2f59df9acab578af8148f0b5bfe68abddf38687ed285c6c49f5fe6aab1a194b2

General

Target

2f59df9acab578af8148f0b5bfe68abddf38687ed285c6c49f5fe6aab1a194b2
Size

9.9MB
MD5

6ee463c0a80b193919699f7025ec6e44
SHA1

7034c0286dfb2a8b449e8dab7ef3bc3b437f5db4
SHA256

2f59df9acab578af8148f0b5bfe68abddf38687ed285c6c49f5fe6aab1a194b2
SHA512

e451f7f278ef48cf5d290b664d92e3f163916e34bd8b0c2182c00c768db489a181d56fa60c6cf267fcaf95c1cc7839aa99971d27f3d18413003b8bc5aff50c06
SSDEEP

196608:8aadWvpJqc5jaHZ9Y6l8yU43H/RvIcUJWCF:Wdmj5mDYU843H/RvE

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Files

2f59df9acab578af8148f0b5bfe68abddf38687ed285c6c49f5fe6aab1a194b2
.apk android arch:arm64 arch:arm arch:x86 arch:x64

com.boshtc.plweather

com.plweather.clean.SplashActivity

Activities

com.plweather.killbackground.view.CleanActivity

android.intent.action.CREATE_SHORTCUT
android.intent.action.MAIN

com.plweather.clean.SplashActivity

android.intent.action.MAIN

cn.jpush.android.ui.PushActivity

cn.jpush.android.ui.PushActivity

com.plweather.clean.cleanmore.phonemanager.activity.PureNewsActivity

android.intent.action.MAIN

Permissions

qiku.permission.READ_WRITE_QKSECURE
android.permission.INSTALL_PACKAGES
com.boshtc.plweather.permission.JPUSH_MESSAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.DISABLE_KEYGUARD
android.permission.ACCESS_DOWNLOAD_MANAGER
android.permission.GET_ACCOUNTS
android.permission.USE_CREDENTIALS
android.permission.NFC
android.permission.SEND_DOWNLOAD_COMPLETED_INTENTS
android.permission.SET_WALLPAPER
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_SETTINGS
android.permission.READ_SYNC_SETTINGS
android.permission.WRITE_SYNC_SETTINGS
android.permission.MANAGE_ACCOUNTS
android.permission.READ_PROFILE
com.android.browser.permission.READ_HISTORY_BOOKMARKS
com.android.browser.permission.WRITE_HISTORY_BOOKMARKS
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.android.launcher.permission.READ_SETTINGS
com.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_PHONE_STATE
com.qihoo360.launcher.permission.WRITE_SETTINGS
com.qihoo360.launcher.permission.READ_SETTINGS
net.qihoo.launcher.permission.READ_SETTINGS
net.qihoo.launcher.permission.WRITE_SETTINGS
com.lge.launcher.permission.READ_SETTINGS
com.lge.launcher.permission.WRITE_SETTINGS
com.android.launcher2.permission.READ_SETTINGS
com.android.launcher2.permission.WRITE_SETTINGS
com.android.launcher3.permission.READ_SETTINGS
com.android.launcher3.permission.WRITE_SETTINGS
com.sec.android.app.twlauncher.settings.READ_SETTINGS
com.sec.android.app.twlauncher.settings.WRITE_SETTINGS
com.tencent.qqlauncher.permission.READ_SETTINGS
com.tencent.qqlauncher.permission.WRITE_SETTINGS
com.huawei.launcher2.permission.READ_SETTINGS
com.huawei.launcher2.permission.WRITE_SETTINGS
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
com.htc.launcher.permission.WRITE_SETTINGS
com.htc.launcher.permission.READ_SETTINGS
com.sec.android.app.twlauncher.WRITE_SETTINGS
com.sec.android.app.twlauncher.READ_SETTINGS
org.adw.launcher.permission.READ_SETTINGS
org.adw.launcher.permission.WRITE_SETTINGS
org.adwfreak.launcher.permission.READ_SETTINGS
org.adwfreak.launcher.permission.WRITE_SETTINGS
com.gau.go.launcherex.permission.READ_SETTINGS
com.gau.go.launcherex.permission.WRITE_SETTINGS
com.qihoo360.home.permission.WRITE_SETTINGS
com.qihoo360.home.permission.READ_SETTINGS
com.fede.launcher.permission.READ_SETTINGS
com.fede.launcher.permission.WRITE_SETTINGS
com.anddoes.launcher.permission.READ_SETTINGS
com.anddoes.launcher.permission.WRITE_SETTINGS
com.lenovo.launcher.permission.WRITE_SETTINGS
com.lenovo.launcher.permission.READ_SETTINGS
com.nd.android.launcher.permission.READ_SETTINGS
com.nd.android.launcher.permission.WRITE_SETTINGS
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.launcher3.permission.READ_SETTINGS
com.huawei.launcher3.permission.WRITE_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
com.meizu.flyme.launcher.permission.READ_SETTINGS
com.meizu.flyme.launcher.permission.WRITE_SETTINGS
android.permission.GET_TASKS
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CHANGE_WIFI_STATE
android.permission.GET_PACKAGE_SIZE
android.permission.VIBRATE
android.permission.CAMERA
android.permission.FLASHLIGHT
android.permission.EXPAND_STATUS_BAR
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.AUTHENTICATE_ACCOUNTS
android.permission.ACCESS_COARSE_UPDATES
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
android.permission.CHANGE_NETWORK_STATE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.BROADCAST_STICKY
android.permission.RECEIVE_USER_PRESENT
android.permission.SYSTEM_ALERT_WINDOW
android.permission.PACKAGE_USAGE_STATS
android.permission.BLUETOOTH
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.WRITE_SETTINGS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS

Receivers

com.plweather.clean.KeepAliceRecever

android.intent.action.BOOT_COMPLETED
android.intent.action.REBOOT
android.hardware.usb.action.USB_STATE
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.WIFI_STATE_CHANGED
android.net.wifi.STATE_CHANGE
com.app.startrecevice
android.intent.action.USER_PRESENT
android.intent.action.TIME_TICK
com.plweather.staticapp
android.net.conn.CONNECTIVITY_CHANGE

com.plweather.clean.cleanmore.phonemanager.receiver.BatteryReceiver

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.BATTERY_CHANGED
android.intent.action.BATTERY_LOW
android.intent.action.BATTERY_OKAY

com.plweather.clean.cleanmore.uninstall.model.AppInstallReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_REMOVED

com.plweather.jpush.YMJpushReceiver

cn.jpush.android.intent.REGISTRATION
cn.jpush.android.intent.MESSAGE_RECEIVED
cn.jpush.android.intent.NOTIFICATION_RECEIVED
cn.jpush.android.intent.NOTIFICATION_OPENED
cn.jpush.android.intent.CONNECTION
cn.jpush.android.intent.NOTIFICATION_OPENED_SELF
cn.jpush.android.intent.ACTION_RICHPUSH_CALLBACK

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

receiver.NetWorkReceiver

android.net.conn.CONNECTIVITY_CHANGE

Services

com.plweather.clean.cleanmore.notification.NotifyService

flashlight_status

com.plweather.clean.cleanmore.accountauthenticator.AuthenticationService

android.accounts.AccountAuthenticator

com.plweather.clean.cleanmore.accountauthenticator.SyncAdapterService

android.content.SyncAdapter

com.plweather.clean.cleanmore.phonemanager.NotificationMonitor

android.service.notification.NotificationListenerService

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER
cn.jpush.android.intent.REPORT
cn.jpush.android.intent.PushService
cn.jpush.android.intent.PUSH_TIME

cn.jpush.android.service.DaemonService

cn.jpush.android.intent.DaemonService
gdtadv2.jar
.apk android

Android Permissions

2f59df9acab578af8148f0b5bfe68abddf38687ed285c6c49f5fe6aab1a194b2

Permissions

qiku.permission.READ_WRITE_QKSECURE

android.permission.INSTALL_PACKAGES

com.boshtc.plweather.permission.JPUSH_MESSAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DISABLE_KEYGUARD

android.permission.ACCESS_DOWNLOAD_MANAGER

android.permission.GET_ACCOUNTS

android.permission.USE_CREDENTIALS

android.permission.NFC

android.permission.SEND_DOWNLOAD_COMPLETED_INTENTS

android.permission.SET_WALLPAPER

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_SETTINGS

android.permission.READ_SYNC_SETTINGS

android.permission.WRITE_SYNC_SETTINGS

android.permission.MANAGE_ACCOUNTS

android.permission.READ_PROFILE

com.android.browser.permission.READ_HISTORY_BOOKMARKS

com.android.browser.permission.WRITE_HISTORY_BOOKMARKS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_PHONE_STATE

com.qihoo360.launcher.permission.WRITE_SETTINGS

com.qihoo360.launcher.permission.READ_SETTINGS

net.qihoo.launcher.permission.READ_SETTINGS

net.qihoo.launcher.permission.WRITE_SETTINGS

com.lge.launcher.permission.READ_SETTINGS

com.lge.launcher.permission.WRITE_SETTINGS

com.android.launcher2.permission.READ_SETTINGS

com.android.launcher2.permission.WRITE_SETTINGS

com.android.launcher3.permission.READ_SETTINGS

com.android.launcher3.permission.WRITE_SETTINGS

com.sec.android.app.twlauncher.settings.READ_SETTINGS

com.sec.android.app.twlauncher.settings.WRITE_SETTINGS

com.tencent.qqlauncher.permission.READ_SETTINGS

com.tencent.qqlauncher.permission.WRITE_SETTINGS

com.huawei.launcher2.permission.READ_SETTINGS

com.huawei.launcher2.permission.WRITE_SETTINGS

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

com.htc.launcher.permission.WRITE_SETTINGS

com.htc.launcher.permission.READ_SETTINGS

com.sec.android.app.twlauncher.WRITE_SETTINGS

com.sec.android.app.twlauncher.READ_SETTINGS

org.adw.launcher.permission.READ_SETTINGS

org.adw.launcher.permission.WRITE_SETTINGS

org.adwfreak.launcher.permission.READ_SETTINGS

Sharing

General

Malware Config

Signatures

Files

com.boshtc.plweather

com.plweather.clean.SplashActivity

Activities

com.plweather.killbackground.view.CleanActivity

com.plweather.clean.SplashActivity

cn.jpush.android.ui.PushActivity

com.plweather.clean.cleanmore.phonemanager.activity.PureNewsActivity

Permissions

Receivers

com.plweather.clean.KeepAliceRecever

com.plweather.clean.cleanmore.phonemanager.receiver.BatteryReceiver

com.plweather.clean.cleanmore.uninstall.model.AppInstallReceiver

com.plweather.jpush.YMJpushReceiver

cn.jpush.android.service.PushReceiver

receiver.NetWorkReceiver

Services

com.plweather.clean.cleanmore.notification.NotifyService

com.plweather.clean.cleanmore.accountauthenticator.AuthenticationService

com.plweather.clean.cleanmore.accountauthenticator.SyncAdapterService

com.plweather.clean.cleanmore.phonemanager.NotificationMonitor

cn.jpush.android.service.PushService

cn.jpush.android.service.DaemonService

Android Permissions

2f59df9acab578af8148f0b5bfe68abddf38687ed285c6c49f5fe6aab1a194b2