9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c

Analysis

max time kernel
179s
max time network
167s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22/05/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stasdk_core.apk
Size 2.1MB
Sample240522-e43k5sca89
SHA256 8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
MD5 e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1 96a86954d989f634798c91523712c34eab06da3d
SHA512 e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP 49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	4236	com.dbgj.stacore

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4236
- getprop ro.board.platform
  2⤵
  PID:4315
- getprop ro.mediatek.platform
  2⤵
  PID:4335
- getprop ro.board.platform
  2⤵
  PID:4357
- getprop ro.mediatek.platform
  2⤵
  PID:4375
- getprop ro.board.platform
  2⤵
  PID:4552

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__xadsdk__remote__final__builtin__.jar

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 11KB
SHA256 049a7eacf3a45ca863a814115f61b1efc06b82a5115c68eade90f5f230de6274
MD5 9c655c6cccaf50bed519ce32975eaf46
SHA1 1e4b045fd73e4de1216bc4c91698c2f0211206bc
SHA512 101cde0853dedcdc60645616cad71f27ee353b391399ab187b7c8afd6c15aeb10da2d7959686a592e1d93e9753105adf0bc0932cbd7b345b69d503918b1d0a25
SSDEEP 192:DEwMdMdg5k/m75u4Em+yu1CT4nXxXHimc6BQEainjYZQ8GLZiRVBfH8qXi:E4Mb1u48VPc6BQEainkZQ8CZiVRH5S
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 85KB
SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
MD5 3c850ffec5bdd850f123077ca210a411
SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar (deleted)

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Size 85KB
SHA256 7ec3a13be4fa192f1e4e4c48ac61bd588fcc325945130f990f3f268e3f1466e1
MD5 86a68a6cce3776bb4c5e9011852f7525
SHA1 fe689fe57f3f7fa585adff8f4406bb13beb40272
SHA512 c104cb66f6eaf1afcfcb6da3ffaa01dfe515923390e0d5b2b0f3855ec8a15a4735e84d43706e874706604f27ecde8492c2022ad9e0ad62ff4f8c8a33c7f346e5
SSDEEP 768:qbwmfUCkUil4wy/B1cA4s4au98yV/3XTWtsA463v3JMVDlhA0Up8BG1Vuydsz4rK:q8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar.cur.prof

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/oat/__xadsdk__remote__final__builtin__.jar.cur.prof
Size 164B
SHA256 016a52288823ef2137402ff3a419117d0cbd1aa7030c9ecb6e7df47f4f082295
MD5 6683741748a5812314ccad4e05975a0d
SHA1 e9a00ad264524c3903c0b443581563d5983184be
SHA512 784d70a077b92c8a0697af3dc575fb60f76d79d51526a5bc98c42da80130ec6269acfd2e48c5e23ae7d55234fff0f87f35c8c31c7a083eff1a5954300a431f5d
MD5 SHA1 SHA512

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 208KB
SHA256 1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c
MD5 8ac0f6e404323d80b3aa5d7132125463
SHA1 547b41a4d04b4448a57a26ce9a4a612743153523
SHA512 50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566
SSDEEP 3072:3dqq3gmye2hfHG+Skr253mkGts6FE/1Rt8Mgu8qErAAOGNbsh6NGJV+P3Xg:31ILHhS8u37Mo17g6ErAmNgJ7
MD5 SHA1 SHA512 SSDEEP

Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 36B
SHA256 cbd5adaeacbba77bca4085d2d7924b284d7e7e04c8add35def7af379cab542ba
MD5 73f1d6a42ed24e0fc00caedb8aadb965
SHA1 4225e3d2884916e3d928c697ef3dd2fbfde98982
SHA512 5a993e07cdf130c4ff2457906c6cf8ed6c729aff717c2ba5f7d24c61eae3abf4da16d47c05ffefd1af3a5d65903d4530919ac471bd12d2cf04800b94e2fea001
MD5 SHA1 SHA512

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 17B
SHA256 c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a
MD5 0f607264fc6318a92b9e13c65db7cd3c
SHA1 c1976429369bfe063ed8b3409db7c7e7d87196d9
SHA512 9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads