Analysis
-
max time kernel
49s -
max time network
165s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
22-08-2024 20:54
Static task
static1
Behavioral task
behavioral1
Sample
HD_STREAMZ_Latest_03-Jul.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
HD_STREAMZ_Latest_03-Jul.apk
Resource
android-x64-20240624-en
General
-
Target
HD_STREAMZ_Latest_03-Jul.apk
-
Size
19.2MB
-
MD5
47f9616a2bc5cbf6403e49b80d8bc22f
-
SHA1
5403978c89bd0d8203b5fd471e0dd4336cae7342
-
SHA256
364359495b38102bb781fe9ea2b0a4c2f80453bb42f52ee81bfd1ebeb020c4df
-
SHA512
635f7ce656ae61dbd375baea5ef5d19c48c70986397bf3f79489f1ddeb9facbe3be37a86a228b02700b7c72bc6943ed73906f3bac8e97c5a82fb2c9fd8eae5d2
-
SSDEEP
393216:QB51Df5gEeI8w9Fm74Su2AI6s3ny5fTIEXF7M2A:QBvVgmU4S8I8IR2A
Malware Config
Signatures
-
Android SMSWorm payload 1 IoCs
resource yara_rule behavioral1/memory/4256-1.dex family_smsworm -
SMSWorm
SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.
-
Checks if the Android device is rooted. 1 TTPs 9 IoCs
ioc Process /system/app/Superuser.apk insure.cable.estate /system/xbin/su insure.cable.estate /data/local/su insure.cable.estate /data/local/bin/su insure.cable.estate /sbin/su insure.cable.estate /system/bin/failsafe/su insure.cable.estate /data/local/xbin/su insure.cable.estate /system/bin/su insure.cable.estate /system/sd/xbin/su insure.cable.estate -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/qemu_pipe insure.cable.estate /dev/socket/qemud insure.cable.estate -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/insure.cable.estate/.jiagu/classes.dex 4256 insure.cable.estate /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex 4256 insure.cable.estate /data/data/insure.cable.estate/.jiagu/classes.dex!classes3.dex 4256 insure.cable.estate -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses insure.cable.estate -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock insure.cable.estate -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
description ioc Process Framework service call android.app.IActivityManager.setServiceForeground insure.cable.estate -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo insure.cable.estate -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver insure.cable.estate -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo insure.cable.estate -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo insure.cable.estate
Processes
-
insure.cable.estate1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4256
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.5MB
MD5333810e89b9f11c61814e7002bd516d2
SHA1e310f730138361b43ff7b2d87f73ef5a14cbc352
SHA256f2f3f53e9ccfc80488522d058616bbda20dc2d61af1f6741811c9b9aa301381a
SHA51292b9f8811cb797e2cd3286073578ec54d4a197bed4c97bcb8463dd3d75157f544e13b777bcf6ce4889b54c0b4400f341058d8a316c8bbf725980890ff1ae5403
-
Filesize
9.4MB
MD5dbabf3dc633ae99e69800dda56816b19
SHA1f92b3cf91be7846570e09cfd0e35f49ac020e435
SHA256a6ff7ff2d2aff124c7506da18c79e43456a84d762914c01bf9f47d1f904a9eff
SHA512ed33bfa82b539c548e41b60075b4c6dd47517df952ab170cd287aa8629a36fd3d952765b8357a5763afcb6e80ca3f90e0fef6674c98c2bd75bbf11560fa98311
-
Filesize
91KB
MD54d69ce4197defcccd9d3f66c521403ae
SHA19de024d239a3ec19fa9c3f687a0714e8f6bf7c88
SHA256dc41313777a66539c3ec52e4b26bf997888cd08bbe2c1dfd2ba734f9d4d2196e
SHA512327b927055a866b4e5cb56f1dd206ea0539a3b5ae45b5ef5e1f77e387bea8f45395eecb3d1ffc0ca6fadf4aed4c08b95be75d266bfc529dceb93c622f9bae388
-
Filesize
733KB
MD50b559e54cc4d58d8d894041ac77d6b1a
SHA19f0a75b91ca3fbfad63482276e0af1d6f5f1f13e
SHA256b8af0ca3197da1c1e9d8a3a9c60ac53dccf83f975a60b6591007d0a3b3abfc18
SHA5128cad681faa9c85e1c954c1b892cc3c4eb417cc70c930926b5b3c6af190789f8b06d16d1427e4daa6ad0c406df7dfa2de9246d0466229d91c2143e4ddf3f9af08
-
Filesize
512B
MD5be670d89e8126cacb6c626635b9c2011
SHA1059d9c144b08419a394a033c1ed5b42e74191b00
SHA256373108cc5aa3dffbf9a5a49bf9c743f7db86909cfe948fd16df9ff20c84d9863
SHA5129ab1e45c0113917b794c6b69170905a6fc7b85461c7513ffa2d9d4f9d59bd7d8e03097d7b3ccd0631697b62ab6653ae9128f1f3b49a8f491e2334ab625cf6f08
-
Filesize
40KB
MD533963a3dbd49de2f741c4f2edc955a64
SHA11b3a4f8e0ee70ae23f3d1fc352ab7977a8f621cf
SHA256f0895b40ac1dab8b24bb4860a705be2743bb29bb63949af105872b6004272bce
SHA5127877a26bb756f213c3a16704b818dcff5d15ad068c31bffe01f0e6fd3f66e7379aaf32e2f8435b08abe5cc51ee9fff5756aa521a275f42710a345f02806cbf3e
-
Filesize
512B
MD5862e5d1a21d90ed49827a7f0ddaea9cc
SHA1be9594ad2b893af4b6f797abc5af0768c85929b8
SHA2566314abbefe046522646df2860f7f02fdce88ee705ca2a9612089c009412072c0
SHA512e43ab86aa5c01cb4a553da0cec609234346fd1456b27262eedea35f306e413d1b680c3752b3fe46ccb698b672c06e78fec86b49c616333761abaccfa4606a89a
-
Filesize
16KB
MD582840acbdb30e424fb742edc88e06a0b
SHA151bae5077dce20ba6f396cd9b44effddde251355
SHA256ad082aa12c658b2576befab5ec029a42ddf796f1cf92598f258872505ce74402
SHA512ff42f6f6799ea96c20137cf12ec2e55005ea85d1f47f66d9e47ac485ae3b9b984f04816656030377b1e2615576644bee8033ba5cdd53eaeb0fa27eada93dfbdd
-
Filesize
44KB
MD53f01a42dc51bf0d0010e83428b99b34b
SHA133881189d21007f5cb18efe81861d8d2a2c5c8d6
SHA2563f6a6d0ed64382f8023dff490a3cf768a02bd1d49468955d758562eca545ffc7
SHA5121463b736ab9653f31166e6a7ed8aa442595c9eec63816a6f556802756fa2d6118b32ac853123f4373f778ed537b3b23bd468aaeba7f69b47346847b1bf3b2d18
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5e99cc433de1b3794a0c0ff9e57ab20e4
SHA1155e7efb98649fb454e1c00066a09b073c4f6611
SHA256b3378b9a62f276b91804d45e4ba49d3aa1cf6b6db4926da9b0b56933cc77a645
SHA5126463ca965696d40b13b897ace044a4b1fbd9cbd4de35387fe1ee21541dc0fef9069c2530752b0ed8087ff5c64652a7c7f716aa1374f3dcf32012caa30da991bc
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD5c8cd3a94cb183a588586b1c41503c3a5
SHA19be4b3068a8e9623fcf18881ca5d853801f55bdd
SHA256198c6fde4b70655e5bf5ecce538fc5fc34f09af34251d551520f10972f906773
SHA512221ab4e63a6bd45dd922519879577ce0a28c6299c9a850280a851fd3fb5fb0dd5bcd6b9017bd2e33d1438dd0f595735db31c6181de9543f898269c48141c1c3b
-
Filesize
512B
MD51973732720123d78dc55e7b0de4e3e35
SHA168924436a11b14966c874ff00f18bfea4e034844
SHA256dd595d136336d692836c68c10128f006968c17f52abc3e5b3ea9d58d7315f737
SHA512192332a606c0c5203573937f7216486d858e7deab300cd6844127d588c7e9f7a161b92315f5c830d05ad6dc7e59273c406e8837302204f2835b84c23c86f5fc4
-
Filesize
84KB
MD5df2096bc906f334edc9f39734c43a80c
SHA16f0dd108151aa202b51cd1f9055a5245e4699726
SHA256da1d13bbba45635ce6a7b59565d82d5955e80892d4f8fe04c183d1fcd7b09a43
SHA51212c85f46d43296f134597f4f83f00baabf27281cf5095eee6b1d9479a317a6abcdc724136e7662429809623dd1fbdc8f601eba00327a7e7d21d0ab446485d9c1
-
/data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/com.crashlytics.settings.json
Filesize715B
MD54a62c29fddf3afaf11ff81668ed5a6bd
SHA1303c7dcf07b0655ba300d5e7bac32f5b1cb04070
SHA256d619687ad2cff38a3365b09ff8706789b2624cde229e2e8455d63c9d975cda52
SHA512df13ca04e27f39131c71ebd68d9169f3acdb7b53ea8993177fad5c47b3d944b506410465c5adef0c76f3051fd9c0886ca35a6dc3fae2c4a82bc525beef70875b
-
/data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/open-sessions/66C7A5A600B1000110A07B8BC82503F7/report
Filesize798B
MD5adafb3259f8d37cc3dbf1cfdfd93b56c
SHA13d03de7abcfce768bd3dbfc0156ad4b3266d4606
SHA256801075a057a9ca96a6bf40b69baa46bd77a8958bdd41fc79afe751dd83c74e1b
SHA51298ccd15aabe98cac1a0a70fc749752f6eb789bd43f13f394c8dea94a693895f1356b17addd7ff91e8b59230e727e6712fa6091e5130ff04659ec4f4ffad86184
-
Filesize
90B
MD5a99e12f023596af35b005d1fc44a52f4
SHA1330038465090acb8a105ec7594f67ec65fb3e8eb
SHA25611fe8cdfb4d45c324d974959f08607d78be010762891035dfa0b1e74b77ff032
SHA512758b1a0b47eb91e8c916a8bd6db723e6f0ca14525a8323e624c8be63f03d7cdcbea657f9c815a0c811ad02ec3571cb27f8780999137c2db44a9f47026e4622a7
-
Filesize
567B
MD5831001d173fdaa7cb255194dd3df4fdc
SHA1fc4e6e69ac992525e64b80b48097371eeaf832e6
SHA256f0ed15064d22dacf1aa937961d589fc86e6639248c295ec79b9b645af79b7f3b
SHA51228b9232c29109b3ff94862c160c15b8367d7dc3a6ea33ba43434d8d771edffe01a78cceebc01bd4881d804363364ef51ac19d57f8d3e2caf2266f83b3e778f53
-
Filesize
33B
MD535b51faac8b5af3886e70bb5a885dab1
SHA1e6cb282da46cd4bf113e25c8573268578dcd11b6
SHA256af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b
SHA5126ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa
-
Filesize
75B
MD5944e6a5a08cb971370c65c06061f0ab4
SHA184d47725cc29bf167b782c702575bce4bf2ecc5b
SHA256ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab
SHA512bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783
-
Filesize
121B
MD5ffcbf87665a36fc21782400bd0537e79
SHA13dbfbdbfdcde953317b089f9a9fa0bbe50c698ee
SHA256a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d
SHA5127f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57
-
Filesize
163B
MD5dcf7d6c1cfd5e7b56074e3001577c78b
SHA1b8eba89aee9f6688ecda6675ef8ff4998da0b141
SHA256ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91
SHA51242d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d
-
Filesize
212B
MD543abf67f2062e62dc52539e7abd0d4d3
SHA11cb3925baffb735c314c77b2aab4590f781bda8d
SHA2562eaf4dce58dadd26a477ea69ff79bd505b3f6c910f240d5f300bd01b670a205f
SHA512addaa33162b53d3bc8c2a6ae6bf7d54c5e382be4bca630534d5b69391d2dd292905d72caa38a3e29f6acc873840e96681a32be28d4f0f3948fc29ab8bc5d6e71
-
/data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_defaults.json
Filesize128B
MD57a845c35ee49d2391daa9795ee60001c
SHA170748279b9220aa33d412ebf4c112c5ef9e04346
SHA256b4837f5556a74af96fbf68913e70f7011d54e8c8ceb75db2830ad737264f1755
SHA512040139f518e44547886d2c4be50baf6f92dd28d000cbd9fdaf86bbca50cb1f60e75967ee4631dba3a1e8e1617ced72611c78b9fc24644c41cce927616c9756b2
-
/data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_fetch.json
Filesize366B
MD5f1e8fb0e162de1c958d44438b51d7dec
SHA1a4afec5cd6bc8a1be165735c9fa297349b48a909
SHA25654440a5d2a9d75f6ccdce8d5f27964fd29603869a8181dee10c91a3ae3d9aab6
SHA512dfe3a1fe03971f5a12c27b676f700fce737a5a20db618f3522fbb6a7ab7c71d9af4570a218cba460559dbc46cac8d1df718d1869c0bf97a0f9d94b63076eb84e
-
Filesize
36B
MD597c062feb7174923ebc6b954784f3047
SHA12845bbc3fcfa7533099df7280b11e65849037bd1
SHA2560969f1500da16b1f1bbde079f7484cbcb61839abdb989cfa3560287ec41318b0
SHA512febbbf266b598275a5d548aa144a27f5bfcb2817d40087c3e60f6440a5f1c7ceaaf1d561792056720340d0031a6daf8de60991076cae0e36576f375e49008c08
-
Filesize
24B
MD5fbcc084efc8cbde99fa02b21cc555cc2
SHA197127482e5dab0da155f003b3f662329a25b331d
SHA256cf62f2539a28f7c282649dc1fd35d7e7d77b26d3d6990e3ea66ea83ee4d39eea
SHA512d412c717d7ac2152c097dbdda9cf513c275498e0d116441e1ccd1ef594ddf691088a865ca2b486c05381f905d9ebbff48d409901f0ef4cde282efea1db4af8af
-
Filesize
8B
MD52709db24fa14ee18df7b1888b34dfad3
SHA15d56d2c5df475933c733179f5023112949c67299
SHA256efb784562dab1307acd9333ad63c1cafc4794a513684905c7863510868e2fa5b
SHA512e06f5fb1c1741b661bbc13981d278af1de4a667c1e7d941a1d229fe306f0ab8511e71497723ca1dd51d5677bb4d4c893cea5225ac253ce50ff2338a2009b4046
-
Filesize
512B
MD5289c265ca8dada9207518d96973dd96e
SHA12e2b4e2ffbd2d283de36b8d75657b0b24e4eb6ec
SHA256ad52790d2190864ee1fab975d47b4e25b8c06163f925c96b67b7fdf697dff90b
SHA512f3b21c76fd456642ae4eb479489d102127427d71e3b809149be20c637b51036002f4ad1b82d49991c92718b8346053a9107b2d0f0a8e2ac4522e15a3c202cbbf
-
Filesize
16KB
MD50d0bc0a1ec9ea554cf82a8b86f8d310c
SHA1ff9d039f769f6c77cc903236946c318b4e72127f
SHA25656b1b08789c1ed50fe2c5f26b304b19be85a23e62e6a3ea41e6475ac329eeef8
SHA51208ad6bc4a480375d33ef474bc544e310152526d7087a9ab2faaff84a1fa44f6656a6d207202ea43b1264bac742726c6af6067d3dd0a3093a5f91b9fbc476566e
-
Filesize
108KB
MD5a572a51547473dfa4424ca4809feb19e
SHA17055558c38f67adc3dd341b855d365f043ef1541
SHA256fbcf262b67d899ac2838ab5322e89715f9d87fb2523bbe5c274d55c3020992ef
SHA5127337fa4bd140b7a00093a8859dba8ab241c1a658f7df0881ecae085ca58ff5701df4c61d926fe68770a4dce7d5c307bfa3768b9eba978eb14f4436e08915e16d
-
Filesize
2KB
MD5952a291f3aa467ffed69500f5a4802a4
SHA196ed1c235da9f4f61fd5c8171bf603fbab7259f0
SHA256eb4ede1c16d542e28a6a2b3a6c238b53094a35394a3eac0abb6469415d32714f
SHA51211b796cfd2b4648226282b3b83282cf3a8f32afc00c5f7949f9a0c41a486746a4066fb7742d430d51e892e6a04ebd3121b8acab5606c0348e2f2b16d860fb07f
-
Filesize
25B
MD5b9d9e0f8902d129e1aeebff0ae7b725b
SHA1cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781
SHA25625a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91
SHA512f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6