2dbcdaa517464d2a1865a412dcaa7d6d87c165c2582ca024c164004af15b41bb

General

Target

stasdk_core.apk
Size

2.1MB
MD5

e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1

96a86954d989f634798c91523712c34eab06da3d
SHA256

8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
SHA512

e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP

49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw

Score

7^/10

collection discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.dbgj.stacore

ioc pid process

/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar 4255 com.dbgj.stacore
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.dbgj.stacore
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.dbgj.stacore

ioc	pid	process
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	4255	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

Processes:

com.dbgj.stacore

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore

Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dbgj.stacore
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dbgj.stacore
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.dbgj.stacore

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.dbgj.stacore

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4255
- getprop ro.board.platform
  2⤵
  PID:4291
- getprop ro.mediatek.platform
  2⤵
  PID:4311
- getprop ro.board.platform
  2⤵
  PID:4336
- getprop ro.mediatek.platform
  2⤵
  PID:4355
- getprop ro.board.platform
  2⤵
  PID:4566
- getprop ro.mediatek.platform
  2⤵
  PID:4586

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Location Tracking

Process Discovery

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

3

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

Filesize
7KB

MD5
0e0bfe92c02fea6626f8cf7b1ad9bf81

SHA1
c2e4961e48bef61a9ce23ba4ed84c494bb7006e1

SHA256
389c84245b8bf8ba586cb55e029d886699d3e940eb2ece6f09b5510742e10b76

SHA512
4446f779785f254d0070d299bd13d23090b4fa53a9eaa2a90f02f9d9bfca3132c6f74244b840c2c28f723d0f71c469174015eab0198e535b9f51cafb6fb68b7a

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

Filesize
85KB

MD5
3c850ffec5bdd850f123077ca210a411

SHA1
1c1ae4678b8a3b65640f047cb1bd72bc70d66f97

SHA256
516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e

SHA512
aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)

Filesize
39KB

MD5
f29291f917c2d8b7f8f3b189be15ade6

SHA1
4db7d49a7de147bbf19eed0a7a1260b41ea31ce2

SHA256
1bf0935e15d18c97107d932165b3b51a5be4806f2e4a99389b4daf53bfb8a231

SHA512
ee564e7892d83e3f8fcf4619d03e68255792fcec9d7ffb0e1e7ae1ca6bd71baeb7fb8994726a82721d399e7d81890c05d28a2b638500ba02b915327d620e379c

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)

Filesize
85KB

MD5
08450a2345dd25aaaa2c78f291e0a255

SHA1
2ce9c2d22d78a88d1ceac76abcbfcc0139de5688

SHA256
aabd640f47f9a012baacfeab40057abea6239da228c6ae69f5a1f7200be1be04

SHA512
2863759c79dbef22a80b93126a4ca8312c00051fe742187a693fb7472030a614ae7f2ee135a1f7af9eb9a01acc05683b81e9ba1326404b5d19cd184ce4a2d847

Download Submit
/data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__e02ce9fb-5628-46d3-ae8d-6e7859ff007a.jar.tmp

Filesize
191KB

MD5
8184abec796a25aaba3af99a9c71aafa

SHA1
4a161b84b5183f498278caebe898f4472552b916

SHA256
ce5d0f0344c9b91e0afd407eb0802b8404222a26a972fac00d3eedca7a65552d

SHA512
eff9eb8d8a046931323b2e5fd1605f2f62a2f0a92908501f63c829f17fe3452dac95bce476085ddafb66ca0c5605e5877bd02308bcff43bd47c24c58e05bae84

Download Submit
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar

Filesize
208KB

MD5
8ac0f6e404323d80b3aa5d7132125463

SHA1
547b41a4d04b4448a57a26ce9a4a612743153523

SHA256
1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c

SHA512
50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
8b27b13af68b5ccc3b161424b0b73161

SHA1
99a8cca040d9b467be7685fcdead1c7b0be96cef

SHA256
14bf9c1271f63f6e5f01358da08d3fe17f80b8e61d15b28811149f28c9867b21

SHA512
c71bcdb4a89b7778c71f0df6bbd47bdc6784cb83d9d65e3e281f9577c959ed98ce4f50b4b47e9c2fc00677b16ec4229064f33fe92da1b04f3ccb77c7f296d137

Download Submit
/storage/emulated/0/data/.systemmac

Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads