2dbcdaa517464d2a1865a412dcaa7d6d87c165c2582ca024c164004af15b41bb

General

Target
stasdk_core.apk
Size 2.1MB
Sample240826-bat55axcpm
SHA256 8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
MD5 e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1 96a86954d989f634798c91523712c34eab06da3d
SHA512 e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP 49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	4255	com.dbgj.stacore

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dbgj.stacore

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.dbgj.stacore

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.dbgj.stacore
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.dbgj.stacore

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dbgj.stacore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dbgj.stacore

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dbgj.stacore

com.dbgj.stacore
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4255
- getprop ro.board.platform
  2⤵
  PID:4291
- getprop ro.mediatek.platform
  2⤵
  PID:4311
- getprop ro.board.platform
  2⤵
  PID:4336
- getprop ro.mediatek.platform
  2⤵
  PID:4355
- getprop ro.board.platform
  2⤵
  PID:4566
- getprop ro.mediatek.platform
  2⤵
  PID:4586

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Location Tracking

Process Discovery

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

3

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__xadsdk__remote__final__builtin__.jar

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 7KB
SHA256 389c84245b8bf8ba586cb55e029d886699d3e940eb2ece6f09b5510742e10b76
MD5 0e0bfe92c02fea6626f8cf7b1ad9bf81
SHA1 c2e4961e48bef61a9ce23ba4ed84c494bb7006e1
SHA512 4446f779785f254d0070d299bd13d23090b4fa53a9eaa2a90f02f9d9bfca3132c6f74244b840c2c28f723d0f71c469174015eab0198e535b9f51cafb6fb68b7a
SSDEEP 192:DEwMdMdg5k/m75u4Em+yu1CT4nXxXHimc2:E4Mb1u48VPc2
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 85KB
SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
MD5 3c850ffec5bdd850f123077ca210a411
SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar (deleted)

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Size 39KB
SHA256 1bf0935e15d18c97107d932165b3b51a5be4806f2e4a99389b4daf53bfb8a231
MD5 f29291f917c2d8b7f8f3b189be15ade6
SHA1 4db7d49a7de147bbf19eed0a7a1260b41ea31ce2
SHA512 ee564e7892d83e3f8fcf4619d03e68255792fcec9d7ffb0e1e7ae1ca6bd71baeb7fb8994726a82721d399e7d81890c05d28a2b638500ba02b915327d620e379c
SSDEEP 96:OzLEezN1e+YwF1EQkI43OBYMUms5GSEc9mPd8/mb:Ozwmne+YwLEQkI1nUzUncsamb
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar (deleted)

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar (deleted)
Size 85KB
SHA256 aabd640f47f9a012baacfeab40057abea6239da228c6ae69f5a1f7200be1be04
MD5 08450a2345dd25aaaa2c78f291e0a255
SHA1 2ce9c2d22d78a88d1ceac76abcbfcc0139de5688
SHA512 2863759c79dbef22a80b93126a4ca8312c00051fe742187a693fb7472030a614ae7f2ee135a1f7af9eb9a01acc05683b81e9ba1326404b5d19cd184ce4a2d847
SSDEEP 768:TCkUil4wy/B1cA4s4au98yV/3XTWtsA463v3JMVDlhA0Up8BG1Vuydsz4rK:TNbM/DXO8Q/3yJ463v6hHA0UGcVrSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__e02ce9fb-5628-46d3-ae8d-6e7859ff007a.jar.tmp

Path /data/data/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__e02ce9fb-5628-46d3-ae8d-6e7859ff007a.jar.tmp
Size 191KB
SHA256 ce5d0f0344c9b91e0afd407eb0802b8404222a26a972fac00d3eedca7a65552d
MD5 8184abec796a25aaba3af99a9c71aafa
SHA1 4a161b84b5183f498278caebe898f4472552b916
SHA512 eff9eb8d8a046931323b2e5fd1605f2f62a2f0a92908501f63c829f17fe3452dac95bce476085ddafb66ca0c5605e5877bd02308bcff43bd47c24c58e05bae84
SSDEEP 3072:dbyVO0b+pdU18oskVnb82BbohuHJCiogWIx0/XObmIAIATsGhvi0CbZCNOW9rknp:ZzLWplVb82ehupUgZcXUmxti0CbZC0yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/user/0/com.dbgj.stacore/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 208KB
SHA256 1cc33691b0bd133bf03839ada68ee4edb4e9ab3e06621e4473a4a9fc34169a0c
MD5 8ac0f6e404323d80b3aa5d7132125463
SHA1 547b41a4d04b4448a57a26ce9a4a612743153523
SHA512 50b539515417a0013b1d02d19d58721c6f0613d5009ee5d879f57454c650691cd995d9ce11c293ec95426821fcdc0f91b5a49481eb27d5e30968b87939547566
SSDEEP 3072:3dqq3gmye2hfHG+Skr253mkGts6FE/1Rt8Mgu8qErAAOGNbsh6NGJV+P3Xg:31ILHhS8u37Mo17g6ErAmNgJ7
MD5 SHA1 SHA512 SSDEEP

Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 36B
SHA256 14bf9c1271f63f6e5f01358da08d3fe17f80b8e61d15b28811149f28c9867b21
MD5 8b27b13af68b5ccc3b161424b0b73161
SHA1 99a8cca040d9b467be7685fcdead1c7b0be96cef
SHA512 c71bcdb4a89b7778c71f0df6bbd47bdc6784cb83d9d65e3e281f9577c959ed98ce4f50b4b47e9c2fc00677b16ec4229064f33fe92da1b04f3ccb77c7f296d137
MD5 SHA1 SHA512

Submit Download

.systemmac

Path /storage/emulated/0/data/.systemmac
Size 17B
SHA256 c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a
MD5 0f607264fc6318a92b9e13c65db7cd3c
SHA1 c1976429369bfe063ed8b3409db7c7e7d87196d9
SHA512 9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads