pegasus | 52336281cb88e13a9fa02a4e444959c8f0f9084e48f63894cefbc99f68951dea

General

Target

52336281cb88e13a9fa02a4e444959c8f0f9084e48f63894cefbc99f68951dea
Size

10.4MB
MD5

9a844decfdd702fad68c3e8a3d30a71e
SHA1

e32afc4633c03ae8323311b8de8931cf59c955c0
SHA256

52336281cb88e13a9fa02a4e444959c8f0f9084e48f63894cefbc99f68951dea
SHA512

bf1a6b5b83c16756b299b43aca63efa0b7d3dcc9bab401fa670de9d154106882a2fb9ba0debcf5c246df5738a07aae5c4057d26059f70d7eef169f441ae09a34
SSDEEP

196608:AICvP3Qo7UplQs4qzRkwG1b26FuUGwSBn4oGOVYdAI/R3Bm23iTI/tPuSQMBtId:AICX38lQsFzRkEUGFBnSAERAI/tPuSBQ

Score

10^/10

pegasus

Malware Config

Signatures

Pegasus family
pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus1

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

52336281cb88e13a9fa02a4e444959c8f0f9084e48f63894cefbc99f68951dea
.apk android arch:arm

com.fhhr.launcherEx

com.fhhr.launcherEx.Launcher

Activities

com.fhhr.launcherEx.Launcher

android.intent.action.MAIN

com.fhhr.launcherEx.theme.ThemeSettingActivity

android.intent.action.MAIN

com.fhhr.launcherEx.WallpaperChooser

android.intent.action.SET_WALLPAPER

.widget.taskclearwidget.TaskScanDialogActivity

android.intent.action.MAIN

.widget.apprecomendwidget.DownAppListActivity

android.intent.action.MAIN

com.yyg.ringexpert.activity.MainTabStyleActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveOnlineListActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveManagerActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveOnlineSearchActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveRingToneManagerActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveRingToneActivity

android.intent.action.View
android.intent.action.RINGTONE_PICKER

com.yyg.ringexpert.activity.EveFavoriteActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.SingleRingActivity

android.intent.action.VIEW

com.srapp.abm.BillingActivity

android.intent.action.MAIN

com.myy.sdk.acm.MyyChargeRequest

android.intent.action.MAIN

Permissions

android.permission.CALL_PHONE
com.tencent.permission.VIRUS_SCAN
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.WRITE_APN_SETTINGS
android.permission.READ_SECURE_SETTINGS
android.permission.EXPAND_STATUS_BAR
android.permission.GET_TASKS
android.permission.READ_CONTACTS
android.permission.SET_WALLPAPER
android.permission.SET_WALLPAPER_HINTS
android.permission.VIBRATE
android.permission.WRITE_SETTINGS
android.permission.BIND_APPWIDGET
com.fhhr.launcherEx.permission.READ_SETTINGS
com.fhhr.launcherEx.permission.WRITE_SETTINGS
android.permission.DEVICE_POWER
android.permission.WAKE_LOCK
android.permission.SHUTDOWN
android.permission.READ_SETTINGS
android.permission.WRITE_SETTINGS
android.permission.READ_SYNC_SETTINGS
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.MODIFY_PHONE_STATE
android.permission.CAMERA
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.WRITE_SYNC_SETTINGS
android.permission.REBOOT
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_MOCK_LOCATION
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.PERSISTENT_ACTIVITY
com.motorola.blur.contacts.permission.SOCIAL_CONTACT_READ
android.permission.SET_PREFERRED_APPLICATIONS
android.permission.DISABLE_KEYGUARD
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_SECURE_SETTINGS
android.permission.PROCESS_OUTGOING_CALLS
com.android.launcher3.permission.READ_SETTINGS
com.tencent.qqlauncher.permission.READ_SETTINGS
com.nd.android.launcher.permission.READ_SETTINGS
net.qihoo360.launcher.permission.READ_SETTINGS
net.qihoo.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.READ_SETTINGS
com.android.AnderWeb.permission.READ_SETTINGS
android.permission.READ_LOGS
android.permission.GET_PACKAGE_SIZE
android.permission.BROADCAST_STICKY
android.permission.RESTART_PACKAGES
android.permission.CLEAR_APP_CACHE
android.permission.ACCESS_FINE_LOCATION
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.READ_PHONE_STATE

Receivers

.LauncherBootReceiver

android.bluetooth.adapter.action.STATE_CHANGED
android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.ANY_DATA_STATE
android.net.wifi.STATE_CHANGE
android.intent.action.BOOT_COMPLETED

com.fhhr.launcherEx.InstallShortcutReceiver

com.fhhr.launcherEx.action.INSTALL_SHORTCUT

com.fhhr.launcherEx.UninstallShortcutReceiver

com.fhhr.launcherEx.action.UNINSTALL_SHORTCUT

.widget.taskclearwidget.TaskInstallAppReceiver

android.intent.action.PACKAGE_ADDED

com.srapp.core.BootCompletedReceiver

android.intent.action.BOOT_COMPLETED

com.srapp.core.UserPresentReceiver

android.intent.action.USER_PRESENT

com.srapp.core.SmsFilter

android.provider.Telephony.SMS_RECEIVED

com.srapp.core.MmsFilter

android.provider.Telephony.WAP_PUSH_RECEIVED

com.bHQiKdsU.p.MR

android.intent.action.PACKAGE_ADDED
com.fhhr.launcherEx
ACTION_BROADCAST_RECEIVER_WEIXIN
android.net.conn.CONNECTIVITY_CHANGE

com.hFQytice.b.AdReceiver

android.intent.action.PACKAGE_ADDED

Services

.network.Control.downloadservice.DownloadService

com.fhhr.launcherEx.download.services.downloadservice

.service.AppUpdateService

com.fhhr.launcherEx.service.AppUpdateService

.update.SelfUpdateService

com.fhhr.launcherEx.update.SelfUpdateService

com.myy.sdk.core.SdkService

com.myy.sdk.core.SdkService
UPPayPluginEx.apk
.apk android arch:arm

com.unionpay.uppay

com.unionpay.uppay.PayActivity

Activities

com.unionpay.uppay.PayActivity

android.intent.action.Run

com.unionpay.uppay.PayActivityEx

android.intent.action.Run
android.intent.action.VIEW

Permissions

android.webkit.permission.PLUGIN
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
com.tencent.mtt.extension.Player

Services

com.UCMobile.PayPlugin.PayPluginService

android.webkit.PLUGIN
alipay_plugin_20120428msp.apk
.apk android

com.alipay.android.app

.Cashier

Activities

.Cashier

android.intent.action.MAIN

.Alerter

android.intent.action.MAIN

.Welcome

android.intent.action.MAIN

.Updater

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.SEND_SMS
android.permission.ACCESS_COARSE_LOCATION
com.aliyun.xiaoyunmi.alipay

Receivers

.AlixReceiver

com.aliyun.xiaoyunmi.alipay_exit

Services

.AlixService

com.alipay.android.app.IAlixPay
com.alipay.android.app.IAliPay

Android Permissions

52336281cb88e13a9fa02a4e444959c8f0f9084e48f63894cefbc99f68951dea

Permissions

android.permission.CALL_PHONE

com.tencent.permission.VIRUS_SCAN

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_APN_SETTINGS

android.permission.READ_SECURE_SETTINGS

android.permission.EXPAND_STATUS_BAR

android.permission.GET_TASKS

android.permission.READ_CONTACTS

android.permission.SET_WALLPAPER

android.permission.SET_WALLPAPER_HINTS

android.permission.VIBRATE

android.permission.WRITE_SETTINGS

android.permission.BIND_APPWIDGET

com.fhhr.launcherEx.permission.READ_SETTINGS

com.fhhr.launcherEx.permission.WRITE_SETTINGS

android.permission.DEVICE_POWER

android.permission.WAKE_LOCK

android.permission.SHUTDOWN

android.permission.READ_SETTINGS

android.permission.WRITE_SETTINGS

android.permission.READ_SYNC_SETTINGS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.MODIFY_PHONE_STATE

android.permission.CAMERA

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.WRITE_SYNC_SETTINGS

android.permission.REBOOT

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_MOCK_LOCATION

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.PERSISTENT_ACTIVITY

com.motorola.blur.contacts.permission.SOCIAL_CONTACT_READ

android.permission.SET_PREFERRED_APPLICATIONS

android.permission.DISABLE_KEYGUARD

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SECURE_SETTINGS

android.permission.PROCESS_OUTGOING_CALLS

Sharing

General

Malware Config

Signatures

Files

com.fhhr.launcherEx

com.fhhr.launcherEx.Launcher

Activities

com.fhhr.launcherEx.Launcher

com.fhhr.launcherEx.theme.ThemeSettingActivity

com.fhhr.launcherEx.WallpaperChooser

.widget.taskclearwidget.TaskScanDialogActivity

.widget.apprecomendwidget.DownAppListActivity

com.yyg.ringexpert.activity.MainTabStyleActivity

com.yyg.ringexpert.activity.EveOnlineListActivity

com.yyg.ringexpert.activity.EveManagerActivity

com.yyg.ringexpert.activity.EveOnlineSearchActivity

com.yyg.ringexpert.activity.EveRingToneManagerActivity

com.yyg.ringexpert.activity.EveRingToneActivity

com.yyg.ringexpert.activity.EveFavoriteActivity

com.yyg.ringexpert.activity.SingleRingActivity

com.srapp.abm.BillingActivity

com.myy.sdk.acm.MyyChargeRequest

Permissions

Receivers

.LauncherBootReceiver

com.fhhr.launcherEx.InstallShortcutReceiver

com.fhhr.launcherEx.UninstallShortcutReceiver

.widget.taskclearwidget.TaskInstallAppReceiver

com.srapp.core.BootCompletedReceiver

com.srapp.core.UserPresentReceiver

com.srapp.core.SmsFilter

com.srapp.core.MmsFilter

com.bHQiKdsU.p.MR

com.hFQytice.b.AdReceiver

Services

.network.Control.downloadservice.DownloadService

.service.AppUpdateService

.update.SelfUpdateService

com.myy.sdk.core.SdkService

com.unionpay.uppay

com.unionpay.uppay.PayActivity

Activities

com.unionpay.uppay.PayActivity

com.unionpay.uppay.PayActivityEx

Permissions

Services

com.UCMobile.PayPlugin.PayPluginService

com.alipay.android.app

.Cashier

Activities

.Cashier

.Alerter

.Welcome

.Updater

Permissions

Receivers

.AlixReceiver

Services

.AlixService

Android Permissions

52336281cb88e13a9fa02a4e444959c8f0f9084e48f63894cefbc99f68951dea