2dbcdaa517464d2a1865a412dcaa7d6d87c165c2582ca024c164004af15b41bb

Analysis

max time kernel
179s
max time network
175s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
26-08-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stasdk_core.apk
Size

2.1MB
MD5

e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1

96a86954d989f634798c91523712c34eab06da3d
SHA256

8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
SHA512

e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP

49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw

Score

7^/10

collection discovery evasion impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.dbgj.stacore
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

Requests cell location 2 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

Processes:

com.dbgj.stacore

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore

Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dbgj.stacore
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dbgj.stacore
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.dbgj.stacore

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.dbgj.stacore
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.dbgj.stacore

description ioc process

File opened for read /proc/meminfo com.dbgj.stacore

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.dbgj.stacore

description	ioc	process
File opened for read	/proc/meminfo	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4672

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__3fb9a03a-a37a-4c51-8b92-9b6bc9ce1c06.jar.tmp

Filesize
464KB

MD5
df3e6828db973805bace2935787183ae

SHA1
17a410dc5ac7feddca328f2e11d74b38a8f9a07d

SHA256
44e8016d3f7438c7e533e0b1d74c1083b07e5edcc5c291a50389944e81a3502f

SHA512
fb21eed997566c04b17e3c195751d64f50321633bf1e8c25dfd820bd8338870a32490fb07568632f56693a93b5e9828745f0db9a0af9f3efcb715918de06fad3

Download Submit
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

Filesize
26KB

MD5
c6d50df26fa685310e6d59640ce82184

SHA1
00a1ef171fb7915e9242b214a87111917ae018f3

SHA256
bf0d190a7cb03b69abd0b723dd94a2664b4bd23ed3006ebe38583b554e705766

SHA512
d42fd00fcbbb0045318b01956e08aa73d9ce7e0a1c82e07cd0da1fd521ebad618c48b3f312a6d05ff715a5a87d1eb43a83efd379db3927f00a4d6c1c0f3d9ef5

Download Submit
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

Filesize
85KB

MD5
3c850ffec5bdd850f123077ca210a411

SHA1
1c1ae4678b8a3b65640f047cb1bd72bc70d66f97

SHA256
516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e

SHA512
aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd

Download Submit
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

Filesize
85KB

MD5
612d39d90a14a658e9eaf5de2d3309de

SHA1
b8e1d341319c8f40fdd4c5885475325c5bce5610

SHA256
1deb27da1fbb2dadef382c3a9495142db0d9d7845224e07f511ba26f9ba47061

SHA512
26b03ff093ca85a56a5acabb737731895f47a53b552b0b85d6783e35052af8cfbd9b1018201151521b4cfb8173b1c29589d3063ff97cf4e5fbdb1b35897b301c

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
7a001b8b873cae3d9662ca2d821b53b0

SHA1
4c9f368d36cd85789338d190a7679bbd7438c8d2

SHA256
f33ddb07afa8b06b49ed36f1da3443b897dbc109c057d74262402b935d6c7079

SHA512
b720821f6aca0c07341583153440de042b870a900cdc8c7f6fccf4e7eb09137f76ee962a3fbf6fb3915be5f1435bffd6ffeda3eabf0a4ad0c52f3c45bdd2f837

Download Submit
/storage/emulated/0/data/.systemmac

Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit