Analysis

  • max time kernel
    49s
  • max time network
    165s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22-08-2024 20:54

General

  • Target

    HD_STREAMZ_Latest_03-Jul.apk

  • Size

    19.2MB

  • MD5

    47f9616a2bc5cbf6403e49b80d8bc22f

  • SHA1

    5403978c89bd0d8203b5fd471e0dd4336cae7342

  • SHA256

    364359495b38102bb781fe9ea2b0a4c2f80453bb42f52ee81bfd1ebeb020c4df

  • SHA512

    635f7ce656ae61dbd375baea5ef5d19c48c70986397bf3f79489f1ddeb9facbe3be37a86a228b02700b7c72bc6943ed73906f3bac8e97c5a82fb2c9fd8eae5d2

  • SSDEEP

    393216:QB51Df5gEeI8w9Fm74Su2AI6s3ny5fTIEXF7M2A:QBvVgmU4S8I8IR2A

Malware Config

Signatures

  • Android SMSWorm payload 1 IoCs
  • SMSWorm

    SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • insure.cable.estate
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4256

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/insure.cable.estate/.jiagu/classes.dex

    Filesize

    10.5MB

    MD5

    333810e89b9f11c61814e7002bd516d2

    SHA1

    e310f730138361b43ff7b2d87f73ef5a14cbc352

    SHA256

    f2f3f53e9ccfc80488522d058616bbda20dc2d61af1f6741811c9b9aa301381a

    SHA512

    92b9f8811cb797e2cd3286073578ec54d4a197bed4c97bcb8463dd3d75157f544e13b777bcf6ce4889b54c0b4400f341058d8a316c8bbf725980890ff1ae5403

  • /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex

    Filesize

    9.4MB

    MD5

    dbabf3dc633ae99e69800dda56816b19

    SHA1

    f92b3cf91be7846570e09cfd0e35f49ac020e435

    SHA256

    a6ff7ff2d2aff124c7506da18c79e43456a84d762914c01bf9f47d1f904a9eff

    SHA512

    ed33bfa82b539c548e41b60075b4c6dd47517df952ab170cd287aa8629a36fd3d952765b8357a5763afcb6e80ca3f90e0fef6674c98c2bd75bbf11560fa98311

  • /data/data/insure.cable.estate/.jiagu/classes.dex!classes3.dex

    Filesize

    91KB

    MD5

    4d69ce4197defcccd9d3f66c521403ae

    SHA1

    9de024d239a3ec19fa9c3f687a0714e8f6bf7c88

    SHA256

    dc41313777a66539c3ec52e4b26bf997888cd08bbe2c1dfd2ba734f9d4d2196e

    SHA512

    327b927055a866b4e5cb56f1dd206ea0539a3b5ae45b5ef5e1f77e387bea8f45395eecb3d1ffc0ca6fadf4aed4c08b95be75d266bfc529dceb93c622f9bae388

  • /data/data/insure.cable.estate/.jiagu/libjiagu.so

    Filesize

    733KB

    MD5

    0b559e54cc4d58d8d894041ac77d6b1a

    SHA1

    9f0a75b91ca3fbfad63482276e0af1d6f5f1f13e

    SHA256

    b8af0ca3197da1c1e9d8a3a9c60ac53dccf83f975a60b6591007d0a3b3abfc18

    SHA512

    8cad681faa9c85e1c954c1b892cc3c4eb417cc70c930926b5b3c6af190789f8b06d16d1427e4daa6ad0c406df7dfa2de9246d0466229d91c2143e4ddf3f9af08

  • /data/data/insure.cable.estate/databases/StartApp-d6864f2502af7851-journal

    Filesize

    512B

    MD5

    be670d89e8126cacb6c626635b9c2011

    SHA1

    059d9c144b08419a394a033c1ed5b42e74191b00

    SHA256

    373108cc5aa3dffbf9a5a49bf9c743f7db86909cfe948fd16df9ff20c84d9863

    SHA512

    9ab1e45c0113917b794c6b69170905a6fc7b85461c7513ffa2d9d4f9d59bd7d8e03097d7b3ccd0631697b62ab6653ae9128f1f3b49a8f491e2334ab625cf6f08

  • /data/data/insure.cable.estate/databases/StartApp-d6864f2502af7851-wal

    Filesize

    40KB

    MD5

    33963a3dbd49de2f741c4f2edc955a64

    SHA1

    1b3a4f8e0ee70ae23f3d1fc352ab7977a8f621cf

    SHA256

    f0895b40ac1dab8b24bb4860a705be2743bb29bb63949af105872b6004272bce

    SHA512

    7877a26bb756f213c3a16704b818dcff5d15ad068c31bffe01f0e6fd3f66e7379aaf32e2f8435b08abe5cc51ee9fff5756aa521a275f42710a345f02806cbf3e

  • /data/data/insure.cable.estate/databases/app-journal

    Filesize

    512B

    MD5

    862e5d1a21d90ed49827a7f0ddaea9cc

    SHA1

    be9594ad2b893af4b6f797abc5af0768c85929b8

    SHA256

    6314abbefe046522646df2860f7f02fdce88ee705ca2a9612089c009412072c0

    SHA512

    e43ab86aa5c01cb4a553da0cec609234346fd1456b27262eedea35f306e413d1b680c3752b3fe46ccb698b672c06e78fec86b49c616333761abaccfa4606a89a

  • /data/data/insure.cable.estate/databases/app-wal

    Filesize

    16KB

    MD5

    82840acbdb30e424fb742edc88e06a0b

    SHA1

    51bae5077dce20ba6f396cd9b44effddde251355

    SHA256

    ad082aa12c658b2576befab5ec029a42ddf796f1cf92598f258872505ce74402

    SHA512

    ff42f6f6799ea96c20137cf12ec2e55005ea85d1f47f66d9e47ac485ae3b9b984f04816656030377b1e2615576644bee8033ba5cdd53eaeb0fa27eada93dfbdd

  • /data/data/insure.cable.estate/databases/app-wal

    Filesize

    44KB

    MD5

    3f01a42dc51bf0d0010e83428b99b34b

    SHA1

    33881189d21007f5cb18efe81861d8d2a2c5c8d6

    SHA256

    3f6a6d0ed64382f8023dff490a3cf768a02bd1d49468955d758562eca545ffc7

    SHA512

    1463b736ab9653f31166e6a7ed8aa442595c9eec63816a6f556802756fa2d6118b32ac853123f4373f778ed537b3b23bd468aaeba7f69b47346847b1bf3b2d18

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    e99cc433de1b3794a0c0ff9e57ab20e4

    SHA1

    155e7efb98649fb454e1c00066a09b073c4f6611

    SHA256

    b3378b9a62f276b91804d45e4ba49d3aa1cf6b6db4926da9b0b56933cc77a645

    SHA512

    6463ca965696d40b13b897ace044a4b1fbd9cbd4de35387fe1ee21541dc0fef9069c2530752b0ed8087ff5c64652a7c7f716aa1374f3dcf32012caa30da991bc

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-wal

    Filesize

    68KB

    MD5

    c8cd3a94cb183a588586b1c41503c3a5

    SHA1

    9be4b3068a8e9623fcf18881ca5d853801f55bdd

    SHA256

    198c6fde4b70655e5bf5ecce538fc5fc34f09af34251d551520f10972f906773

    SHA512

    221ab4e63a6bd45dd922519879577ce0a28c6299c9a850280a851fd3fb5fb0dd5bcd6b9017bd2e33d1438dd0f595735db31c6181de9543f898269c48141c1c3b

  • /data/data/insure.cable.estate/databases/google_analytics_v4.db-journal

    Filesize

    512B

    MD5

    1973732720123d78dc55e7b0de4e3e35

    SHA1

    68924436a11b14966c874ff00f18bfea4e034844

    SHA256

    dd595d136336d692836c68c10128f006968c17f52abc3e5b3ea9d58d7315f737

    SHA512

    192332a606c0c5203573937f7216486d858e7deab300cd6844127d588c7e9f7a161b92315f5c830d05ad6dc7e59273c406e8837302204f2835b84c23c86f5fc4

  • /data/data/insure.cable.estate/databases/google_analytics_v4.db-wal

    Filesize

    84KB

    MD5

    df2096bc906f334edc9f39734c43a80c

    SHA1

    6f0dd108151aa202b51cd1f9055a5245e4699726

    SHA256

    da1d13bbba45635ce6a7b59565d82d5955e80892d4f8fe04c183d1fcd7b09a43

    SHA512

    12c85f46d43296f134597f4f83f00baabf27281cf5095eee6b1d9479a317a6abcdc724136e7662429809623dd1fbdc8f601eba00327a7e7d21d0ab446485d9c1

  • /data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/com.crashlytics.settings.json

    Filesize

    715B

    MD5

    4a62c29fddf3afaf11ff81668ed5a6bd

    SHA1

    303c7dcf07b0655ba300d5e7bac32f5b1cb04070

    SHA256

    d619687ad2cff38a3365b09ff8706789b2624cde229e2e8455d63c9d975cda52

    SHA512

    df13ca04e27f39131c71ebd68d9169f3acdb7b53ea8993177fad5c47b3d944b506410465c5adef0c76f3051fd9c0886ca35a6dc3fae2c4a82bc525beef70875b

  • /data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/open-sessions/66C7A5A600B1000110A07B8BC82503F7/report

    Filesize

    798B

    MD5

    adafb3259f8d37cc3dbf1cfdfd93b56c

    SHA1

    3d03de7abcfce768bd3dbfc0156ad4b3266d4606

    SHA256

    801075a057a9ca96a6bf40b69baa46bd77a8958bdd41fc79afe751dd83c74e1b

    SHA512

    98ccd15aabe98cac1a0a70fc749752f6eb789bd43f13f394c8dea94a693895f1356b17addd7ff91e8b59230e727e6712fa6091e5130ff04659ec4f4ffad86184

  • /data/data/insure.cable.estate/files/PersistedInstallation3170642462111101436tmp

    Filesize

    90B

    MD5

    a99e12f023596af35b005d1fc44a52f4

    SHA1

    330038465090acb8a105ec7594f67ec65fb3e8eb

    SHA256

    11fe8cdfb4d45c324d974959f08607d78be010762891035dfa0b1e74b77ff032

    SHA512

    758b1a0b47eb91e8c916a8bd6db723e6f0ca14525a8323e624c8be63f03d7cdcbea657f9c815a0c811ad02ec3571cb27f8780999137c2db44a9f47026e4622a7

  • /data/data/insure.cable.estate/files/PersistedInstallation5363482533691531890tmp

    Filesize

    567B

    MD5

    831001d173fdaa7cb255194dd3df4fdc

    SHA1

    fc4e6e69ac992525e64b80b48097371eeaf832e6

    SHA256

    f0ed15064d22dacf1aa937961d589fc86e6639248c295ec79b9b645af79b7f3b

    SHA512

    28b9232c29109b3ff94862c160c15b8367d7dc3a6ea33ba43434d8d771edffe01a78cceebc01bd4881d804363364ef51ac19d57f8d3e2caf2266f83b3e778f53

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    33B

    MD5

    35b51faac8b5af3886e70bb5a885dab1

    SHA1

    e6cb282da46cd4bf113e25c8573268578dcd11b6

    SHA256

    af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b

    SHA512

    6ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    75B

    MD5

    944e6a5a08cb971370c65c06061f0ab4

    SHA1

    84d47725cc29bf167b782c702575bce4bf2ecc5b

    SHA256

    ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab

    SHA512

    bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    121B

    MD5

    ffcbf87665a36fc21782400bd0537e79

    SHA1

    3dbfbdbfdcde953317b089f9a9fa0bbe50c698ee

    SHA256

    a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d

    SHA512

    7f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    163B

    MD5

    dcf7d6c1cfd5e7b56074e3001577c78b

    SHA1

    b8eba89aee9f6688ecda6675ef8ff4998da0b141

    SHA256

    ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91

    SHA512

    42d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    212B

    MD5

    43abf67f2062e62dc52539e7abd0d4d3

    SHA1

    1cb3925baffb735c314c77b2aab4590f781bda8d

    SHA256

    2eaf4dce58dadd26a477ea69ff79bd505b3f6c910f240d5f300bd01b670a205f

    SHA512

    addaa33162b53d3bc8c2a6ae6bf7d54c5e382be4bca630534d5b69391d2dd292905d72caa38a3e29f6acc873840e96681a32be28d4f0f3948fc29ab8bc5d6e71

  • /data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_defaults.json

    Filesize

    128B

    MD5

    7a845c35ee49d2391daa9795ee60001c

    SHA1

    70748279b9220aa33d412ebf4c112c5ef9e04346

    SHA256

    b4837f5556a74af96fbf68913e70f7011d54e8c8ceb75db2830ad737264f1755

    SHA512

    040139f518e44547886d2c4be50baf6f92dd28d000cbd9fdaf86bbca50cb1f60e75967ee4631dba3a1e8e1617ced72611c78b9fc24644c41cce927616c9756b2

  • /data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_fetch.json

    Filesize

    366B

    MD5

    f1e8fb0e162de1c958d44438b51d7dec

    SHA1

    a4afec5cd6bc8a1be165735c9fa297349b48a909

    SHA256

    54440a5d2a9d75f6ccdce8d5f27964fd29603869a8181dee10c91a3ae3d9aab6

    SHA512

    dfe3a1fe03971f5a12c27b676f700fce737a5a20db618f3522fbb6a7ab7c71d9af4570a218cba460559dbc46cac8d1df718d1869c0bf97a0f9d94b63076eb84e

  • /data/data/insure.cable.estate/files/gaClientId

    Filesize

    36B

    MD5

    97c062feb7174923ebc6b954784f3047

    SHA1

    2845bbc3fcfa7533099df7280b11e65849037bd1

    SHA256

    0969f1500da16b1f1bbde079f7484cbcb61839abdb989cfa3560287ec41318b0

    SHA512

    febbbf266b598275a5d548aa144a27f5bfcb2817d40087c3e60f6440a5f1c7ceaaf1d561792056720340d0031a6daf8de60991076cae0e36576f375e49008c08

  • /data/data/insure.cable.estate/files/profileInstalled

    Filesize

    24B

    MD5

    fbcc084efc8cbde99fa02b21cc555cc2

    SHA1

    97127482e5dab0da155f003b3f662329a25b331d

    SHA256

    cf62f2539a28f7c282649dc1fd35d7e7d77b26d3d6990e3ea66ea83ee4d39eea

    SHA512

    d412c717d7ac2152c097dbdda9cf513c275498e0d116441e1ccd1ef594ddf691088a865ca2b486c05381f905d9ebbff48d409901f0ef4cde282efea1db4af8af

  • /data/data/insure.cable.estate/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    2709db24fa14ee18df7b1888b34dfad3

    SHA1

    5d56d2c5df475933c733179f5023112949c67299

    SHA256

    efb784562dab1307acd9333ad63c1cafc4794a513684905c7863510868e2fa5b

    SHA512

    e06f5fb1c1741b661bbc13981d278af1de4a667c1e7d941a1d229fe306f0ab8511e71497723ca1dd51d5677bb4d4c893cea5225ac253ce50ff2338a2009b4046

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    289c265ca8dada9207518d96973dd96e

    SHA1

    2e2b4e2ffbd2d283de36b8d75657b0b24e4eb6ec

    SHA256

    ad52790d2190864ee1fab975d47b4e25b8c06163f925c96b67b7fdf697dff90b

    SHA512

    f3b21c76fd456642ae4eb479489d102127427d71e3b809149be20c637b51036002f4ad1b82d49991c92718b8346053a9107b2d0f0a8e2ac4522e15a3c202cbbf

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    0d0bc0a1ec9ea554cf82a8b86f8d310c

    SHA1

    ff9d039f769f6c77cc903236946c318b4e72127f

    SHA256

    56b1b08789c1ed50fe2c5f26b304b19be85a23e62e6a3ea41e6475ac329eeef8

    SHA512

    08ad6bc4a480375d33ef474bc544e310152526d7087a9ab2faaff84a1fa44f6656a6d207202ea43b1264bac742726c6af6067d3dd0a3093a5f91b9fbc476566e

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    a572a51547473dfa4424ca4809feb19e

    SHA1

    7055558c38f67adc3dd341b855d365f043ef1541

    SHA256

    fbcf262b67d899ac2838ab5322e89715f9d87fb2523bbe5c274d55c3020992ef

    SHA512

    7337fa4bd140b7a00093a8859dba8ab241c1a658f7df0881ecae085ca58ff5701df4c61d926fe68770a4dce7d5c307bfa3768b9eba978eb14f4436e08915e16d

  • /data/misc/profiles/cur/0/insure.cable.estate/primary.prof

    Filesize

    2KB

    MD5

    952a291f3aa467ffed69500f5a4802a4

    SHA1

    96ed1c235da9f4f61fd5c8171bf603fbab7259f0

    SHA256

    eb4ede1c16d542e28a6a2b3a6c238b53094a35394a3eac0abb6469415d32714f

    SHA512

    11b796cfd2b4648226282b3b83282cf3a8f32afc00c5f7949f9a0c41a486746a4066fb7742d430d51e892e6a04ebd3121b8acab5606c0348e2f2b16d860fb07f

  • /data/misc/profiles/cur/0/insure.cable.estate/primary.prof

    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6