Resubmissions

07-11-2024 02:45

241107-c82tasthln 10

06-11-2024 20:08

241106-ywk6nsxaph 10

Analysis

  • max time kernel
    107s
  • max time network
    152s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06-11-2024 20:08

General

  • Target

    HD_STREAMZ_Latest_Version_2024_HDStreamzs.Com1.apk

  • Size

    19.8MB

  • MD5

    d9a3a25181c4e14d546b7a12cde29521

  • SHA1

    9f48d6bf76640e5cf64e1397baf357dde3938a87

  • SHA256

    71f44665d167f6c6fb93ebdadb0fc2b1513dd3589c5ecda84591bcba9f6f365f

  • SHA512

    d3da5cc4c4ea29f8bdac7f8199e8c38d7342adcc8908fe0f88dc87a431571178e94e19c08eba448da365aa32981fa12b34bc2c71a1060487d994866bd5a1a032

  • SSDEEP

    393216:DjGJoe37RquDHhFVhytkwrgcY9sNORkooI7wpZOTsAI6s9QfTEn3M14GEIV:nGL7Rq8xAawksNYnJ7wp8rIeE81Zz

Malware Config

Signatures

  • Android SMSWorm payload 1 IoCs
  • SMSWorm

    SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.

  • Smsworm family
  • Checks if the Android device is rooted. 1 TTPs 9 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Checks the presence of a debugger
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • insure.cable.estate
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4320

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/insure.cable.estate/.jiagu/classes.dex

    Filesize

    10.6MB

    MD5

    2ad2f7af22c5704deac203184dba10a9

    SHA1

    40d647ba97ee7775841ed7d9845d2ad172e8d77e

    SHA256

    6fc88c27d8f657a8f95dafbd267792f4984448e671aade2a57d2faa1d0c62f16

    SHA512

    38e9c4a9a2837542d8163224fb0bd394db4c31f608b3fd7872d41f08f7035c3fa855bcc86f99e0a0428043cee5cebd161b2c000a7cffc4b2863d03029c497f42

  • /data/data/insure.cable.estate/.jiagu/classes.dex!classes2.dex

    Filesize

    9.3MB

    MD5

    c379ae1e140a18af67f142a985dbef6d

    SHA1

    91685400fd042026fab6de4e7c9afb3b7a9af6ec

    SHA256

    2862fc1602ff670387097865718eba335a324c4deb379739f188488fe64821dd

    SHA512

    cf4e39bb1f413fecefd523ddf7721938bce185ebcebe01b11d47e08002d87d500bceee4618c04d815b0146df301b0e849b2815875956e7fa918c07f603d9173c

  • /data/data/insure.cable.estate/.jiagu/classes.dex!classes3.dex

    Filesize

    91KB

    MD5

    b237cb71784406e1849399221ca65b83

    SHA1

    a6c230f556bc4ad1573e01537cd7eafa9ad98905

    SHA256

    14d4fc8cdeec7dd19a7fd010ed46037395a9d50ffdb6aaf64ae7f650c9ea8ebe

    SHA512

    6e3ab92c119129c2404ce079746cf423ea5fed2c64e7efb974f3517eaef16d85bc99e4c79c3058832a29aae46cb2b9fcf622618fc7122f8577b1b062ba29d0f2

  • /data/data/insure.cable.estate/.jiagu/libjiagu.so

    Filesize

    730KB

    MD5

    9c09b44d28dc9ef1dd810747820b0348

    SHA1

    55b89c9ef314df3da3b350ab13bfbcf514a84041

    SHA256

    2d969529ce8391a2088e4cdbc642bb7a8438e645b2563ba44b47fae6a6639a1e

    SHA512

    dfc0a654653b55abf989249b2eefe3b014a71e8501ed7d9cb56d27a23523601f0be823369072b7a1972638ab894418b7eb69ea0a4a46d14169f49f75be60978a

  • /data/data/insure.cable.estate/databases/StartApp-d6864f2502af7851-journal

    Filesize

    512B

    MD5

    27c323af0b6600cd1f5bdfcf595591a7

    SHA1

    1ec55208ca352f036a231089601a7272588b8521

    SHA256

    d524ad00b56d38e79e52fee9ee4ec119f598677b8ae750e4f5c011b4b341c723

    SHA512

    0d49ed0051de642b6dc5172241716545d1de1b70b732b27e672a1815e1224960b01e7999365e1f56afa5fe26e18eb1f15e73f68785062d198d6c9d9f3ae82c55

  • /data/data/insure.cable.estate/databases/StartApp-d6864f2502af7851-wal

    Filesize

    52KB

    MD5

    3213c5c1e0641839db93ccb346c46609

    SHA1

    7f28cdfcec203a24cdc9c5353eed5addf0ffc637

    SHA256

    b2ff923cd0fa00c645be95aece44d396482ee131c5ca55431373c7318eeeb1aa

    SHA512

    57daa9a6d4a2be951229cf9e2e0071fd8107a55fee9e8ddaaef705d78ba46d11cf8ff6d951fe3247fe2a6e3454f7dc500c92514e354b7a03589a94639c4b19d5

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    0783c4d36399358baa8e41ab8fe6e380

    SHA1

    648f325678f735b8bdec260317c6e8f24689e9b9

    SHA256

    6d5f121d6f8af1381a6cbdac77d7e981d199f8c9446e6e8bd81135bc12d0c446

    SHA512

    cbbd65918e1d8747baa8bce8a557a8b33f73c5f8f0d234cb5a559c1b012919872cd2267399039e385413c765986b2364d97276129a979ae0a72e509a9a425d8a

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/insure.cable.estate/databases/com.google.android.datatransport.events-wal

    Filesize

    68KB

    MD5

    73cfe4923efa4a9240b890f393f7e1c5

    SHA1

    8c93e7c01b19ba886d4c218c3b19bb476952a7f8

    SHA256

    66c9cd9196f7a448f95b910248cd5d0c973e72cfac6a5bba2d748d3bee3f2bbd

    SHA512

    bc788de984d0434649670311f7a83b19010eea02def0df115a2f7753e2cea95285d83b83fff1569071cad5aaed1cde59455cd5ca7610a2d4192045f4f3499b22

  • /data/data/insure.cable.estate/databases/google_analytics_v4.db-journal

    Filesize

    512B

    MD5

    28b2f26fb28d02185fd961b1b1336d9e

    SHA1

    ad564bc755c53cf79d4d0f250a91615ee11f4f7a

    SHA256

    7ba40695303d4a5920c45fade49941534a7daa61d80e0b0481f5fb127a19befd

    SHA512

    c8e6ff0be178d25f4047cc7c63b56a43c84e1a2a79b16f152c609e82984c6d596e7ce9785bc909802f713da132196fd04d4d4471305062cb8aae6d290e92ed88

  • /data/data/insure.cable.estate/databases/google_analytics_v4.db-wal

    Filesize

    84KB

    MD5

    f1a8ea7a0abd8d677aaaa86b59170f56

    SHA1

    f778b1d230d59d5e7919142622fd716569be85f0

    SHA256

    204e442900b14c174b062a171d6f22635ad64bee3d227a44a6148e50b29e7c61

    SHA512

    17929aa59a589160f529eb5e2c3441c0ad1a4fc884bc05944861e6311c8ac409d316cc8352eac525aae753b8a7db7ee8a5e63393c3ea7a5d1d65a1581f6efe47

  • /data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/com.crashlytics.settings.json

    Filesize

    715B

    MD5

    9d2c2157f03fd42c4e39f39b2c8a07fd

    SHA1

    e1e30cc4b0501b8dea7d07a06dd9a5662dc58b58

    SHA256

    3321c1c26e0c070580151ab45f3fcceb0793ba3150f58939a748b3809be69493

    SHA512

    94d4c3572a231726a71c8b18704a01f7d270d901086e2e31de6d566169d08c44da2b15ad9cf20b8af763d2ed78353d7779d1870ba863f74865076b741a44e5ce

  • /data/data/insure.cable.estate/files/.com.google.firebase.crashlytics.files.v2:insure.cable.estate/open-sessions/672BCCBF0198000110E040E931F442E3/report

    Filesize

    798B

    MD5

    8afd8272e0331d620bc4c85921657dd8

    SHA1

    e25918fdd6aab96508c5c19c209f26b0fe92351b

    SHA256

    f3ce2dc65f656bcf71c7f14ee5ee8afbbf6d40b398bd609780d07863d60b9d36

    SHA512

    8636767e423b8837ec755dffb2bbd1cc3d273a45b2deae6356e5aa7d2e3199ddab661da069a023f4e0ba5a42c97e9be193c12ad333717fec20fca6c2c83281d9

  • /data/data/insure.cable.estate/files/PersistedInstallation2954611733861491475tmp

    Filesize

    90B

    MD5

    da5f02f570afa0d4b009eb75e6c75b1b

    SHA1

    99041ec42de893229a6db480e9ba03a585644d42

    SHA256

    cc800819f1f3e62f93cadc6a9667ac7ad7b07bb9287c3c597bd8c4174fc8be8f

    SHA512

    23cf03b7d8392a36b0276896d7bddb46c65418dbcfe80083351f064c3c8370ded23c36bfcdc2a95e9ed8a19dbf713fbe20e09862039e2dc6c38ed098f481c3d8

  • /data/data/insure.cable.estate/files/PersistedInstallation6237585630918707945tmp

    Filesize

    567B

    MD5

    a9a5ce9c71b9c33cba90a1aeb97b3a85

    SHA1

    b5aa1e7d045eb2589321e5f9320bf70881bccec7

    SHA256

    65ae38e0317de90184a63a690fc24ce2ebe1c0e79f0d4726f068fb3092697f7a

    SHA512

    fe323c79270eb7fdb48f1c29fb74669bda0312305b9ba11c0c10a3c7b78edfaf6925da1c979ded06390774c714910f0035efd8648b17acda6152d1654564b441

  • /data/data/insure.cable.estate/files/StartappMetadata

    Filesize

    5KB

    MD5

    e602848edc22b5d5d5d767cd4e74e93a

    SHA1

    0fed5b58d0bff5f2d908d46109239f7c3b328f1d

    SHA256

    03ce22d905bd2bc676a01ae03263cf2c8dd65f58f389bf0dcbfdda4f84696b4e

    SHA512

    6f034fe19639160662809494b1cfb7667cc19a44e92326345383d92db0060b1eee23fd4819fb369a15de4269f40aa9e475a376407b0c03bb547b4839aaa875bf

  • /data/data/insure.cable.estate/files/StartappSplashMetadata

    Filesize

    1KB

    MD5

    f2e771eb3dbe494a2d8304937a6dde14

    SHA1

    4ef57eb9e45bd6cc73700e6fb3d251566969e5b5

    SHA256

    31108f4a764d2034dfeae646996361ff030b1937d736ae475671bdac234862f5

    SHA512

    1e4e3f4d82f4858ad0f9811b159c7825eac7ebace0cabe06b2f277d7ef2dfe0cb9ea4f7468be25ff5e4beb6f6f127238ba53a85842d5311075d6639546b5daf9

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    33B

    MD5

    35b51faac8b5af3886e70bb5a885dab1

    SHA1

    e6cb282da46cd4bf113e25c8573268578dcd11b6

    SHA256

    af5b3362ec35985974c6b73eeba53e5063861f2491252d61d8cd42168aa5ed6b

    SHA512

    6ad5e9766cc03a4436e1440b9e47c44da6c6440a3c94b1cc988f8c5680043cde6f7b7e02b2b4c71b25df4209c39ed099fb65fdde02a9f09464609a1abe6af8fa

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    75B

    MD5

    944e6a5a08cb971370c65c06061f0ab4

    SHA1

    84d47725cc29bf167b782c702575bce4bf2ecc5b

    SHA256

    ba8f4af0e35f93cc15649f4c51969f5279421fc12deeafaddec5e5c48aa58dab

    SHA512

    bdc404233927a6a99160492d0b3e2cf00776d51b33612b8c9ecba395747b3572cf1790269fb199915aafe84c546d30e3259833c9d00af8c412823396882ca783

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    121B

    MD5

    ffcbf87665a36fc21782400bd0537e79

    SHA1

    3dbfbdbfdcde953317b089f9a9fa0bbe50c698ee

    SHA256

    a21d3bf2cca0951e9e7b3fed43cafe9f89a4cf9d844c82279b260852d0ee473d

    SHA512

    7f98ac150c422eb4f1126d86501d0435817ceaa7eb5549e4d21a295d57be3d3fed4388cda782c084130c4ac8d57a4f225139a2e42e8a12b34cc1679140d16b57

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    163B

    MD5

    dcf7d6c1cfd5e7b56074e3001577c78b

    SHA1

    b8eba89aee9f6688ecda6675ef8ff4998da0b141

    SHA256

    ba0830617929c78abca9391c2059f89c78049911f502ef5525d39341e4da2b91

    SHA512

    42d75be824d69de23d2e8605d60c3608db20ed5c059f5b67c63ca2845484c67150aea88a3aae36aae12a4ea266fb6b469d09f765bbcd444350d836ab83f7695d

  • /data/data/insure.cable.estate/files/datastore/firebase_session_settings.preferences_pb.tmp

    Filesize

    212B

    MD5

    d103d966885970e5cd8660ef5f30b46a

    SHA1

    1be9acc8bcaf9f9317f29b7ef6540d8ff0c23729

    SHA256

    33ae0138813d0efb4eecb6fda8a48da0b47e29e4cd2d6a2fa88f05b2f2618998

    SHA512

    065995d71bfb411f50af2839bf14a5632393a45185c2f6710d80cc5b253f0e142a72820ca6afcfb15f6a712899e60d32845ec6838b55910d4ed47cdcb372a4d1

  • /data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_defaults.json

    Filesize

    128B

    MD5

    7a845c35ee49d2391daa9795ee60001c

    SHA1

    70748279b9220aa33d412ebf4c112c5ef9e04346

    SHA256

    b4837f5556a74af96fbf68913e70f7011d54e8c8ceb75db2830ad737264f1755

    SHA512

    040139f518e44547886d2c4be50baf6f92dd28d000cbd9fdaf86bbca50cb1f60e75967ee4631dba3a1e8e1617ced72611c78b9fc24644c41cce927616c9756b2

  • /data/data/insure.cable.estate/files/frc_1:614315011479:android:59cce33af57d3bfc66a8d2_firebase_fetch.json

    Filesize

    381B

    MD5

    9de001a473581c392074e1f760a405ca

    SHA1

    b020952ac664eed49854a0b2551ad02f8965841a

    SHA256

    cd0e1bde9c4a760064dd1352896958cfe03af131929fd89256e8c43893fb16d9

    SHA512

    14db0d20a10d59be163e39db975e72d9fb40f6e5801e7d045587ba807d451aed9a468628e939df3eb5d8db18002a3c28a506530ec195a0fb769459fd7f3f99ed

  • /data/data/insure.cable.estate/files/gaClientId

    Filesize

    36B

    MD5

    626f31dc4d99f5f36d216b45f97d4228

    SHA1

    a16d6f4351c9e3082276ab92658f6caa8423fc30

    SHA256

    6e93052e8fe517e3dfa654707c10d16c3fb4f42069cbae115837e4d77fe3f453

    SHA512

    a5d524f12b80f7eae55d805178854247cc9a651aec686f2118118d9b93712b895a5bf01640b44bb5ab1e832f8e03ed8170f23767bc2dc2d103b9e9b3fee2183b

  • /data/data/insure.cable.estate/files/profileInstalled

    Filesize

    24B

    MD5

    2531608639f19c229bfc95457b4dbe11

    SHA1

    d642643245c6345fad45705cc2441f75a05b9893

    SHA256

    735fb0108d9cd82db0b00f43c13fc40099d89a4a801599708b8231328b857ac9

    SHA512

    b8a382fdf59ef9f581cbb3f5e373fffa702b5588fc3637455e6d6879860ae9a33d091a0fc8173edae9d20979e82de90c8a58bdfd0d7af7fd11a2c20da9587f2f

  • /data/data/insure.cable.estate/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

    Filesize

    8B

    MD5

    f573c7ad354ac81d9ac4e59004ccb7ff

    SHA1

    d8e7d2983fb570e9927c1835c8bd62446d50183d

    SHA256

    e983e2a2416b2242d2ac7af7cda39407f4bd2ba28e9d95ee9579ab08d57acffe

    SHA512

    6460af890517eb949fb00c7a316153777542e9ff2ecb67325f8d99d4a097a6916d23d143927eacdcc04b8d9f1b1cee52ea7e936cc123d75118430b66c40e74c0

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    acf1cef2c7e0d44e1ca6057d59f61dea

    SHA1

    a9399b6d2eb4456cb8fde76f5e4af40e697e8df6

    SHA256

    89a20b135d7520fef0036ea8dcc08ca95a98fca84a3968ec410ee79908a49bb3

    SHA512

    f777bb46e2e352bff6c6cb3084c821531e2687a457497f1d6699740f7bde9a0538577e20cf4484d26f8d4b20cdaeacfa52b040e7b7b9d7428aac8677c0d94390

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    cbffa3469ce6ee0bb426e833c15b3b16

    SHA1

    1619a197aaab828a9800ee6a01ffc9b63ed38d9b

    SHA256

    0255c5d4803dab0dbdf45220283b1c9d194ce1e2938b5c2a366690e503c07890

    SHA512

    948129805ccfc2452a6d696240d996f23d71698b9c4950fa075acb1bc6d1130f1bcec47e15686656520c5a1a289451e2f37ade1697a306933794c6486df77c26

  • /data/data/insure.cable.estate/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    65765463c21ec5fb1fd33f973756981d

    SHA1

    92b9117cfa7de36613edc797d93bd69c5fb2fbc8

    SHA256

    0cbcfb45911aefb7aba826debe746cf60643fc8f60e719832fd5512e3719e092

    SHA512

    da03cc8bcd1787aba37f309fc809f82f2ff4d46a18162553353049c5c26eb2f06b989315c73adf8ff5ab1e7f88124e7c0f1c9b0d4d43f00728ebfdfb3a2a8d15

  • /data/misc/profiles/cur/0/insure.cable.estate/primary.prof

    Filesize

    3KB

    MD5

    625b7bfb0a95c22350563afe7a989652

    SHA1

    6d0712f223459406ea3506e170ef40bf0e81534c

    SHA256

    db5e33341082e7e75cb5b0a8ba2a8589652a4dbca5a11b6210294478ad774402

    SHA512

    81e56e1a026441bcb9d1072b55539f62de79ed486a4f89019b801c8eb79f969dcada2665eb16cc415c58e4993ddb306e146de9f3ae8d76d52fdc7b4f5ebb093f

  • /data/misc/profiles/cur/0/insure.cable.estate/primary.prof

    Filesize

    25B

    MD5

    b9d9e0f8902d129e1aeebff0ae7b725b

    SHA1

    cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

    SHA256

    25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

    SHA512

    f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6