Analysis
-
max time kernel
48s -
max time network
163s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
22-08-2024 20:53
Static task
static1
Behavioral task
behavioral1
Sample
HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com.apk
Resource
android-x64-20240624-en
General
-
Target
HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com.apk
-
Size
19.8MB
-
MD5
d9a3a25181c4e14d546b7a12cde29521
-
SHA1
9f48d6bf76640e5cf64e1397baf357dde3938a87
-
SHA256
71f44665d167f6c6fb93ebdadb0fc2b1513dd3589c5ecda84591bcba9f6f365f
-
SHA512
d3da5cc4c4ea29f8bdac7f8199e8c38d7342adcc8908fe0f88dc87a431571178e94e19c08eba448da365aa32981fa12b34bc2c71a1060487d994866bd5a1a032
-
SSDEEP
393216:DjGJoe37RquDHhFVhytkwrgcY9sNORkooI7wpZOTsAI6s9QfTEn3M14GEIV:nGL7Rq8xAawksNYnJ7wp8rIeE81Zz
Malware Config
Signatures
-
Android SMSWorm payload 1 IoCs
Processes:
resource yara_rule /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex family_smsworm -
SMSWorm
SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.
-
Checks if the Android device is rooted. 1 TTPs 9 IoCs
Processes:
insure.cable.estateioc process /system/sd/xbin/su insure.cable.estate /system/app/Superuser.apk insure.cable.estate /data/local/bin/su insure.cable.estate /data/local/xbin/su insure.cable.estate /sbin/su insure.cable.estate /system/bin/su insure.cable.estate /system/xbin/su insure.cable.estate /data/local/su insure.cable.estate /system/bin/failsafe/su insure.cable.estate -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
insure.cable.estateioc process /dev/socket/qemud insure.cable.estate /dev/qemu_pipe insure.cable.estate -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
insure.cable.estateioc pid process /data/data/insure.cable.estate/.jiagu/classes.dex 4244 insure.cable.estate /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex 4244 insure.cable.estate /data/data/insure.cable.estate/.jiagu/classes.dex!classes3.dex 4244 insure.cable.estate -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
insure.cable.estatedescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses insure.cable.estate -
Acquires the wake lock 1 IoCs
Processes:
insure.cable.estatedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock insure.cable.estate -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
insure.cable.estatedescription ioc process Framework service call android.app.IActivityManager.setServiceForeground insure.cable.estate -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo insure.cable.estate -
Reads information about phone network operator. 1 TTPs
-
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process Framework service call android.app.IActivityManager.registerReceiver insure.cable.estate -
Checks CPU information 2 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process File opened for read /proc/cpuinfo insure.cable.estate -
Checks memory information 2 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process File opened for read /proc/meminfo insure.cable.estate
Processes
-
insure.cable.estate1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4244
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
MD52ad2f7af22c5704deac203184dba10a9
SHA140d647ba97ee7775841ed7d9845d2ad172e8d77e
SHA2566fc88c27d8f657a8f95dafbd267792f4984448e671aade2a57d2faa1d0c62f16
SHA51238e9c4a9a2837542d8163224fb0bd394db4c31f608b3fd7872d41f08f7035c3fa855bcc86f99e0a0428043cee5cebd161b2c000a7cffc4b2863d03029c497f42
-
Filesize
9.3MB
MD5c379ae1e140a18af67f142a985dbef6d
SHA191685400fd042026fab6de4e7c9afb3b7a9af6ec
SHA2562862fc1602ff670387097865718eba335a324c4deb379739f188488fe64821dd
SHA512cf4e39bb1f413fecefd523ddf7721938bce185ebcebe01b11d47e08002d87d500bceee4618c04d815b0146df301b0e849b2815875956e7fa918c07f603d9173c
-
Filesize
91KB
MD5b237cb71784406e1849399221ca65b83
SHA1a6c230f556bc4ad1573e01537cd7eafa9ad98905
SHA25614d4fc8cdeec7dd19a7fd010ed46037395a9d50ffdb6aaf64ae7f650c9ea8ebe
SHA5126e3ab92c119129c2404ce079746cf423ea5fed2c64e7efb974f3517eaef16d85bc99e4c79c3058832a29aae46cb2b9fcf622618fc7122f8577b1b062ba29d0f2
-
Filesize
730KB
MD59c09b44d28dc9ef1dd810747820b0348
SHA155b89c9ef314df3da3b350ab13bfbcf514a84041
SHA2562d969529ce8391a2088e4cdbc642bb7a8438e645b2563ba44b47fae6a6639a1e
SHA512dfc0a654653b55abf989249b2eefe3b014a71e8501ed7d9cb56d27a23523601f0be823369072b7a1972638ab894418b7eb69ea0a4a46d14169f49f75be60978a
-
Filesize
512B
MD5818f531023e82a90600867130f5b49a0
SHA196dffb296c9bde8b2124ae3c3030c68aeb64a383
SHA256edbdf6d1849282cce9e7f1e32fa70d70c7bf24802d765cdc9a421be6a3a36695
SHA5124e8f04eb3383087e34d9a64fc66e441648cdc4f2ca8c384f33d3037abf856529ab14cbf7805d683d5db363f55dec9d4c2ab37a5291266fec8dec33c1c9dd951c
-
Filesize
40KB
MD556efa313ae183aa364a941c8a46aa950
SHA1e751caed003d06485611ef36dc87c7296cb155c5
SHA25633ae3a6ac1209dd18170ffeac43c9b50b5e994e10a5dc2dd62106b10e687135f
SHA512523a4e3514e2f47832d8a53ae90377eba35ce05091aed15f2fedcd04af6ff3d005d382a51ab487831f17fc3ac2bcbee5253dc0df47a74b8625026fabe91b4ef9
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5da82382fff143453aa6c1e8bd83e3f12
SHA1d44b45f38e3316fa139268641379f5e2a77ea38b
SHA2566451a8eb6508c406ee5df74cf96e469577e18f71edfef4f2d714a755e9699595
SHA5127b27c2f186ebdece4e45815737422b5a4fbdcd00e33301e0cecdd430f6a38da8d20acbd148013c4685076d0ccd95c5e79f31d9f8b737ece7c4baaa58256615e1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD5f7aef4b61fd712f00a1b9a5c94791273
SHA1369c66a87436d349a4578813a5386c1987e75406
SHA256c1d2c26cc0cbb9f47213d5115b4f8dd8fee5724e1be257c0d48b08d54e4d372a
SHA512aeb745a4bbed3755203c52330b93a30861bc16b2872fd07635c2a64d515fe192790ff8e2581ff2c721d382bd245a49ed1ebee81d5604def5ddb036d1267776ac
-
Filesize
512B
MD5049f6a5acb6fab5f90620dbee36717e5
SHA1e7b7ae2f95c5bc9599eaa0bac41e8619e0451ba8
SHA256cbbbbd0431360823936e8ce325559687e06374d6cbdc08775a7875e3802cce07
SHA512fc0a3b7be7e0344eeb25313e37757a0c4a5fe6ff2d62edf680e4d9fc4e3da3f5cd204cc9e97102c2677ab30ac7a717264a805d226ee782a898476fc2a704469a
-
Filesize
84KB
MD5e1c013a6a3615aa09075a387657e9aab
SHA10cb720996bd8e6b41d9e86da5cd06fea7ccd5482
SHA256a0877a09a281bb0069723bb221b3a6001d176b03a9380059427bd621be2bd671
SHA5122971ba98661fc40db8dd9feddd1ef8ca92f2a4c5b5bb577d009b062812f83efa06c74e770c5eb42a07defcd4ef821e2ad5be3cc504628e97a9ebe1ff9d028721
-
/data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/com.crashlytics.settings.json
Filesize715B
MD5c1b44cb0f2c50075a7da13e18f65e0c5
SHA133e762a1db233afa707fd2d6f6b9840d199c4d95
SHA256fad432c56fff8995602cd49947eba05d4e8d70dbc3115cc0d10efc32d172ed09
SHA5120dd238540f94ba511e29509558b3f29385168c410cf5cd7e5e34a6778edca855000c8b97b79ed74a8efcd4d01ead157723cf86dbe1f57524310851a1368ff61a
-
/data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/open-sessions/66C7A565032A00011094102952572B21/report
Filesize798B
MD5c2671bba947c95fcf695baf77bbe3a7f
SHA12737dc21d4309b61d64c835e94ae98313f95b7bc
SHA25631c868611c85b7fc132f4b7750f3a063452295a2c13ba0b4a786daafc2cf26cc
SHA5125e49c75ccd76b1822a561a62142836154aff6405c4ca2d62f437ed0ae2c1dc5b3a62605b4329dbd369aa4aa788f80069bc846a277539fccd8ba207a891a3d538
-
Filesize
90B
MD5ad5a2629ca4c49313876bd844283f071
SHA15028ec5a8a16183094ff8411a30cb9a4b83b3615
SHA2560545467415398a7f52e0a6f91c65dbeba4c9fc6553bf5f0d544dc897aca92ec7
SHA5121f661675319ee70825a77b798e9c4a007d160cef4576658b067721e576367369013eb12f98ccc420a170b2ff8d6bcd8fd432610c0315486fdcbf735326fb6c95
-
Filesize
566B
MD5339e2bacdfda86c9e3450b7e5f934a33
SHA1f2bd4c6ff5572228f4fb2a22a12a49300b113dbb
SHA2560a9580a80285aea549c3397e4410bb4d47d8aa25a666729b203616a4372e9e2d
SHA512fc40f899adace8f47e327d92d81f5ae3b2d48d9b39750e4cdebc8f7202f3900ca7ef31f7dfe3e356f9067366247b057e42e2bc5e24012e92fadca9ac24c07340
-
Filesize
33B
MD535b51faac8b5af3886e70bb5a885dab1
SHA1e6cb282da46cd4bf113e25c8573268578dcd11b6
SHA256af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b
SHA5126ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa
-
Filesize
75B
MD5944e6a5a08cb971370c65c06061f0ab4
SHA184d47725cc29bf167b782c702575bce4bf2ecc5b
SHA256ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab
SHA512bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783
-
Filesize
121B
MD5ffcbf87665a36fc21782400bd0537e79
SHA13dbfbdbfdcde953317b089f9a9fa0bbe50c698ee
SHA256a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d
SHA5127f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57
-
Filesize
163B
MD5dcf7d6c1cfd5e7b56074e3001577c78b
SHA1b8eba89aee9f6688ecda6675ef8ff4998da0b141
SHA256ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91
SHA51242d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d
-
Filesize
212B
MD5a23f78f02a129cf28366a5fc485db22c
SHA16f4347851f50f5dd6a3439fcce852b279c65db5e
SHA256d5acf68d9047478d03ae04389387a6624886fa9abe19188be2d81a7bc03dcfa1
SHA5123b255e373732615ef1c876790bf3adf192682069301e184c36ecd9a4529088211ae3da0044e8218d67a2e9f2b0d3fa76e40bc1f1b33b224afa0f2d9a678af984
-
/data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_defaults.json
Filesize128B
MD57a845c35ee49d2391daa9795ee60001c
SHA170748279b9220aa33d412ebf4c112c5ef9e04346
SHA256b4837f5556a74af96fbf68913e70f7011d54e8c8ceb75db2830ad737264f1755
SHA512040139f518e44547886d2c4be50baf6f92dd28d000cbd9fdaf86bbca50cb1f60e75967ee4631dba3a1e8e1617ced72611c78b9fc24644c41cce927616c9756b2
-
/data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_fetch.json
Filesize366B
MD5e829a73d975b6eb43bd683da4e345e31
SHA1b2597395642da4398f755a95162072d422689515
SHA25617d0b7266e0f188faa6e3954e755c11508151f26a1388062b1d05cf5555754b1
SHA51255540356153c94b2d9fdbe88885bb3dac9fceedfcbea536cccc001041470111e99e2d75d9ac8219daeb8e2a25d155139b017f28c0775080fc2610c39abd30e2d
-
Filesize
36B
MD54cda3bfb77989caab61297b8d647b200
SHA18a84f11783f9ecd4f3c406f0fc4a6e4df5c1adcd
SHA256eb89ca263b8afd9524f75c84e9a2a6e868584d871d020bb4fcdacfb4a4b693e4
SHA512e48b2c9cc68a2d6fa98e64870e07bb6515e06e750d74f2f4b0e90129cad43295243a7cdf3e2675d21251bcfe94aa18e0cb9d3618af9662a396307ba61eac681e
-
Filesize
24B
MD5cb46cc8d25d677f117bd3f3c8ac769e5
SHA1fcdcdedc3b11c5836c15197fed047b2c2af4bafd
SHA256309839dfad233c94546d1f6dcd652a635efecf0cbf33f59b5cc4359ea37db9e0
SHA5125384264c418c008ec4e4b7f3c084c68a00b459bc4b0474866aa1f4dd47c6b88e0284b9ae354306d2041bd65ab248a54fc81b89d2b44b748f650d3049c6573467
-
Filesize
8B
MD51b284da6f61cf18b667dc1ed93cde3ee
SHA1a0f2f30c1f70f9cc0c8d292bb79979488c6c3038
SHA25603bbedc84884983a3535b65f3fabfee79ee492a18bd8046cacd8fc0e9b2d1dfb
SHA51251520005fc8d4ae57554773906f6d28863cebb84e8da7344ea513ace1c380469f3c4b2b39e33f6e2d1259d0946099bba875317434334fb02e7dcec2f2e85a3f0
-
Filesize
512B
MD5b090f02b45c88b9119d491649947f36a
SHA1807a348b4b61ed186015d73d763b0592632e1784
SHA2561336becbb300abe29657c9136a8a0b8e6891057985de99d8a72e82292f5133ae
SHA512c965ccd9c84b008ade941aededb4cc430076786259f3bd8e35f0af29abb5d4475f380315fdf496f07a5130d3c2468c9e67676f5df761412b4c7a9d79091909ca
-
Filesize
16KB
MD5c6599c0f886f0e888e5472ddd408cce0
SHA16143e959f40a2e6b384af7ec0373b59c65b05aa9
SHA256fac514767c62dd658b95b1fd682b6630d63f8f0d6553a46c47d46bc4d13336c1
SHA512fa624aca8a9f7e3e060866c5690df567874e4551ba9bd8d0a4a72ac46070b8f1dc1021259c71bbb228f6961b334a823b7a1d3eb8f6e73b3bde8952cf7e0852f2
-
Filesize
108KB
MD5d3eb3aede2bd7263d0b03210ae010766
SHA1fc0531eef84eadd710939d7b7d1716d525446e61
SHA256bb379e01976c5a4f26486fe82473161faff94043ca542be89ebee76bb25e0dd0
SHA5128ead5691b6fc30d2fc17ff8a13b170b2f84870bb8740d5bbbd44ab102324b05a085fd354e6a9cfdc6b2fbe34f41f681070819cb7c03e337ffee46f3032c0811e
-
Filesize
3KB
MD5625b7bfb0a95c22350563afe7a989652
SHA16d0712f223459406ea3506e170ef40bf0e81534c
SHA256db5e33341082e7e75cb5b0a8ba2a8589652a4dbca5a11b6210294478ad774402
SHA51281e56e1a026441bcb9d1072b55539f62de79ed486a4f89019b801c8eb79f969dcada2665eb16cc415c58e4993ddb306e146de9f3ae8d76d52fdc7b4f5ebb093f
-
Filesize
25B
MD5b9d9e0f8902d129e1aeebff0ae7b725b
SHA1cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781
SHA25625a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91
SHA512f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6