a754307414a4467ca04a1d1a70c30ae23b8e21a1ee8054b1b092b437631adee5

Analysis

max time kernel
152s
max time network
151s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
27-04-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stasdk_core.apk
Size

2.1MB
MD5

e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1

96a86954d989f634798c91523712c34eab06da3d
SHA256

8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
SHA512

e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP

49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery

T1430

Processes:

com.dbgj.stacore

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.dbgj.stacore

ioc pid process

/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar 5092 com.dbgj.stacore
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.dbgj.stacore
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dbgj.stacore
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.dbgj.stacore
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.dbgj.stacore
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dbgj.stacore
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422

ioc	pid	process
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	5092	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Filesize
85KB

MD5
3c850ffec5bdd850f123077ca210a411

SHA1
1c1ae4678b8a3b65640f047cb1bd72bc70d66f97

SHA256
516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e

SHA512
aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Filesize
75KB

MD5
b40bc2581872aaa387d3639aece392bb

SHA1
1636ca6cfab6adc7d99318fb5c119f0b840bfa46

SHA256
8da950aec4dc1df30f0900c279ff2894c19394610ef48b12bd84dcdc7437c164

SHA512
8d7156f0a41471b2142f5e68b9d0720c816ab211a6e6b225ea89ae515fd29ebc2dae1c15e44279da68cf403ffd62f66ec63f7f9ff03c77c37482c8ad7dfcc7a4

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Filesize
85KB

MD5
b13e0993ebe69e92499f37710e843306

SHA1
2480425d85b11276d2d3b66cadb7be1da9db064b

SHA256
de907e88bc323076cf329f865b94a0ca4637656fa0520f4621bc0077a9a67391

SHA512
4cae2f092d0cbb18452be1c308bc43d0624fb36114be32099848da0268a6ddf8e29baba86d2d60081bed399e75d4003e5d8ced291410b1435ebdf0bd5f8ba1d2

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/oat/__xadsdk__remote__final__builtin__.jar.cur.prof
Filesize
149B

MD5
7d300ce4a503a91a0da57807cf3ec5a7

SHA1
9446281b0d2729b655ba5b408799fee665b41557

SHA256
aa321640fac6e585621a916218c2e8b77f29444142002adc60bba257eb4ed0ce

SHA512
3009237fc0e8a280e3492d6a52062c660655d0803d839364ddc5383494f67c13c9f4fa525ac8fbdf32808645886f52154efc62fc9af7d3220c1fe626a8254544

Download Submit
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Filesize
208KB

MD5
8ac0f6e404323d80b3aa5d7132125463

SHA1
547b41a4d04b4448a57a26ce9a4a612743153523

SHA256
1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c

SHA512
50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566

Download Submit
/storage/emulated/0/data/.systemid
Filesize
36B

MD5
db8ec40645c6b31cdacfdf4f684a1b18

SHA1
7058a37e1c699ad14ff9e0074162dffb87fa8eb6

SHA256
bf75067b15a293bbbe093ac2aa1ab9bd685627b2f690cd9c5bf808b1c80c9a9c

SHA512
1659a616813a1957c120e15e3cdc5338a12584a9b4eb171ce754044c57cc62ff4e395c66a6c479baa7d108369d2c51adefbd15db169453bf959f581169e0a486

Download Submit
/storage/emulated/0/data/.systemmac
Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit