize
180B

MD5
58e858122926a2ffbf7f8613880a93e1

SHA1
fc663d137bb6542a6bc5eda6bf58bb705d134049

SHA256
16ebc4d11ca39242bbcec662681a2a6e7b3c837c02f6de8c7ada1f94f122d2c3

SHA512
47e20a60ebe479e44c5c13240a248dd295e7927115fa97ab8b511834124b5dc0c959a9ce9610c1da90be139bbfba3b7dea224ce12da334a63c75a56c11041923

Download Submit
/data/data/com.xgbuy.xg/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db

Filesize
20KB

MD5
ca8a06f9e9ad8900bf6d398520fec485

SHA1
844a797e59b4531760d04c7cd9c633a4995ab58c

SHA256
0e0b466c00128c8ee41b965afc6809a0e7d64e613882b4c03f7ae0f00befc9e7

SHA512
fbdaed5452d9657cef7f942d66d0f4b4b9842ae51a8e3cdf0559e8f6fed8163577ab40d0af708cc92fb0b9d92ea2fbde1d50c249885dc15e923859a5680b5e91

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db

Filesize
20KB

MD5
6b91a8bcde56c78c576d5f6ba59be6e5

SHA1
f0f579498d4deeb7b87f38491a6d591d38efea14

SHA256
46c8472b5c577675acf865bf4ac0f3df1aa517bd93fb52d0b54c5eef829f6b68

SHA512
e6b5e03bc681b5d3206196d3c8435512a5c56097823b4991669c3bc6bdc67f3381bdd4af4249d3c9772bcf410e240efb75a0355f61c62613ce66bd08c6c35a8e

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db

Filesize
20KB

MD5
8b70e4b5bc443c20827a3b61e886ab23

SHA1
2deaaa944fb0180f81f8b82e6944b1623d1fa66f

SHA256
aa6139ce57e152162fc6dfad5d7faae51eb3b9310c281c24d5c4c069b8b17d45

SHA512
f8e13f71ffcafca69485a669a9b4d77f492466fb228bcea9bacdd83216ab7e00cf04f49639ee06531041716174d18fbf626a72b0dbaa8de7cdef69f1b6cf7b95

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db

Filesize
20KB

MD5
8f7908c49ac2d969985dc33471a47812

SHA1
79336788f76ed43cfd1ad359e37708f4140df27c

SHA256
ec29fd5823672d926b2e595a54d431477941d1ce55bb0b25c8941883deb114b9

SHA512
40e2ac93f25455dc8875240c22dba81161f81213f0e08619f60bc1fbfdac700218ad8bd356e7952b63025ab8c8f1e3de13a56d91d71be84c31bef29c9ed2bae3

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db

Filesize
20KB

MD5
ede21addc26931efcba8dc552c150c99

SHA1
8af80faf743a86abc6ec5ec4b06ec049a34355b8

SHA256
a29c411ea866735df2952fcbc5222a6a6993482a56f109c3976c216715d8789c

SHA512
f2eefc2b8107bbebd9cabced62a63f80b2777c319622065c74e3410aa28e83c5c80aae30793c3a7d495124f199c904eac2849b85453a2d257d4fc9886fb6c356

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db

Filesize
28KB

MD5
644c41d303840400bffe4ba586cd245a

SHA1
185ef6351ac9111849671dd20de4c8c816fdb429

SHA256
88589a60869a63343a83ccd301515b6ab15d21dd1df7fcac2a4283bc9ed0226b

SHA512
88af37c157af28c9d57356462303a7733c05584badefcbaaac264d399ffb868af17c6df4f5397d7487bbc636060773ef2f8959c0d693508e680bf9d43aabc1b9

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db-journal

Filesize
512B

MD5
08153b3f1249b016327dc87fc59965d5

SHA1
07f753fc87c82ec591ca14b3c17ec155370ad605

SHA256
8cb76c41cbffa4a3f981d184f6c396f9d196eb5d70470ede627eacb522bf36f3

SHA512
db849874393169f6a620718fd70fdb0a87c89808cb6ed19b958881c6c25ab9c069c9eb0fde0ae48fd94c6010acf1eb035640f5e91731746107b7f8d79cad4a07

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db-journal

Filesize
8KB

MD5
bd915d62ef6fc57457844b446d93e8c8

SHA1
569535d1385bc0f6d84d19dd9d2f4812728ed551

SHA256
4bb2f499cf2dc8c61ef534e101893c5b5791066ff19edf9f41e9f3a28bb88f59

SHA512
aa8ccf3c0db79a45936d81d7cd39dc8e4b558f9763abacb8363aca5cf8cdd2525053fb5c8be92cde8d8f83a1a2a7c5a52aae68414135156e6a2949dbceeb94c9

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db-journal

Filesize
4KB

MD5
d5b81163f47328abefb02e4f3c9c2893

SHA1
9344139219511464c758be25becf0730955fcf05

SHA256
5da8e8322cc6d3a4b78b6b1f54a0d2ea0be2fd9a993a8b79092f24cc2dfc5a5f

SHA512
1165bfc27fd363d9d01cae612862930d7930cfd36b39af6799c6db0b69388b91d7afe7f14d227a653d1b4dd1cbc3043a8746d34dde138133066f9977804dcfb7

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db-journal

Filesize
8KB

MD5
9e112a3214cbd34bdf21696a0f49bde6

SHA1
df0f7855d14f35cd53c5ac6deb76aefc9583b761

SHA256
6ec176495d241ad986511f56699041d4e1fcdf347bf5b849b5693e308fd39485

SHA512
a43b878fa8ee1b534f0315bb780ba6f1923e28d5a75be1b7919a1f1f1d5f132f4d95d057daf9b6ee0c913abd144978927290f097157069757d5982f4c6932669

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db-journal

Filesize
12KB

MD5
57a1adfb373e64de08f1eecc8dce305c

SHA1
cce17d1a7c0445a7a1775e118a9cc977307af0a2

SHA256
bb7a5f6cfcc622d8482b9a4e4cd952bb97ce413766120d066dccf8c9b5198288

SHA512
a8a64228c393fa81c9b8cfeff5789d75ef5cdc667c920f5231c5dc1309565d6cd8807ebfcee05e5d79651e0cdd3fd93f9a2ccd34dd82c979d87cd071e938fc8b

Download Submit
/data/data/com.xgbuy.xg/databases/Reyun.db-journal

Filesize
16KB

MD5
58ff793ffeb16a593d6a8407b8b0aefc

SHA1
92ff1db2140b7049edec95eb4b9bb6ec9e24a7de

SHA256
ee97d76cfafb34c9b1e303627772567882fa184ffe72ccf5b02c63963f9814e2

SHA512
0e61a61f66843a9d85f5d5a86357322e744a698543fd2b51571caf98a56f7052a890eeaf371d1e2c6fc033d5452024245b7c31d2c3de49e976f026b41f7ed168

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db

Filesize
28KB

MD5
831cac9d239d82b64ba615bc4d0d3f4f

SHA1
6ae4ff12aa0b8a4c08cb4984b0f9140dce29da6a

SHA256
39e2cbb950790efcf0d56962e1e15741952e136f0afa903f055561cb9e0e59f1

SHA512
e93b82af3f7ec1cd47863926d088d88104e0a410f0e09e80a0306ee32eb1d4a713d18c669e371136914304f9eef392368d996e7e4eaf7faa460c7f30505cc135

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db

Filesize
36KB

MD5
feadcdae879afbaba00592cb1a7c87a9

SHA1
27dbb72adc375596f559fe65b51e1e142bbd99bc

SHA256
f864648f2671cd599e7f225f37ac4873cd173c9c238ce3ed5a606800873f24bb

SHA512
5235bbd8d69fec4ff85032b466f4e2cc7203beecd8dd9970213b589d79f6455e58dfbc0ae0fea4c5be179cdee12ee607b728aaea6316fca35bfdbd21e7307236

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
12KB

MD5
566a962359b53c5cbb25d04fd7c6ad86

SHA1
6bc0ddc5412b3e2c276b54f4900c3eb2463604bf

SHA256
d0f8ac855d0b295c47e7b0d8f28f676113d006ea0191cee86a0a0e661919cfb2

SHA512
d454ddcc5e2310be462a7fc2a6b55cc3f51428b82b9ee24e9435e34b82c618b5f003d71e5544f22f8cbbf197cd6d033eb7711f9deab74c4ce98782722c6b116f

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
12KB

MD5
23e458c1132c85bdd8063e36964ce621

SHA1
f3ceaabd9750b2a89969192dc83caa42257b5711

SHA256
cc58e47aeabd3d1a1ae9cdf4f2ceb5ea52f39e4acffee29518762f5239a805b7

SHA512
7a9d4a884ec532e8c16fae90e98f8093471f7b8157c08d1e94fe34b0b34fb0b98a11ad07ee706d6dccb1d8a30646916ecc2d9d21724432d39cce7d99822dd125

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
285d2e3574a40779e25d96afa2fd979e

SHA1
add5d9cee956bae637ab8415b9e97d3cc07ca4a3

SHA256
73876705ac143d9a433b2be14f244baa2a6a4adcd171aa6810e8db7d61f9183e

SHA512
709477dcd0aa2973c16d767ba16e90caaf7b2ad685da1f99ea3312a94d0298480810e315910cde11fdbd5e80cfa86bdc3294572507cceeea6bc6ec550efb3ba8

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
8KB

MD5
643de18ff11db510f0ec0b56a0925909

SHA1
b68b7432e81470a2cfac16947dfc8e4589d7f401

SHA256
72df5a81d2f89f5507b6c4447f9ba28e8821bf57c29666bc9009d077fd19da6a

SHA512
9e6a9562c86e2baed30184f4866adf7215e35a1c342b14a3386c39b8ecd09948c5008f10f98b8bb0e15468291d03b935c7487b3a55efaa396c90bf4c64f77146

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
8KB

MD5
183dbb9279c1ccb0324bbfe049843a11

SHA1
d76080390a9de48592bf03e09b00341883b4c262

SHA256
8be8b69008f0e88d5cbcc48c27ff36fe4367991eb46d146c99d1b99709764da5

SHA512
97d1bc4837b98c5f5194a697c41340e8e6cb52b34ad0854cebcbdd5ccc63287229d99c964a5cee8498371314371c37d85e4dc76e91d57f92ab89e26d6ec51e28

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
12KB

MD5
aab4cbd4774cc6c0192c45d18403b6c1

SHA1
b4c93ce195b66c8a42c5fb757b966a394749556e

SHA256
eb9c644fd50363fc6f43593652e3a939b9e2a310a99b624299c301f705c6c21a

SHA512
2b862fb3f74a7bde06f1c9aa8981bd9ff026fd56541619721feadefc53c77d219baecc39b25d4ae360f7188423b69695061e803f668f1fba34f6979c5262ba15

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
16KB

MD5
5e64ed1bac2b6a0e5a6d1dd1f63986da

SHA1
30979f27571d547b81b7a68845c8f6849555b46e

SHA256
43286b7aaebbe7b14cc0d795927ce2025f041306f59e581d752bd4c9f3902ea9

SHA512
c657ecc8b5af62751de5423394ecb0c9aee1c4e805276a7bb0b8203b17087e985ff10081b9ac2ea110701e75c96d5f00254c98a082b7c544fedbd379ebfa4b2c

Download Submit
/data/data/com.xgbuy.xg/databases/ThrowalbeLog.db-journal

Filesize
16KB

MD5
abf4d610707d06cc4401cacf109df73b

SHA1
b496982187a4e0cadd059a4f6304920fd0d9050a

SHA256
4e4393421bb11e74fcf05ab226e5045b622cc122853e0d2c2c0cff9e8a177a62

SHA512
1634b5a6c82b5e9b737c6e4e0a42ed59443bed9c414b8f5b438756edc40cc5d1f971a5c5aa2c42bff0b9b4f1aad3b808685f0c17c2bb8d8fe026f5a305149094

Download Submit
/data/data/com.xgbuy.xg/databases/je_1000_ISME9754_guest92463713653294129289491490256803232664

Filesize
28KB

MD5
ef1dfea68b7e0e0d813d5c17a4b8c31d

SHA1
85d0abe96e379089baf1b912e791df64be2e92b3

SHA256
1fb2febba5f324d9efac895145cae3690211d6dd7cb67c47613c8ad5a27d0335

SHA512
4bf24a0afe1d1bcfc9391440a60c16695137260bef526d0eef284377939df8b5876976d1d955c4fa55c565ba7ed107f189014ae4b02d495d191b7d88be26b7a8

Download Submit
/data/data/com.xgbuy.xg/databases/je_1000_ISME9754_guest92463713653294129289491490256803232664-journal

Filesize
512B

MD5
a5c245c531b63eb920bc533fc0bbb395

SHA1
d2159155ea480db7954a6677838942b6add476c2

SHA256
3ec494a02d322de7a20026bc64dd6790d39140bd7ccbdd61240d496f18d9ff29

SHA512
9f060987a83fb0b539f4befb6e1ec0d1a666f6d082916b9f1c633fdf87f1cb16ca75083c6471f8d8f24a96bce43717f9380baf8c00c5723c6dbb606633ac11dc

Download Submit
/data/data/com.xgbuy.xg/databases/je_1000_ISME9754_guest92463713653294129289491490256803232664-journal

Filesize
8KB

MD5
bc05e9a13e4f5814ed8a63b32ae561b4

SHA1
d58771bab3e1d1e9635d0a2758cbaafac9c5c30f

SHA256
074aada25cfe924fa5154343528c5e8709470867d0c0e6ad5f0d724b2201f664

SHA512
087d4067533325d6c70c3c8831892c52786148d148b2b8cd46f1db6a749dcf2f303ee978305dbe7d5e8f9b306405e7e5baa2c457a19c9117e4c662f2780d0ed1

Download Submit
/data/data/com.xgbuy.xg/databases/je_1000_ISME9754_guest92463713653294129289491490256803232664-journal

Filesize
8KB

MD5
3af465370a1066977e9a29d385b067f7

SHA1
78fe4f457efd46331e5b72a9fb5198c5b8b56122

SHA256
6d568f1cbcc194f43a4508d49d29d19c82af439fd8c7b876b95cc026fc7b50a1

SHA512
1ad5fa5647cb12ba71a2a1a06601d2548683401ccb454c6e9f7cc03718f341276a3f435ad24c084ab00260d740ff8f888aeecc6f238fa28a11b407bb6891c766

Download Submit
/data/data/com.xgbuy.xg/databases/je_1000_ISME9754_guest92463713653294129289491490256803232664-journal

Filesize
12KB

MD5
3930f6d27830541959db0e6cbee046eb

SHA1
a08cf1631f581ac029b2cb191c81edb93f4e7429

SHA256
aaaa61cc7ba47d3b4054e75cb3e7a3114ab50de4d16c1c5d77b2b0d53b5fe66e

SHA512
0bf664a50684b6b4f99b87276f9f75f7e6866e3794384ba4ee93981bf4ca6ac7892d4512cdab97aa4db221147f0ee97c8aa8fdce9791b1f18e18161584f561f7

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou

Filesize
44KB

MD5
e1dae7ab60411cadf88bc7ab4c5104c6

SHA1
abae338c4cb09d2c4ff6c39cae9c4f15dc41e8bf

SHA256
d08436975ba795ad600573e7720045680fc51c730e727459b2d11c10ca2c4994

SHA512
7d0f6cd2d4d732cb89d5144a9b50ccb30d9baecdc54a6da61e9a511531780028f6a2878ee5e587e0dc12815c90ee63d9b28643518c11220caa478f7f080c7ee6

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou-journal

Filesize
512B

MD5
43ee4439f7b5a5f66ed147eb4b94b103

SHA1
6403162d0b9a17419f8712c5839d7d1f4dc81e9b

SHA256
847c69df0cf45e4da10fdfffad527a792fcd01c156d0478e6abc00d4d081bf4a

SHA512
5cf3fc6e37fc1cf8e9bc7298bd1a384b3e155634480481e122f6823a0d8034e81d6c8deeabf999ac0067f33052cc05925ea5ea3820c766e858478f21ff440d12

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou-journal

Filesize
8KB

MD5
197892a4a64fd676a0bad72d3f522ca0

SHA1
4d5330b2bbff5d34fa0130911f75f09a1692e926

SHA256
eeca300bae86459d108d4ab7089cc88898c0241eec21e764b00506e029ac7f2d

SHA512
502f92917b426ee45928bb2d0ad80c20ce673b74e31f835a0a874d46de18ba65afd7d8f9a7a91af33472157d588b2fc141d10393444c44be4b9a54bd2ba329f0

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou-journal

Filesize
8KB

MD5
f6f42177dc2cadd6e0fd8e4b678c934b

SHA1
20d11daa7630f0ad962650cfff5c1eab99118f76

SHA256
8278c098f88d6bb8f28aaed06c7258cdd727c0001f6543cd93bea36284700fc2

SHA512
d54bbdb7c03f5aaa3b6622b6ac40d428ff982c1049edcef0bc4f11cd74271dc7fbf6708bd0ff674a51806c3d3eeee4022d259f7f707bf0c2a356b1b618d9e659

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou-journal

Filesize
8KB

MD5
a1718341f3661706f8428d09ce7c6522

SHA1
30a3b58a2ba32fa9871a0ff66286eba488f00fa4

SHA256
3d92cd1e57d7f29bd7b61902efc8342421655b18d740d8797cbe807fa860c171

SHA512
140b7897ea57d0bc5ca7d9bf570e379ee59edcd22a15f5b0d1b7f2d95414a739a2c7b4e89886c2873c21449ba7278a3576f64b80b91fa4699043fd9ac96aaa54

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou-journal

Filesize
8KB

MD5
9543b180c5bd68ee28941fae016013eb

SHA1
4791fb099c0272877729b274aafa32b2d63a91d0

SHA256
3a29ab2db25355d09fd0b498c185bc6928883b3f457b6e54681b1e52aab7ca17

SHA512
7e762b1b0f8054bfd96190a54e46008a4d194dc92e18eaf71ff9e37718d6ee04e2523d4e2c759b0077c37c81aae648d9138ff893621c6ec6f9a67d02818c088f

Download Submit
/data/data/com.xgbuy.xg/databases/xinggou-journal

Filesize
8KB

MD5
a5ad95d47d11dc5db7626630708fb79f

SHA1
3b8d3c59a08a6050bf3bd277c3326d112ea1215a

SHA256
4c280d187dd46287e4609ae2f828c0deee00ee62f54e2013d538f9be098a0794

SHA512
9fe59da1117280480aac69293eeb1006cb7960bb3005aa4d4c275064985987fac10830c4a7e9236c8f5f1d829aac754732775a1116b71076d054cf158890ae0c

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ac

Filesize
40B

MD5
3911ad10a2d9a4f7ef7a09639a1b8cf3

SHA1
d8d5dae863fe04bef8d987202e25e065efce1e1f

SHA256
0ae3380b0712c9bcbb362bcdf7b72504b9e495fe2987cfc20aec121977dba19d

SHA512
d58dc5e805e0e2d11a79c725285dbb3f75d351d456c87ce79439af68c3a6c2506f5814bc16f09fbf16462c93f5c781437a5bbadc4d48977782899ce9d741dec8

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ac

Filesize
40B

MD5
81024874f926b0c0c9e613997c9370b1

SHA1
a7b4c37570f3e5aa7bd575d0dbcc71ff9079a95c

SHA256
da5ea38fae9a292777936eae50a76aae4d2a589550448aa6970383e44aabe7d6

SHA512
8ae3ca2a1a4ea6c514fffeb911f4c42ff173433a7fd82980193d883196e748e458e83ee42051ccbabfa7f49792dabbf1eb8a72fea3db16c2f157e7ada4182830

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
a28c60ecf10ebe7e89ea14006d6a59cb

SHA1
e87290ba48e86ecc67252a4097f2d355acd6e1ca

SHA256
7d99ead3f7dc0ffb4ce93085e49a651deb45526b4d26b6d8b6f650354ddd3ed3

SHA512
c9628c35d5a2eaf509cde10449231c6f74a978f44986b089a17042e3f7152927994f9adf58a69d328092ff07d6fa1b60496edb8a8bd06d9d8894c5069f0c17f9

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.di

Filesize
340B

MD5
c4ea7eaa5e80f36aa9cfce9673e2a90f

SHA1
9dbf7ba0d3db5f136d1b3a1724b5b359df691b9e

SHA256
d6e2f84456f4ea9c6bb984a699e57acdc32d50953973a194f35e468720032b11

SHA512
cf88bce7f6a4868646e00751201439a7bc55a4fa182a91b9a4ee132383e90cb8476ac0b6d4f177d4a35fdbe5610334847adddf2dab2c8f5ec025b80a65abfd78

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ic

Filesize
40B

MD5
1bd86b90e1b355f123e5ce8c93c3de53

SHA1
bee5683d6124650c8be0b3740ad66e771f29b178

SHA256
3ba28c4fe20d74ea96f6ced27333f04a01e03c50092717eed1b6e30152a8d152

SHA512
6ba3d7ac2b9da3bb2f7ca50488782bfb9f12a38bf17debc4f2853a161551a932885bedaedace0ecd3da9777e1cddbb407ca2360c13512b1b804bd6242e767abe

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.li

Filesize
85B

MD5
deb82f87af690782d072ed96cfe7276f

SHA1
f07c80391296c50c30903acc0d13ccbf020e34ab

SHA256
96da0cbcfb78fc3341d02cd742397ad1341087723e3171161284f3af6076e227

SHA512
bacfcd283afefb1a34dce46372e05ad7ef4b518b5ab5f14c1ae5c9615024b58b9406f570079e91c12bdf76881a0b5c2ed5ef040055bf304b8e54bd85b1927656

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.rd

Filesize
32B

MD5
dc2e848be2824acf32cff8ee979e58cf

SHA1
de0d519b548d2290385fe035f031fd2c4a61a0eb

SHA256
77b8a926e64d8810db71b3d51f4cf37b68037d0d91e5ea2940872775e8442a23

SHA512
52d2e8441548718e5a13c0521a46b15ee7d6b93039edd4f3033852240a63bb4361e238b6c7020725eddfad0199ccfdb7496f8e47a3ef6116e5d0bf067f5b46c9

Download Submit
/data/data/com.xgbuy.xg/files/.jglogs/.jg.ri

Filesize
314B

MD5
c5d02315c0ed2ec3dc0c9a3ec7baab7c

SHA1
a2d1b2783a372cdeedcb7de11571e105cfe44a49

SHA256
add046adb9728db32ac46955d5756d54b90fed043546c30c065d1d73b4b33acf

SHA512
46f4c5b9d4bc7b4102833fe725a74056c7d2472f4212effd07b3c60480cf9225ef11040f16d0aba80543732d2b969a9d079a2d41ee7f3ac7c45f67f71d20a048

Download Submit
/data/data/com.xgbuy.xg/files/.jiagu.lock

Filesize
27B

MD5
9fcb3cae16b1c5e816b858c8f78c8c5d

SHA1
a8a162dd7350108852c4b884abd65f47a1e91a85

SHA256
0a82519f6c7aa5d930442ab121c735fdb2c670ef8e57cfe5b7f7e7194175b9f8

SHA512
9d762692e1e5cffef18dbea07457f834689ee6823e2ab57b4773390b5257627525dee573f34865b35b4097e86d3c7b021f5c3d6e92b4c581d235dc3891c5e64a

Download Submit
/data/data/com.xgbuy.xg/files/Mob/mob_commons_1

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/com.xgbuy.xg/files/Mob/share_sdk_1

Filesize
23B

MD5
8e24e79baab91c4d0604eaa9006a0cb3

SHA1
e427afc94a4b957a7096f73e395a10ea404c076b

SHA256
65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

SHA512
45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

Download Submit
/data/data/com.xgbuy.xg/files/Mob/share_sdk_1

Filesize
62B

MD5
cb479c41e575bec48b1b3ccd01fb8617

SHA1
cb55988ecb0b3a53d05000e19e58237d167ac07e

SHA256
f6e625960a625d4f0cb8d1f8dc4f9e3c8a2005912917e9582591be841e2744d5

SHA512
9ca3bd5243ac88462deee1ffa8d7b84ba150ceebd2f0ae614281dfe8bd39c525e6e355bbe068c34fbf3a6f3c0a0c3703c18f5d13d57fc17ecb534534f1561de4

Download Submit
/data/data/com.xgbuy.xg/files/Mob/share_sdk_1

Filesize
86B

MD5
56626c0613d7fca11f66c863e31b1c65

SHA1
fbf85661d77e5fc9b56a714c1c6e10acc21d1f5c

SHA256
60db058c403f0b61a8164c75877285bffa094d7024dc7e69ad3789ec39101b72

SHA512
06b73e99cc3bb776b529e8310600af454aa369c3c869a08f7811ca99b1ae60e9daccbcdde6b04b1d5044b72e23866beb9d12e90c01e664947847d94412202a85

Download Submit
/data/data/com.xgbuy.xg/files/jpush_stat_cache.json

Filesize
131B

MD5
d0477ced39e8220c293ad0be54212259

SHA1
fad12b8ccf7a22598e12946f7370f16b76a782c6

SHA256
03bf8ab87255f2b6b91fbf6efb6e0d4d1bae809773112761b095c9c280bb3a1b

SHA512
c206ea43037a1ecda5b852e0f878871eae24b577f656c2b3447416a08c0d7003816e154b0c45fa9d542b36c82ee35de8c60fd4d48a09f422ce563fbe72cf6567

Download Submit
/data/data/com.xgbuy.xg/files/jpush_stat_cache.json

Filesize
177B

MD5
f2041e466bc42655003af32b44aa516e

SHA1
33bbf1ab78e2fcdc0cb55312091f060d512b4d01

SHA256
bd44bfeefa7433fd87a93a2c66ace7a728eaef485756b4c45d0e045ba891e138

SHA512
dddef7c056d7f5ea85962e0ec208902884e94308a8756431d039562db00a24680d738764db4ab83fc25739964db60fda6ea3d815310cd9b011a62baa84ff63d0

Download Submit
/data/data/com.xgbuy.xg/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzI2NzI2ODM3ODg1

Filesize
1KB

MD5
1209dd089825b1a4453a4ff702166485

SHA1
37895d88254953b5290f92a9ec5cff9588b6a16a

SHA256
f0f6f9d741e305c03088ceaa14437d7d3e9874de0385380d11c768e734815946

SHA512
2e1bd9d2c2a539bbd4488b015ba8cfbdeaa92a1fe5f47e986352426ad133f6760449cd82d2e0960ec9b9615772c9e4b7929856e0cf207b71965ce9ef6363fec6

Download Submit
/data/data/com.xgbuy.xg/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzI2NzI2ODczMTYy

Filesize
1KB

MD5
b4cd7ae8f4019fd538578d10934260be

SHA1
b7dea737f641ac73a87893320d3b48348366cfd3

SHA256
b9a8f2d216593ac943f4a2b2be948b0a3d1de35bb342696c79fbea2dc221ca38

SHA512
12bdbfebac61d3862a7c234271b6b9b8d542bf38b916eb4a325438b8583c5d8f5f20516c03d5cb30bd54ee7d01e7f4eac135d600c9e50c703940cb03bff644df

Download Submit
/data/data/com.xgbuy.xg/files/umeng_it.cache

Filesize
350B

MD5
71cc1725f66b9327a65d26fa95439a78

SHA1
a57a0911af01c29ba7cfa3891da0935bed09cb28

SHA256
0587c6761654372275aa7ae395c4cea94b2327c2de3d2655e80f3fd6f58562eb

SHA512
6992bd77d0c43370468c99a291e123a4bc72dfc2d81a527ec87bc76790a92570f6d405984cbbb85d761614e32d822570269c65505b4c13cda8ee9e1fb2fa907d

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]

Filesize
6.5MB

MD5
bc7b7cec4c2313b65f6d767a77164dd0

SHA1
f0a2fb5db284bc60f424c2084984c830cf4d2ca1

SHA256
84906c5a9b057b44e0df1fb8030d13110748ba30ef7a8017abdd3157ef349ffb

SHA512
379bec4a7a82a83c32e93cb3d5d0e0622d78ec79a5e17861f9600069283ffeac13340003fd2323c884a114bd45102034b3e5e609b3390ce099db6ef71a144432

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes2.dex

Filesize
6.5MB

MD5
f1e1513c1caa393fe8e9a3f9fff03e7c

SHA1
db053d40d0ead70c10b229d129359601a8b5debd

SHA256
4e81f36348e9d21ea9121450a9c68817efadedf40bf365af9d54a6033b363934

SHA512
e9c0cb206d14c55f3bf375fddd0d1edcf2e4540c24ac5df6e1c4884e87be9861a87b4fa5a49162fd054bafac7ed223e6f79686ffd71224f64f7336173298c03b

Download Submit
/data/user/0/com.xgbuy.xg/[email protected]!classes3.dex

Filesize
2.0MB

MD5
e0cdaf1a37a325beb335128a913ce71e

SHA1
1b4f9eda9ff72406032655f7a7f97e361d90bb2f

SHA256
444121cbd8f09a2461d84bcdecea5c61c0a5bc7b0fd3671d6a1ba5a91281cbba

SHA512
2f24d69d48c4cf889db9b6d2d5c867b8ea758663e0e83ce1e7ecf650a6b5850669d35d46df3355a643bb2732b590d4609eabbe4aa74d4a4b076c3bb8e8a17d8b

Download Submit
/storage/emulated/0/360/.deviceId

Filesize
48B

MD5
4c4c5285293d5141f582aefa4e038669

SHA1
e01852a72e5a8e6f7d63a21426b515118196047b

SHA256
36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731

SHA512
097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399

Download Submit
/storage/emulated/0/360/.iddata

Filesize
66B

MD5
19402718bfb1c685a726b4e1d846ad98

SHA1
02a7e30044a67085f2f1da24e16e4ecfede65b72

SHA256
079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0

SHA512
25254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b

Download Submit
/storage/emulated/0/Mob/.slw

Filesize
66B

MD5
093d6d3426351dbbd68f2a6f70dfae8e

SHA1
9fd1d9088b5b354c772f7ea865ec8450c09bbdd2

SHA256
7065930c425107957a2db95b13c8b4bc1b7225c945a2a1fd941f833933af395f

SHA512
4926afa7a570010742fd2e92f9b5813b82e4370c8d44f8e0ff897313a120c2a0e0b14b52629da31c16171c4ec1a435e83efe368dba7535c4ced8a4081a8e2984

Download Submit
/storage/emulated/0/data/.push_deviceid

Filesize
32B

MD5
04cd5b8d387329caee2401b50dcac9fe

SHA1
ff5367122649e79728f4be5eb7b4b232636fe9ad

SHA256
5a5921cec8571108569199e14b3f3c9f34d0fc0849e587493f0fc4d3d794984c

SHA512
602355a22d0726ce068d9fbb71fc2c648a480b1e4363fb45f98640102e01aea7e6efd41d4be0e3dac9fa9117afccf7a2f2f7530ff85204ba27c9347b8bc0d0fe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads