5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5

Analysis

max time kernel
151s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
12/05/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stasdk_core.apk
Size 2.1MB
Sample240512-rw2ebsdf72
SHA256 8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
MD5 e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1 96a86954d989f634798c91523712c34eab06da3d
SHA512 e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP 49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	4264	com.dbgj.stacore

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4264
- getprop ro.board.platform
  2⤵
  PID:4335
- getprop ro.mediatek.platform
  2⤵
  PID:4355
- getprop ro.board.platform
  2⤵
  PID:4378
- getprop ro.mediatek.platform
  2⤵
  PID:4396
- getprop ro.board.platform
  2⤵
  PID:4650
- getprop ro.mediatek.platform
  2⤵
  PID:4670

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__xadsdk__remote__final__builtin__.jar

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 85KB
SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
MD5 3c850ffec5bdd850f123077ca210a411
SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar (deleted)

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Size 11KB
SHA256 3a7b70ecfb1b246ae70d3b7eef3940a495cad6592922aaceef9dff1f94f9958d
MD5 978707fd5e4a105e1b9812536d8e0da2
SHA1 657e742838a0113bf8bbba9792295cab87778cf6
SHA512 cff22eb5b1bff2386dedbb1a17cde2f794fdc796723c3ba0bf40473a8d88eec3bc84dfd76051ad8ab332329ebef0c4d23c4ffa402fa31a884fe5cae7b33b0254
SSDEEP 48:mLhcRJfjt8/TNev2VQXQzs8q58a80nVV41U/xU0J4b1VxNdjwUHnn8Iym4KSGXXi:oiffjYZHzs8G8aPi6ZiRVjdcUHn8qX9U
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar (deleted)

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Size 85KB
SHA256 03f72716beb5c1c3550b6813abe5f5c64b5642b9f52eb51c3e6229d8e7e4ad26
MD5 78db86019a609f4e7e6df2bdce7d927f
SHA1 aa0dbce195dfdb42b7655b1f93abc6f232e7b8b1
SHA512 4bdbbaa113f1591a84a2115a212cf0bb80bec47ce3c845fb6dc7192901b639e85c05ca94700b7cefc767c7a49717db656d9f8b51b79f915a70ba00dca3bac058
SSDEEP 1536:A/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:cmg/I/tkdP8sa80O42uXcVrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar.cur.prof

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/oat/__xadsdk__remote__final__builtin__.jar.cur.prof
Size 164B
SHA256 016a52288823ef2137402ff3a419117d0cbd1aa7030c9ecb6e7df47f4f082295
MD5 6683741748a5812314ccad4e05975a0d
SHA1 e9a00ad264524c3903c0b443581563d5983184be
SHA512 784d70a077b92c8a0697af3dc575fb60f76d79d51526a5bc98c42da80130ec6269acfd2e48c5e23ae7d55234fff0f87f35c8c31c7a083eff1a5954300a431f5d
MD5 SHA1 SHA512

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 208KB
SHA256 1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c
MD5 8ac0f6e404323d80b3aa5d7132125463
SHA1 547b41a4d04b4448a57a26ce9a4a612743153523
SHA512 50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566
SSDEEP 3072:3dqq3gmye2hfHG+Skr253mkGts6FE/1Rt8Mgu8qErAAOGNbsh6NGJV+P3Xg:31ILHhS8u37Mo17g6ErAmNgJ7
MD5 SHA1 SHA512 SSDEEP

Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 36B
SHA256 f3f245618575dc3c1f32f530eed4b84fd326db19c31a7c8efb29ae37c2b71a4c
MD5 507866752b51917166ff397f5a51dbd4
SHA1 9dd2ffc36405813ce595f8c1a603833c5651ff8c
SHA512 ed076b1ad283cca011c32ff25f68e1068ca4912da85a8161d1025dbc649aece72fe3105e6f00d9fa7849fc446578e441539192f6bb4d6940cc8f8c4918b3bf13
MD5 SHA1 SHA512

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 17B
SHA256 c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a
MD5 0f607264fc6318a92b9e13c65db7cd3c
SHA1 c1976429369bfe063ed8b3409db7c7e7d87196d9
SHA512 9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads