815fdc322b4112e70344e98f0794a475f627a6b9e63d89dc38fced656cabdb50

General

Target

815fdc322b4112e70344e98f0794a475f627a6b9e63d89dc38fced656cabdb50
Size

8.8MB
MD5

baeb9b1a68599d2da7ed0484b0649c06
SHA1

61be81fbc810a02c58adaca17d8cb61b370a2d8b
SHA256

815fdc322b4112e70344e98f0794a475f627a6b9e63d89dc38fced656cabdb50
SHA512

aa6f11c8526cf4ac617ca8b5aefc986c3ee56c6556048ce265bafbc3ec44d7b8ee078a9cdcf51d1cb384936d8448d66d379a3dcaae8ce06daca4e58084ccd5e9
SSDEEP

196608:gcqzhVE3MP+NQKIrnTI2DIaEAwBpi5VhI+tRLYM3epMAsr:gpdVE/QzrT85Aw2V2MRJe2xr

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE

Requests dangerous framework permissions 11 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to record audio.	android.permission.RECORD_AUDIO

Files

815fdc322b4112e70344e98f0794a475f627a6b9e63d89dc38fced656cabdb50
.apk android arch:x86 arch:arm64 arch:arm

com.github.shadowsocks

com.github.shadowsocks.MainActivity

Activities

com.github.shadowsocks.MainActivity

android.intent.action.MAIN
android.service.quicksettings.action.QS_TILE_PREFERENCES
android.intent.action.VIEW
android.nfc.action.NDEF_DISCOVERED

com.github.shadowsocks.TaskerActivity

com.twofortyfouram.locale.intent.action.EDIT_SETTING

com.github.shadowsocks.QuickToggleShortcut

android.intent.action.CREATE_SHORTCUT

Permissions

android.permission.INTERNET
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.NFC
android.permission.CAMERA
android.permission.READ_PHONE_STATE
android.permission.READ_CONTACTS
android.permission.READ_CALL_LOG
android.permission.READ_SMS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.PROCESS_OUTGOING_CALLS
android.permission.RECORD_AUDIO
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
com.github.shadowsocks.permission.C2D_MESSAGE

Receivers

com.github.shadowsocks.BootReceiver

android.intent.action.BOOT_COMPLETED

com.github.shadowsocks.TaskerReceiver

com.twofortyfouram.locale.intent.action.FIRE_SETTING

com.evernote.android.job.v14.PlatformAlarmReceiver

com.evernote.android.job.v14.RUN_JOB
net.vrallev.android.job.v14.RUN_JOB

com.evernote.android.job.JobBootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.MY_PACKAGE_REPLACED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services

com.github.shadowsocks.ShadowsocksVpnService

android.net.VpnService

com.github.shadowsocks.ShadowsocksTileService

android.service.quicksettings.action.QS_TILE

com.evernote.android.job.gcm.PlatformGcmService

com.google.android.gms.gcm.ACTION_TASK_READY

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT
update_1.1.jar
.apk android

Android Permissions

815fdc322b4112e70344e98f0794a475f627a6b9e63d89dc38fced656cabdb50

Permissions

android.permission.INTERNET

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.NFC

android.permission.CAMERA

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.READ_SMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.PROCESS_OUTGOING_CALLS

android.permission.RECORD_AUDIO

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

com.google.android.c2dm.permission.RECEIVE

com.github.shadowsocks.permission.C2D_MESSAGE

Sharing

General

Malware Config

Signatures

Files

com.github.shadowsocks

com.github.shadowsocks.MainActivity

Activities

com.github.shadowsocks.MainActivity

com.github.shadowsocks.TaskerActivity

com.github.shadowsocks.QuickToggleShortcut

Permissions

Receivers

com.github.shadowsocks.BootReceiver

com.github.shadowsocks.TaskerReceiver

com.evernote.android.job.v14.PlatformAlarmReceiver

com.evernote.android.job.JobBootReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

Services

com.github.shadowsocks.ShadowsocksVpnService

com.github.shadowsocks.ShadowsocksTileService

com.evernote.android.job.gcm.PlatformGcmService

com.google.firebase.iid.FirebaseInstanceIdService

Android Permissions

815fdc322b4112e70344e98f0794a475f627a6b9e63d89dc38fced656cabdb50