Analysis
-
max time kernel
107s -
max time network
152s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
06-11-2024 20:08
Static task
static1
Behavioral task
behavioral1
Sample
HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com1.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com1.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com1.apk
-
Size
19.8MB
-
MD5
d9a3a25181c4e14d546b7a12cde29521
-
SHA1
9f48d6bf76640e5cf64e1397baf357dde3938a87
-
SHA256
71f44665d167f6c6fb93ebdadb0fc2b1513dd3589c5ecda84591bcba9f6f365f
-
SHA512
d3da5cc4c4ea29f8bdac7f8199e8c38d7342adcc8908fe0f88dc87a431571178e94e19c08eba448da365aa32981fa12b34bc2c71a1060487d994866bd5a1a032
-
SSDEEP
393216:DjGJoe37RquDHhFVhytkwrgcY9sNORkooI7wpZOTsAI6s9QfTEn3M14GEIV:nGL7Rq8xAawksNYnJ7wp8rIeE81Zz
Malware Config
Signatures
-
Android SMSWorm payload 1 IoCs
Processes:
resource yara_rule /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex family_smsworm -
SMSWorm
SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.
-
Smsworm family
-
Checks if the Android device is rooted. 1 TTPs 9 IoCs
Processes:
insure.cable.estateioc process /sbin/su insure.cable.estate /data/local/xbin/su insure.cable.estate /system/xbin/su insure.cable.estate /data/local/su insure.cable.estate /data/local/bin/su insure.cable.estate /system/bin/su insure.cable.estate /system/bin/failsafe/su insure.cable.estate /system/sd/xbin/su insure.cable.estate /system/app/Superuser.apk insure.cable.estate -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
insure.cable.estateioc process /dev/socket/qemud insure.cable.estate /dev/qemu_pipe insure.cable.estate -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
insure.cable.estateioc pid process /data/data/insure.cable.estate/.jiagu/classes.dex 4320 insure.cable.estate /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex 4320 insure.cable.estate /data/data/insure.cable.estate/.jiagu/classes.dex!classes3.dex 4320 insure.cable.estate -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
insure.cable.estatedescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses insure.cable.estate -
Acquires the wake lock 1 IoCs
Processes:
insure.cable.estatedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock insure.cable.estate -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
insure.cable.estatedescription ioc process Framework service call android.app.IActivityManager.setServiceForeground insure.cable.estate -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo insure.cable.estate -
Checks the presence of a debugger
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process Framework service call android.app.IActivityManager.registerReceiver insure.cable.estate -
Checks CPU information 2 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process File opened for read /proc/cpuinfo insure.cable.estate -
Checks memory information 2 TTPs 1 IoCs
Processes:
insure.cable.estatedescription ioc process File opened for read /proc/meminfo insure.cable.estate
Processes
-
insure.cable.estate1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4320
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
MD52ad2f7af22c5704deac203184dba10a9
SHA140d647ba97ee7775841ed7d9845d2ad172e8d77e
SHA2566fc88c27d8f657a8f95dafbd267792f4984448e671aade2a57d2faa1d0c62f16
SHA51238e9c4a9a2837542d8163224fb0bd394db4c31f608b3fd7872d41f08f7035c3fa855bcc86f99e0a0428043cee5cebd161b2c000a7cffc4b2863d03029c497f42
-
Filesize
9.3MB
MD5c379ae1e140a18af67f142a985dbef6d
SHA191685400fd042026fab6de4e7c9afb3b7a9af6ec
SHA2562862fc1602ff670387097865718eba335a324c4deb379739f188488fe64821dd
SHA512cf4e39bb1f413fecefd523ddf7721938bce185ebcebe01b11d47e08002d87d500bceee4618c04d815b0146df301b0e849b2815875956e7fa918c07f603d9173c
-
Filesize
91KB
MD5b237cb71784406e1849399221ca65b83
SHA1a6c230f556bc4ad1573e01537cd7eafa9ad98905
SHA25614d4fc8cdeec7dd19a7fd010ed46037395a9d50ffdb6aaf64ae7f650c9ea8ebe
SHA5126e3ab92c119129c2404ce079746cf423ea5fed2c64e7efb974f3517eaef16d85bc99e4c79c3058832a29aae46cb2b9fcf622618fc7122f8577b1b062ba29d0f2
-
Filesize
730KB
MD59c09b44d28dc9ef1dd810747820b0348
SHA155b89c9ef314df3da3b350ab13bfbcf514a84041
SHA2562d969529ce8391a2088e4cdbc642bb7a8438e645b2563ba44b47fae6a6639a1e
SHA512dfc0a654653b55abf989249b2eefe3b014a71e8501ed7d9cb56d27a23523601f0be823369072b7a1972638ab894418b7eb69ea0a4a46d14169f49f75be60978a
-
Filesize
512B
MD527c323af0b6600cd1f5bdfcf595591a7
SHA11ec55208ca352f036a231089601a7272588b8521
SHA256d524ad00b56d38e79e52fee9ee4ec119f598677b8ae750e4f5c011b4b341c723
SHA5120d49ed0051de642b6dc5172241716545d1de1b70b732b27e672a1815e1224960b01e7999365e1f56afa5fe26e18eb1f15e73f68785062d198d6c9d9f3ae82c55
-
Filesize
52KB
MD53213c5c1e0641839db93ccb346c46609
SHA17f28cdfcec203a24cdc9c5353eed5addf0ffc637
SHA256b2ff923cd0fa00c645be95aece44d396482ee131c5ca55431373c7318eeeb1aa
SHA51257daa9a6d4a2be951229cf9e2e0071fd8107a55fee9e8ddaaef705d78ba46d11cf8ff6d951fe3247fe2a6e3454f7dc500c92514e354b7a03589a94639c4b19d5
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD50783c4d36399358baa8e41ab8fe6e380
SHA1648f325678f735b8bdec260317c6e8f24689e9b9
SHA2566d5f121d6f8af1381a6cbdac77d7e981d199f8c9446e6e8bd81135bc12d0c446
SHA512cbbd65918e1d8747baa8bce8a557a8b33f73c5f8f0d234cb5a559c1b012919872cd2267399039e385413c765986b2364d97276129a979ae0a72e509a9a425d8a
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD573cfe4923efa4a9240b890f393f7e1c5
SHA18c93e7c01b19ba886d4c218c3b19bb476952a7f8
SHA25666c9cd9196f7a448f95b910248cd5d0c973e72cfac6a5bba2d748d3bee3f2bbd
SHA512bc788de984d0434649670311f7a83b19010eea02def0df115a2f7753e2cea95285d83b83fff1569071cad5aaed1cde59455cd5ca7610a2d4192045f4f3499b22
-
Filesize
512B
MD528b2f26fb28d02185fd961b1b1336d9e
SHA1ad564bc755c53cf79d4d0f250a91615ee11f4f7a
SHA2567ba40695303d4a5920c45fade49941534a7daa61d80e0b0481f5fb127a19befd
SHA512c8e6ff0be178d25f4047cc7c63b56a43c84e1a2a79b16f152c609e82984c6d596e7ce9785bc909802f713da132196fd04d4d4471305062cb8aae6d290e92ed88
-
Filesize
84KB
MD5f1a8ea7a0abd8d677aaaa86b59170f56
SHA1f778b1d230d59d5e7919142622fd716569be85f0
SHA256204e442900b14c174b062a171d6f22635ad64bee3d227a44a6148e50b29e7c61
SHA51217929aa59a589160f529eb5e2c3441c0ad1a4fc884bc05944861e6311c8ac409d316cc8352eac525aae753b8a7db7ee8a5e63393c3ea7a5d1d65a1581f6efe47
-
/data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/com.crashlytics.settings.json
Filesize715B
MD59d2c2157f03fd42c4e39f39b2c8a07fd
SHA1e1e30cc4b0501b8dea7d07a06dd9a5662dc58b58
SHA2563321c1c26e0c070580151ab45f3fcceb0793ba3150f58939a748b3809be69493
SHA51294d4c3572a231726a71c8b18704a01f7d270d901086e2e31de6d566169d08c44da2b15ad9cf20b8af763d2ed78353d7779d1870ba863f74865076b741a44e5ce
-
/data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/open-sessions/672BCCBF0198000110E040E931F442E3/report
Filesize798B
MD58afd8272e0331d620bc4c85921657dd8
SHA1e25918fdd6aab96508c5c19c209f26b0fe92351b
SHA256f3ce2dc65f656bcf71c7f14ee5ee8afbbf6d40b398bd609780d07863d60b9d36
SHA5128636767e423b8837ec755dffb2bbd1cc3d273a45b2deae6356e5aa7d2e3199ddab661da069a023f4e0ba5a42c97e9be193c12ad333717fec20fca6c2c83281d9
-
Filesize
90B
MD5da5f02f570afa0d4b009eb75e6c75b1b
SHA199041ec42de893229a6db480e9ba03a585644d42
SHA256cc800819f1f3e62f93cadc6a9667ac7ad7b07bb9287c3c597bd8c4174fc8be8f
SHA51223cf03b7d8392a36b0276896d7bddb46c65418dbcfe80083351f064c3c8370ded23c36bfcdc2a95e9ed8a19dbf713fbe20e09862039e2dc6c38ed098f481c3d8
-
Filesize
567B
MD5a9a5ce9c71b9c33cba90a1aeb97b3a85
SHA1b5aa1e7d045eb2589321e5f9320bf70881bccec7
SHA25665ae38e0317de90184a63a690fc24ce2ebe1c0e79f0d4726f068fb3092697f7a
SHA512fe323c79270eb7fdb48f1c29fb74669bda0312305b9ba11c0c10a3c7b78edfaf6925da1c979ded06390774c714910f0035efd8648b17acda6152d1654564b441
-
Filesize
5KB
MD5e602848edc22b5d5d5d767cd4e74e93a
SHA10fed5b58d0bff5f2d908d46109239f7c3b328f1d
SHA25603ce22d905bd2bc676a01ae03263cf2c8dd65f58f389bf0dcbfdda4f84696b4e
SHA5126f034fe19639160662809494b1cfb7667cc19a44e92326345383d92db0060b1eee23fd4819fb369a15de4269f40aa9e475a376407b0c03bb547b4839aaa875bf
-
Filesize
1KB
MD5f2e771eb3dbe494a2d8304937a6dde14
SHA14ef57eb9e45bd6cc73700e6fb3d251566969e5b5
SHA25631108f4a764d2034dfeae646996361ff030b1937d736ae475671bdac234862f5
SHA5121e4e3f4d82f4858ad0f9811b159c7825eac7ebace0cabe06b2f277d7ef2dfe0cb9ea4f7468be25ff5e4beb6f6f127238ba53a85842d5311075d6639546b5daf9
-
Filesize
33B
MD535b51faac8b5af3886e70bb5a885dab1
SHA1e6cb282da46cd4bf113e25c8573268578dcd11b6
SHA256af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b
SHA5126ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa
-
Filesize
75B
MD5944e6a5a08cb971370c65c06061f0ab4
SHA184d47725cc29bf167b782c702575bce4bf2ecc5b
SHA256ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab
SHA512bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783
-
Filesize
121B
MD5ffcbf87665a36fc21782400bd0537e79
SHA13dbfbdbfdcde953317b089f9a9fa0bbe50c698ee
SHA256a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d
SHA5127f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57
-
Filesize
163B
MD5dcf7d6c1cfd5e7b56074e3001577c78b
SHA1b8eba89aee9f6688ecda6675ef8ff4998da0b141
SHA256ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91
SHA51242d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d
-
Filesize
212B
MD5d103d966885970e5cd8660ef5f30b46a
SHA11be9acc8bcaf9f9317f29b7ef6540d8ff0c23729
SHA25633ae0138813d0efb4eecb6fda8a48da0b47e29e4cd2d6a2fa88f05b2f2618998
SHA512065995d71bfb411f50af2839bf14a5632393a45185c2f6710d80cc5b253f0e142a72820ca6afcfb15f6a712899e60d32845ec6838b55910d4ed47cdcb372a4d1
-
/data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_defaults.json
Filesize128B
MD57a845c35ee49d2391daa9795ee60001c
SHA170748279b9220aa33d412ebf4c112c5ef9e04346
SHA256b4837f5556a74af96fbf68913e70f7011d54e8c8ceb75db2830ad737264f1755
SHA512040139f518e44547886d2c4be50baf6f92dd28d000cbd9fdaf86bbca50cb1f60e75967ee4631dba3a1e8e1617ced72611c78b9fc24644c41cce927616c9756b2
-
/data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_fetch.json
Filesize381B
MD59de001a473581c392074e1f760a405ca
SHA1b020952ac664eed49854a0b2551ad02f8965841a
SHA256cd0e1bde9c4a760064dd1352896958cfe03af131929fd89256e8c43893fb16d9
SHA51214db0d20a10d59be163e39db975e72d9fb40f6e5801e7d045587ba807d451aed9a468628e939df3eb5d8db18002a3c28a506530ec195a0fb769459fd7f3f99ed
-
Filesize
36B
MD5626f31dc4d99f5f36d216b45f97d4228
SHA1a16d6f4351c9e3082276ab92658f6caa8423fc30
SHA2566e93052e8fe517e3dfa654707c10d16c3fb4f42069cbae115837e4d77fe3f453
SHA512a5d524f12b80f7eae55d805178854247cc9a651aec686f2118118d9b93712b895a5bf01640b44bb5ab1e832f8e03ed8170f23767bc2dc2d103b9e9b3fee2183b
-
Filesize
24B
MD52531608639f19c229bfc95457b4dbe11
SHA1d642643245c6345fad45705cc2441f75a05b9893
SHA256735fb0108d9cd82db0b00f43c13fc40099d89a4a801599708b8231328b857ac9
SHA512b8a382fdf59ef9f581cbb3f5e373fffa702b5588fc3637455e6d6879860ae9a33d091a0fc8173edae9d20979e82de90c8a58bdfd0d7af7fd11a2c20da9587f2f
-
Filesize
8B
MD5f573c7ad354ac81d9ac4e59004ccb7ff
SHA1d8e7d2983fb570e9927c1835c8bd62446d50183d
SHA256e983e2a2416b2242d2ac7af7cda39407f4bd2ba28e9d95ee9579ab08d57acffe
SHA5126460af890517eb949fb00c7a316153777542e9ff2ecb67325f8d99d4a097a6916d23d143927eacdcc04b8d9f1b1cee52ea7e936cc123d75118430b66c40e74c0
-
Filesize
512B
MD5acf1cef2c7e0d44e1ca6057d59f61dea
SHA1a9399b6d2eb4456cb8fde76f5e4af40e697e8df6
SHA25689a20b135d7520fef0036ea8dcc08ca95a98fca84a3968ec410ee79908a49bb3
SHA512f777bb46e2e352bff6c6cb3084c821531e2687a457497f1d6699740f7bde9a0538577e20cf4484d26f8d4b20cdaeacfa52b040e7b7b9d7428aac8677c0d94390
-
Filesize
16KB
MD5cbffa3469ce6ee0bb426e833c15b3b16
SHA11619a197aaab828a9800ee6a01ffc9b63ed38d9b
SHA2560255c5d4803dab0dbdf45220283b1c9d194ce1e2938b5c2a366690e503c07890
SHA512948129805ccfc2452a6d696240d996f23d71698b9c4950fa075acb1bc6d1130f1bcec47e15686656520c5a1a289451e2f37ade1697a306933794c6486df77c26
-
Filesize
108KB
MD565765463c21ec5fb1fd33f973756981d
SHA192b9117cfa7de36613edc797d93bd69c5fb2fbc8
SHA2560cbcfb45911aefb7aba826debe746cf60643fc8f60e719832fd5512e3719e092
SHA512da03cc8bcd1787aba37f309fc809f82f2ff4d46a18162553353049c5c26eb2f06b989315c73adf8ff5ab1e7f88124e7c0f1c9b0d4d43f00728ebfdfb3a2a8d15
-
Filesize
3KB
MD5625b7bfb0a95c22350563afe7a989652
SHA16d0712f223459406ea3506e170ef40bf0e81534c
SHA256db5e33341082e7e75cb5b0a8ba2a8589652a4dbca5a11b6210294478ad774402
SHA51281e56e1a026441bcb9d1072b55539f62de79ed486a4f89019b801c8eb79f969dcada2665eb16cc415c58e4993ddb306e146de9f3ae8d76d52fdc7b4f5ebb093f
-
Filesize
25B
MD5b9d9e0f8902d129e1aeebff0ae7b725b
SHA1cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781
SHA25625a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91
SHA512f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6