Analysis

  • max time kernel
    179s
  • max time network
    177s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    18-06-2024 11:15

General

  • Target

    stasdk_core.apk

  • Size

    2.1MB

  • MD5

    7219500f857b0c418b074759ba44301e

  • SHA1

    07f557bc3d839260caf921852618ac762fef262d

  • SHA256

    d8c32e40ba04065dd62cae8495eb47d1c251a6bc830778f80eb06ae07f04563f

  • SHA512

    6086cfbeb32e3ded98d89c0f0bc01fac10e6036874e1c8e0ecb41864e62b00df5a32f9a3aa7bf126f6b8f1393db48abaf94ce528cf0686a3946b139bc50c8a68

  • SSDEEP

    49152:CzrcZzVCuS4++IpMKWnL0qRIZvwukk/icrtb+OPpGF:CzGzoB+I+dnL1RIOu9icyF

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.dbgj.stacore
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5147

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

    Filesize

    85KB

    MD5

    3c850ffec5bdd850f123077ca210a411

    SHA1

    1c1ae4678b8a3b65640f047cb1bd72bc70d66f97

    SHA256

    516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e

    SHA512

    aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd

  • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)

    Filesize

    83KB

    MD5

    8aa4ac905d8e474052926a5bdb16c3e4

    SHA1

    4c0ce9c9d5af94e4e38664f282e442fe01e381ab

    SHA256

    3ea27b8cc7d1c1c0e24296f8da3c8393fed4d84b29b35faed28ad82f0a940c19

    SHA512

    71bdbdc23eb2bcdb32831303fa601e9959c6b23c2d7225dd7b1e20fb4f5ce433e07146bafbed2eb6129b6067bb5bdc2fe4de58ff999a10473109ede96634e0c9

  • /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)

    Filesize

    85KB

    MD5

    3af3af0621933b63d761dc5112bda7b6

    SHA1

    cb54f4c125ac9e19fad4d4743ce37190c3383988

    SHA256

    73e7d984e71cf983c0303b0449bc0ae26da441423ad14305fe65c6c7091b494c

    SHA512

    7914a12bc47548a62520824a3d87806b3a64e1d0e465702389bbc0ae78f81c6f8add623b34ff27aaa393b5ec188f9d78d562f3593e3502aab6221153411d2ba7

  • /data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

    Filesize

    208KB

    MD5

    8ac0f6e404323d80b3aa5d7132125463

    SHA1

    547b41a4d04b4448a57a26ce9a4a612743153523

    SHA256

    1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c

    SHA512

    50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566

  • /storage/emulated/0/data/.systemid

    Filesize

    36B

    MD5

    1bb14464ec497fd2006b8b4d2ce0c65f

    SHA1

    3d275c6fd455d530380872b1755dc682ec9dffb9

    SHA256

    1110fcd8236f35a0610ca208b80212c0f1ab5761d327b417bf06c2c3bdb02ef7

    SHA512

    7ba185ec87130680f3d5864525be409439f9663b8fb163078a824922d4f86822b74d1e50db72822728d2cd6b32c6fa0c975d223ca264980509ad275836f7d128

  • /storage/emulated/0/data/.systemmac

    Filesize

    17B

    MD5

    0f607264fc6318a92b9e13c65db7cd3c

    SHA1

    c1976429369bfe063ed8b3409db7c7e7d87196d9

    SHA256

    c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

    SHA512

    9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1