180651eb20478bc35465a031729598ef62eb2f824e0aadfc85154e666ae6e85a

Analysis

max time kernel
179s
max time network
169s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
22-05-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stasdk_core.apk
Size

1.8MB
MD5

8ec43e10005ec4bc91c4e45b8e68e304
SHA1

66fb42cb11e77900e55cbd4a8e247841dad1c5ea
SHA256

18d90827352cf0ed3084c4f1f94d98026908f674914889e1e58c2ac5e68be63f
SHA512

6077f32c03361faa552bde6c7cb9676c6393a9b7a30a9622095e6eb93da484b29fd75edd955523c8b51d4e86fe4a19fbce5cc456f7612162dbdec76e43b563d6
SSDEEP

49152:kORoNccoT875hzBwbAqEAdBXrcZzVCuSow:kORo6kha0qjXGzoow

Score

7^/10

discovery persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.dbgj.stacore
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dbgj.stacore
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.dbgj.stacore
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5129

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/data/.systemid

Filesize
36B

MD5
6bf45ec2b5a4f5506440cd508e2ade95

SHA1
cc849ecc752a365f48b58679998dcb9350b5061d

SHA256
ddabead0fabc0bed4c59e8d3bec3399c332ac20e3c13d3d0552245dc4c5b896f

SHA512
9cd6b25639800afd45edc890ade94627a9e94038c9dc4239245eb9cf945052dbb0d6ce061657726a5a6dcb9d4e5ef387f22a2474f9588bbbeb6a57b90d91097b

Download Submit
/storage/emulated/0/data/.systemmac

Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit