Analysis

  • max time kernel
    179s
  • max time network
    178s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    18-06-2024 11:15

General

  • Target

    stasdk_core.apk

  • Size

    2.1MB

  • MD5

    7219500f857b0c418b074759ba44301e

  • SHA1

    07f557bc3d839260caf921852618ac762fef262d

  • SHA256

    d8c32e40ba04065dd62cae8495eb47d1c251a6bc830778f80eb06ae07f04563f

  • SHA512

    6086cfbeb32e3ded98d89c0f0bc01fac10e6036874e1c8e0ecb41864e62b00df5a32f9a3aa7bf126f6b8f1393db48abaf94ce528cf0686a3946b139bc50c8a68

  • SSDEEP

    49152:CzrcZzVCuS4++IpMKWnL0qRIZvwukk/icrtb+OPpGF:CzGzoB+I+dnL1RIOu9icyF

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.dbgj.stacore
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4198
    • getprop ro.board.platform
      2⤵
        PID:4245
      • getprop ro.mediatek.platform
        2⤵
          PID:4265
        • getprop ro.board.platform
          2⤵
            PID:4304
          • getprop ro.mediatek.platform
            2⤵
              PID:4327
            • getprop ro.board.platform
              2⤵
                PID:4514
              • getprop ro.mediatek.platform
                2⤵
                  PID:4534

              Network

              MITRE ATT&CK Mobile v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

                Filesize

                4KB

                MD5

                75aeedef7a4f56ed0b279d47a404ab2c

                SHA1

                cb45bacec758a54683c8136bcb3395862708f4b6

                SHA256

                f8164f4b428440ad0a148eafa3e3f654919d8484f7dcf50aec07077423326b5e

                SHA512

                338e696b620e56c7dda8de0869409e30743cf399436aff1bceca3f5f17fe91a21570405f3a548f670f88356a786dbe02c95d40b9f3896b6ca5a11fe6c76ecb6d

              • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

                Filesize

                85KB

                MD5

                3c850ffec5bdd850f123077ca210a411

                SHA1

                1c1ae4678b8a3b65640f047cb1bd72bc70d66f97

                SHA256

                516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e

                SHA512

                aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd

              • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)

                Filesize

                60KB

                MD5

                3b03eec661933f743a701ed7427bf211

                SHA1

                3acc343ce80139bdae798af8ddf3c97b4b7e15df

                SHA256

                df32266e457bbc1a347549679c66d2a99a4647a8455e204656dfe8ea10cc0bf2

                SHA512

                5cd9528bc217dd2f509052e013b32c1cc3c0f682e6fc8d3d086b928ab104166166ddf704fd14df00792147feee8042f8378b8a4cad0952cde239342417b8fd83

              • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)

                Filesize

                85KB

                MD5

                2f51a19c0b517418706df9a37beee13d

                SHA1

                e2deeb111b6abfb95c8bb30a746c23a58f092ee3

                SHA256

                d510f0bf1dafbbab6e921ff3ae0248925223cb6e0c1976d352c4a8b69143ac5f

                SHA512

                587d1abd7d1a51b372bc4133b22dcca75f61af0956db7456c00a850c0785b970a3955d266a1b47dd3ccd74427bfc518c34c61592e31e5fbf12af584061bcfdb6

              • /data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

                Filesize

                208KB

                MD5

                8ac0f6e404323d80b3aa5d7132125463

                SHA1

                547b41a4d04b4448a57a26ce9a4a612743153523

                SHA256

                1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c

                SHA512

                50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566

              • /storage/emulated/0/data/.systemid

                Filesize

                36B

                MD5

                82d0933b952c0633305be45987769a8f

                SHA1

                fb8e56f0b8ae0f35e7119444189432db19036ac6

                SHA256

                5828121818789fbd92e843f02abcbbd47ccdb41e9ddfe7dda4c7be4ba346a0f2

                SHA512

                948fdf371c0eae32272381fe7f2240da6e1b389938c0859a36242d8d3cad85536f630df387f80903ef748973b9be432e6cbc3e2770c855a73d414f40a5fb1c47

              • /storage/emulated/0/data/.systemmac

                Filesize

                17B

                MD5

                0f607264fc6318a92b9e13c65db7cd3c

                SHA1

                c1976429369bfe063ed8b3409db7c7e7d87196d9

                SHA256

                c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

                SHA512

                9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1