a49331e419c70643364f3f6419ca171b91dbd2b7a8d4023fae620ff8d09fa2fd

Analysis

max time kernel
179s
max time network
176s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
14-06-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stasdk_core.apk
Size

2.1MB
MD5

7219500f857b0c418b074759ba44301e
SHA1

07f557bc3d839260caf921852618ac762fef262d
SHA256

d8c32e40ba04065dd62cae8495eb47d1c251a6bc830778f80eb06ae07f04563f
SHA512

6086cfbeb32e3ded98d89c0f0bc01fac10e6036874e1c8e0ecb41864e62b00df5a32f9a3aa7bf126f6b8f1393db48abaf94ce528cf0686a3946b139bc50c8a68
SSDEEP

49152:CzrcZzVCuS4++IpMKWnL0qRIZvwukk/icrtb+OPpGF:CzGzoB+I+dnL1RIOu9icyF

Score

7^/10

collection discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.dbgj.stacore

ioc pid process

/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar 5171 com.dbgj.stacore
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.dbgj.stacore
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.dbgj.stacore

ioc	pid	process
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	5171	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

T1430

T1627.001

Processes:

com.dbgj.stacore

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore

Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dbgj.stacore
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dbgj.stacore
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.dbgj.stacore

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5171

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Filesize
85KB

MD5
3c850ffec5bdd850f123077ca210a411

SHA1
1c1ae4678b8a3b65640f047cb1bd72bc70d66f97

SHA256
516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e

SHA512
aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Filesize
25KB

MD5
1137abee2555df45715c3172945b67e4

SHA1
76c4c6654d5abee527dcff6ad0919c28c55cd31a

SHA256
dafda0d1ab524bccc873160e2a2c96da98979d6cd7f4b72fc6e43862809e8d50

SHA512
148d4afd2f0fff60dd6252d533094697541ea003c19280fb2bcf74f8c84462fd333f869caa46cb5219342e976fc1ae8e73d0d26ce2ce329f84986f957579e395

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Filesize
85KB

MD5
3e6255300c9b33bea93bd84cb04f22b1

SHA1
72dd3e3d874ef20059e11c5befd2a61862bddd91

SHA256
e15fed1d39315b9c152ff058a7e3e3f39d533c17ea185ee47890c47dcd045002

SHA512
825d72e3534cf3761e24fed2ba76c04ff9ed61881d2048e60a9c8001137c5d318e1b73f6ae27c5aa6213546b54d303a237200cbc0dfa318d8ae2026991768608

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/oat/__xadsdk__remote__final__builtin__.jar.cur.prof
Filesize
149B

MD5
7d300ce4a503a91a0da57807cf3ec5a7

SHA1
9446281b0d2729b655ba5b408799fee665b41557

SHA256
aa321640fac6e585621a916218c2e8b77f29444142002adc60bba257eb4ed0ce

SHA512
3009237fc0e8a280e3492d6a52062c660655d0803d839364ddc5383494f67c13c9f4fa525ac8fbdf32808645886f52154efc62fc9af7d3220c1fe626a8254544

Download Submit
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Filesize
208KB

MD5
8ac0f6e404323d80b3aa5d7132125463

SHA1
547b41a4d04b4448a57a26ce9a4a612743153523

SHA256
1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c

SHA512
50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566

Download Submit
/storage/emulated/0/data/.systemid
Filesize
36B

MD5
b890ab57a1495b109d612a7e2d63d180

SHA1
9af4229ca640695734df76e42b560ca459dfd4e2

SHA256
adf9a3a0cbbc4207bb90dc4d1d46dd168235c25cd59454c45537aa2f901869e0

SHA512
ff0b004c4bd535abba69ed13e913686613f1a11bd4097ee51f250b7652c115b58b8dbd4f956b2255c3b31e574f90c32c24c36d3a6a3d7d30afa3dea980dc7ce6

Download Submit
/storage/emulated/0/data/.systemmac
Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit