Analysis

  • max time kernel
    48s
  • max time network
    163s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    22-08-2024 20:53

General

  • Target

    HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com.apk

  • Size

    19.8MB

  • MD5

    d9a3a25181c4e14d546b7a12cde29521

  • SHA1

    9f48d6bf76640e5cf64e1397baf357dde3938a87

  • SHA256

    71f44665d167f6c6fb93ebdadb0fc2b1513dd3589c5ecda84591bcba9f6f365f

  • SHA512

    d3da5cc4c4ea29f8bdac7f8199e8c38d7342adcc8908fe0f88dc87a431571178e94e19c08eba448da365aa32981fa12b34bc2c71a1060487d994866bd5a1a032

  • SSDEEP

    393216:DjGJoe37RquDHhFVhytkwrgcY9sNORkooI7wpZOTsAI6s9QfTEn3M14GEIV:nGL7Rq8xAawksNYnJ7wp8rIeE81Zz

Malware Config

Signatures

  • Android SMSWorm payload 1 IoCs
  • SMSWorm

    SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.

  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • insure.cable.estate
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4244

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/insure.cable.estate/.jiagu/classes.dex

    Filesize

    10.6MB

    MD5

    2ad2f7af22c5704deac203184dba10a9

    SHA1

    40d647ba97ee7775841ed7d9845d2ad172e8d77e

    SHA256

    6fc88c27d8f657a8f95dafbd267792f4984448e671aade2a57d2faa1d0c62f16

    SHA512

    38e9c4a9a2837542d8163224fb0bd394db4c31f608b3fd7872d41f08f7035c3fa855bcc86f99e0a0428043cee5cebd161b2c000a7cffc4b2863d03029c497f42

  • /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex

    Filesize

    9.3MB

    MD5

    c379ae1e140a18af67f142a985dbef6d

    SHA1

    91685400fd042026fab6de4e7c9afb3b7a9af6ec

    SHA256

    2862fc1602ff670387097865718eba335a324c4deb379739f188488fe64821dd

    SHA512

    cf4e39bb1f413fecefd523ddf7721938bce185ebcebe01b11d47e08002d87d500bceee4618c04d815b0146df301b0e849b2815875956e7fa918c07f603d9173c

  • /data/data/insure.cable.estate/.jiagu/classes.dex!classes3.dex

    Filesize

    91KB

    MD5

    b237cb71784406e1849399221ca65b83

    SHA1

    a6c230f556bc4ad1573e01537cd7eafa9ad98905

    SHA256

    14d4fc8cdeec7dd19a7fd010ed46037395a9d50ffdb6aaf64ae7f650c9ea8ebe

    SHA512

    6e3ab92c119129c2404ce079746cf423ea5fed2c64e7efb974f3517eaef16d85bc99e4c79c3058832a29aae46cb2b9fcf622618fc7122f8577b1b062ba29d0f2

  • /data/data/insure.cable.estate/.jiagu/libjiagu.so

    Filesize

    730KB

    MD5

    9c09b44d28dc9ef1dd810747820b0348

    SHA1

    55b89c9ef314df3da3b350ab13bfbcf514a84041

    SHA256

    2d969529ce8391a2088e4cdbc642bb7a8438e645b2563ba44b47fae6a6639a1e

    SHA512

    dfc0a654653b55abf989249b2eefe3b014a71e8501ed7d9cb56d27a23523601f0be823369072b7a1972638ab894418b7eb69ea0a4a46d14169f49f75be60978a

  • /data/data/insure.cable.estate/databases/StartApp-d6864f2502af7851-journal

    Filesize

    512B

    MD5

    818f531023e82a90600867130f5b49a0

    SHA1

    96dffb296c9bde8b2124ae3c3030c68aeb64a383

    SHA256

    edbdf6d1849282cce9e7f1e32fa70d70c7bf24802d765cdc9a421be6a3a36695

    SHA512

    4e8f04eb3383087e34d9a64fc66e441648cdc4f2ca8c384f33d3037abf856529ab14cbf7805d683d5db363f55dec9d4c2ab37a5291266fec8dec33c1c9dd951c

  • /data/data/insure.cable.estate/databases/StartApp-d6864f2502af7851-wal

    Filesize

    40KB

    MD5

    56efa313ae183aa364a941c8a46aa950

    SHA1

    e751caed003d06485611ef36dc87c7296cb155c5

    SHA256

    33ae3a6ac1209dd18170ffeac43c9b50b5e994e10a5dc2dd62106b10e687135f

    SHA512

    523a4e3514e2f47832d8a53ae90377eba35ce05091aed15f2fedcd04af6ff3d005d382a51ab487831f17fc3ac2bcbee5253dc0df47a74b8625026fabe91b4ef9

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    da82382fff143453aa6c1e8bd83e3f12

    SHA1

    d44b45f38e3316fa139268641379f5e2a77ea38b

    SHA256

    6451a8eb6508c406ee5df74cf96e469577e18f71edfef4f2d714a755e9699595

    SHA512

    7b27c2f186ebdece4e45815737422b5a4fbdcd00e33301e0cecdd430f6a38da8d20acbd148013c4685076d0ccd95c5e79f31d9f8b737ece7c4baaa58256615e1

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-wal

    Filesize

    68KB

    MD5

    f7aef4b61fd712f00a1b9a5c94791273

    SHA1

    369c66a87436d349a4578813a5386c1987e75406

    SHA256

    c1d2c26cc0cbb9f47213d5115b4f8dd8fee5724e1be257c0d48b08d54e4d372a

    SHA512

    aeb745a4bbed3755203c52330b93a30861bc16b2872fd07635c2a64d515fe192790ff8e2581ff2c721d382bd245a49ed1ebee81d5604def5ddb036d1267776ac

  • /data/data/insure.cable.estate/databases/google_analytics_v4.db-journal

    Filesize

    512B

    MD5

    049f6a5acb6fab5f90620dbee36717e5

    SHA1

    e7b7ae2f95c5bc9599eaa0bac41e8619e0451ba8

    SHA256

    cbbbbd0431360823936e8ce325559687e06374d6cbdc08775a7875e3802cce07

    SHA512

    fc0a3b7be7e0344eeb25313e37757a0c4a5fe6ff2d62edf680e4d9fc4e3da3f5cd204cc9e97102c2677ab30ac7a717264a805d226ee782a898476fc2a704469a

  • /data/data/insure.cable.estate/databases/google_analytics_v4.db-wal

    Filesize

    84KB

    MD5

    e1c013a6a3615aa09075a387657e9aab

    SHA1

    0cb720996bd8e6b41d9e86da5cd06fea7ccd5482

    SHA256

    a0877a09a281bb0069723bb221b3a6001d176b03a9380059427bd621be2bd671

    SHA512

    2971ba98661fc40db8dd9feddd1ef8ca92f2a4c5b5bb577d009b062812f83efa06c74e770c5eb42a07defcd4ef821e2ad5be3cc504628e97a9ebe1ff9d028721

  • /data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/com.crashlytics.settings.json

    Filesize

    715B

    MD5

    c1b44cb0f2c50075a7da13e18f65e0c5

    SHA1

    33e762a1db233afa707fd2d6f6b9840d199c4d95

    SHA256

    fad432c56fff8995602cd49947eba05d4e8d70dbc3115cc0d10efc32d172ed09

    SHA512

    0dd238540f94ba511e29509558b3f29385168c410cf5cd7e5e34a6778edca855000c8b97b79ed74a8efcd4d01ead157723cf86dbe1f57524310851a1368ff61a

  • /data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/open-sessions/66C7A565032A00011094102952572B21/report

    Filesize

    798B

    MD5

    c2671bba947c95fcf695baf77bbe3a7f

    SHA1

    2737dc21d4309b61d64c835e94ae98313f95b7bc

    SHA256

    31c868611c85b7fc132f4b7750f3a063452295a2c13ba0b4a786daafc2cf26cc

    SHA512

    5e49c75ccd76b1822a561a62142836154aff6405c4ca2d62f437ed0ae2c1dc5b3a62605b4329dbd369aa4aa788f80069bc846a277539fccd8ba207a891a3d538

  • /data/data/insure.cable.estate/files/PersistedInstallation6651437182701998693tmp

    Filesize

    90B

    MD5

    ad5a2629ca4c49313876bd844283f071

    SHA1

    5028ec5a8a16183094ff8411a30cb9a4b83b3615

    SHA256

    0545467415398a7f52e0a6f91c65dbeba4c9fc6553bf5f0d544dc897aca92ec7

    SHA512

    1f661675319ee70825a77b798e9c4a007d160cef4576658b067721e576367369013eb12f98ccc420a170b2ff8d6bcd8fd432610c0315486fdcbf735326fb6c95

  • /data/data/insure.cable.estate/files/PersistedInstallation7219136177259592910tmp

    Filesize

    566B

    MD5

    339e2bacdfda86c9e3450b7e5f934a33

    SHA1

    f2bd4c6ff5572228f4fb2a22a12a49300b113dbb

    SHA256

    0a9580a80285aea549c3397e4410bb4d47d8aa25a666729b203616a4372e9e2d

    SHA512

    fc40f899adace8f47e327d92d81f5ae3b2d48d9b39750e4cdebc8f7202f3900ca7ef31f7dfe3e356f9067366247b057e42e2bc5e24012e92fadca9ac24c07340

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    33B

    MD5

    35b51faac8b5af3886e70bb5a885dab1

    SHA1

    e6cb282da46cd4bf113e25c8573268578dcd11b6

    SHA256

    af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b

    SHA512

    6ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    75B

    MD5

    944e6a5a08cb971370c65c06061f0ab4

    SHA1

    84d47725cc29bf167b782c702575bce4bf2ecc5b

    SHA256

    ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab

    SHA512

    bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    121B

    MD5

    ffcbf87665a36fc21782400bd0537e79

    SHA1

    3dbfbdbfdcde953317b089f9a9fa0bbe50c698ee

    SHA256

    a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d

    SHA512

    7f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    163B

    MD5

    dcf7d6c1cfd5e7b56074e3001577c78b

    SHA1

    b8eba89aee9f6688ecda6675ef8ff4998da0b141

    SHA256

    ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91

    SHA512

    42d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    212B

    MD5

    a23f78f02a129cf28366a5fc485db22c

    SHA1

    6f4347851f50f5dd6a3439fcce852b279c65db5e

    SHA256

    d5acf68d9047478d03ae04389387a6624886fa9abe19188be2d81a7bc03dcfa1

    SHA512

    3b255e373732615ef1c876790bf3adf192682069301e184c36ecd9a4529088211ae3da0044e8218d67a2e9f2b0d3fa76e40bc1f1b33b224afa0f2d9a678af984

  • /data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_defaults.json

    Filesize

    128B

    MD5

    7a845c35ee49d2391daa9795ee60001c

    SHA1

    70748279b9220aa33d412ebf4c112c5ef9e04346

    SHA256

    b4837f5556a74af96fbf68913e70f7011d54e8c8ceb75db2830ad737264f1755

    SHA512

    040139f518e44547886d2c4be50baf6f92dd28d000cbd9fdaf86bbca50cb1f60e75967ee4631dba3a1e8e1617ced72611c78b9fc24644c41cce927616c9756b2

  • /data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_fetch.json

    Filesize

    366B

    MD5

    e829a73d975b6eb43bd683da4e345e31

    SHA1

    b2597395642da4398f755a95162072d422689515

    SHA256

    17d0b7266e0f188faa6e3954e755c11508151f26a1388062b1d05cf5555754b1

    SHA512

    55540356153c94b2d9fdbe88885bb3dac9fceedfcbea536cccc001041470111e99e2d75d9ac8219daeb8e2a25d155139b017f28c0775080fc2610c39abd30e2d

  • /data/data/insure.cable.estate/files/gaClientId

    Filesize

    36B

    MD5

    4cda3bfb77989caab61297b8d647b200

    SHA1

    8a84f11783f9ecd4f3c406f0fc4a6e4df5c1adcd

    SHA256

    eb89ca263b8afd9524f75c84e9a2a6e868584d871d020bb4fcdacfb4a4b693e4

    SHA512

    e48b2c9cc68a2d6fa98e64870e07bb6515e06e750d74f2f4b0e90129cad43295243a7cdf3e2675d21251bcfe94aa18e0cb9d3618af9662a396307ba61eac681e

  • /data/data/insure.cable.estate/files/profileInstalled

    Filesize

    24B

    MD5

    cb46cc8d25d677f117bd3f3c8ac769e5

    SHA1

    fcdcdedc3b11c5836c15197fed047b2c2af4bafd

    SHA256

    309839dfad233c94546d1f6dcd652a635efecf0cbf33f59b5cc4359ea37db9e0

    SHA512

    5384264c418c008ec4e4b7f3c084c68a00b459bc4b0474866aa1f4dd47c6b88e0284b9ae354306d2041bd65ab248a54fc81b89d2b44b748f650d3049c6573467

  • /data/data/insure.cable.estate/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    1b284da6f61cf18b667dc1ed93cde3ee

    SHA1

    a0f2f30c1f70f9cc0c8d292bb79979488c6c3038

    SHA256

    03bbedc84884983a3535b65f3fabfee79ee492a18bd8046cacd8fc0e9b2d1dfb

    SHA512

    51520005fc8d4ae57554773906f6d28863cebb84e8da7344ea513ace1c380469f3c4b2b39e33f6e2d1259d0946099bba875317434334fb02e7dcec2f2e85a3f0

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    b090f02b45c88b9119d491649947f36a

    SHA1

    807a348b4b61ed186015d73d763b0592632e1784

    SHA256

    1336becbb300abe29657c9136a8a0b8e6891057985de99d8a72e82292f5133ae

    SHA512

    c965ccd9c84b008ade941aededb4cc430076786259f3bd8e35f0af29abb5d4475f380315fdf496f07a5130d3c2468c9e67676f5df761412b4c7a9d79091909ca

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    c6599c0f886f0e888e5472ddd408cce0

    SHA1

    6143e959f40a2e6b384af7ec0373b59c65b05aa9

    SHA256

    fac514767c62dd658b95b1fd682b6630d63f8f0d6553a46c47d46bc4d13336c1

    SHA512

    fa624aca8a9f7e3e060866c5690df567874e4551ba9bd8d0a4a72ac46070b8f1dc1021259c71bbb228f6961b334a823b7a1d3eb8f6e73b3bde8952cf7e0852f2

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    d3eb3aede2bd7263d0b03210ae010766

    SHA1

    fc0531eef84eadd710939d7b7d1716d525446e61

    SHA256

    bb379e01976c5a4f26486fe82473161faff94043ca542be89ebee76bb25e0dd0

    SHA512

    8ead5691b6fc30d2fc17ff8a13b170b2f84870bb8740d5bbbd44ab102324b05a085fd354e6a9cfdc6b2fbe34f41f681070819cb7c03e337ffee46f3032c0811e

  • /data/misc/profiles/cur/0/insure.cable.estate/primary.prof

    Filesize

    3KB

    MD5

    625b7bfb0a95c22350563afe7a989652

    SHA1

    6d0712f223459406ea3506e170ef40bf0e81534c

    SHA256

    db5e33341082e7e75cb5b0a8ba2a8589652a4dbca5a11b6210294478ad774402

    SHA512

    81e56e1a026441bcb9d1072b55539f62de79ed486a4f89019b801c8eb79f969dcada2665eb16cc415c58e4993ddb306e146de9f3ae8d76d52fdc7b4f5ebb093f

  • /data/misc/profiles/cur/0/insure.cable.estate/primary.prof

    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6