pegasus | 2fc6435bd71cc4e52fb0526734b50000_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
2fc6435bd71cc4e52fb0526734b50000_JaffaCakes118
Size 9.1MB
Sample240510-ssvcaaff65
SHA256 59c059af923654a57cdcabe0652daf448200d51368ffd7610d4c5a421c0ca70e
MD5 2fc6435bd71cc4e52fb0526734b50000
SHA1 f034b7b93b0656a9721efeb03db7e0a596998f47
SHA512 cede8419d65992ea76fc5158539784aafbe698d425c9e8d8b722389aa16a7c6792e53e20202e331b5e8b10c64459ae02992952e15d947b6e633479c840ec8617
SSDEEP 196608:eytBtUOGLBNd/KexY/w2wgplItfErbjC7PxTP9nJ0biEDDNpSWwjE:eAULHdqTw8ly799nJvaPHwg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pegasus

Malware Config

Signatures

Pegasus family
pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus1

Requests dangerous framework permissions 16 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS

File Explorer

2fc6435bd71cc4e52fb0526734b50000_JaffaCakes118

.apk 9.1MB
RootRobot

.apk 10KB
ri.jar

.apk 30KB

2fc6435bd71cc4e52fb0526734b50000_JaffaCakes118

SHA256 59c059af923654a57cdcabe0652daf448200d51368ffd7610d4c5a421c0ca70e
MD5 2fc6435bd71cc4e52fb0526734b50000
SHA1 f034b7b93b0656a9721efeb03db7e0a596998f47
SHA512 cede8419d65992ea76fc5158539784aafbe698d425c9e8d8b722389aa16a7c6792e53e20202e331b5e8b10c64459ae02992952e15d947b6e633479c840ec8617
SSDEEP 196608:eytBtUOGLBNd/KexY/w2wgplItfErbjC7PxTP9nJ0biEDDNpSWwjE:eAULHdqTw8ly799nJvaPHwg
MD5 SHA1 SHA512 SSDEEP

android arch:arm

Pegasus payload

com.tencent.qqphonebook

android.permission.CAMERA android.permission.WRITE_SETTINGS android.permission.WRITE_CONTACTS android.permission.READ_CONTACTS android.permission.INTERNET android.permission.MODIFY_PHONE_STATE android.permission.READ_PHONE_STATE android.permission.PROCESS_OUTGOING_CALLS android.permission.WRITE_OWNER_DATA android.permission.RECEIVE_SMS android.permission.READ_SMS android.permission.WRITE_SMS android.permission.RECEIVE_MMS android.permission.CHANGE_CONFIGURATION android.permission.WRITE_EXTERNAL_STORAGE android.permission.CALL_PHONE android.permission.SEND_SMS android.permission.VIBRATE android.permission.ACCESS_WIFI_STATE android.permission.RECEIVE_BOOT_COMPLETED android.permission.ACCESS_NETWORK_STATE android.permission.CHANGE_NETWORK_STATE android.permission.MODIFY_AUDIO_SETTINGS android.permission.GET_ACCOUNTS android.permission.REORDER_TASKS android.permission.SYSTEM_ALERT_WINDOW android.permission.ACCESS_NETWORK_STATE android.permission.WAKE_LOCK android.permission.RECORD_AUDIO android.permission.PROCESS_OUTGOING_CALLS android.permission.READ_LOGS android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_WIFI_STATE android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.DISABLE_KEYGUARD android.permission.BATTERY_STATS android.permission.GET_TASKS android.permission.READ_LOGS com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT com.android.launcher.permission.READ_SETTINGS com.tencent.tpf.permission.qxinAccount com.tencent.permission.SHOW_LOCATION com.tencent.permission.CONTENT_PROVIDER com.tencent.tmsecure.permission.RECEIVE_SMS com.sec.android.provider.logsprovider.permission.READ_LOGS com.sec.android.provider.logsprovider.permission.WRITE_LOGS android.permission.FLASHLIGHT

.ui.PhoneBookActivity

android.intent.action.DIAL android.intent.action.DIAL android.intent.action.DIAL android.intent.action.MAIN android.intent.action.VIEW android.intent.action.DIAL android.intent.action.VIEW android.intent.action.CALL_BUTTON android.intent.action.MAIN android.intent.action.MAIN android.intent.action.VIEW

.ui.setting.AccountSettingActivity

com.tencent.mms.ui.MmsContainerActivity

.ui.contact.TabContactActivity

com.android.contacts.action.LIST_DEFAULT com.android.contacts.action.LIST_CONTACTS com.android.contacts.action.LIST_ALL_CONTACTS com.android.contacts.action.LIST_CONTACTS_WITH_PHONES com.android.contacts.action.LIST_STARRED com.android.contacts.action.LIST_FREQUENT com.android.contacts.action.LIST_STREQUENT

.ui.profile.QQLoginActivity

.ui.setting.AccountActivity

.ui.profile.PersonalCardEditActivity

.ui.contact.ContactBatchActivity

.ui.dial.TabDialActivity

com.android.phone.action.TOUCH_DIALER

.ui.msg.ClassZeroActivity

.ui.msg.TabConversationListActivity

.ui.msg.privatemsg.PrivateConversationListActivity

.ui.setting.MyWebView

.ui.msg.ConversationBatchActivity

.ui.msg.SmsBackgroundSettingActivity

.ui.msg.SmsBackgroundPreviewActivity

.ui.customcall.CustomCallSettingActivity

.ui.customcall.CustomCallPreviewActivity

.ui.ComposeMicroMsgActivity

.ui.msg.CombineComposeMsgActivity

android.intent.action.VIEW android.intent.action.VIEW android.intent.action.SENDTO android.intent.action.SEND

.ui.contact.ContactDetailActivity

android.intent.action.VIEW

.ui.msg.ShareByMMsIntentAcitivity

android.intent.action.SEND

.ui.msg.ShareByQxinIntentAcitivity

android.intent.action.SEND

.ui.msg.GraffitiActivity

.ui.msg.GraffitiTabActivity

.ui.msg.GraffitiDrawActivity

.ui.msg.PreviewGraffitiDrawPicActivity

.ui.profile.LoginActivity

.ui.sync.SyncActivity

.ui.sync.SyncSmsBatchActivity

.ui.sync.SyncWebActivity

.ui.sync.LogActivity

.ui.msg.ViewPhotoActivity

.ui.msg.ViewPhotoActivity2

.ui.msg.PhotoPreviewActivity

.ui.company.CompanyRegisterActivity

.ui.company.CompanySearchActivity

.ui.setting.AboutSettingActivity

.ui.sync.SyncHelpActivity

.ui.lock.LockHelpActivity

.ui.setting.QMessageHelpActivity

.ui.dial.SpringTravelCallHelpActivity

.ui.customcall.CustomCallHelpActivity

.ui.setting.HelpActivity

.ui.msg.RecipientsBatchActivity

.ui.contact.ContactInsertActivity

.ui.dial.NumberLocationFindActivity

.ui.toolbox.PluginMainActivity

.ui.TestDexClassLoaderActivity

.ui.dial.NumberFindActivity

.ui.dial.NumberFindGroupDetailActivity

.ui.dial.SpringTravelCallActivity

.ui.setting.DualSettingActivity

.ui.setting.SecretSettingActivity

.ui.toolbox.TabToolActivity

.ui.toolbox.ToolManageActivity

.ui.profile.RegisterForVCodeActivity

.ui.setting.QuickDialSettingsActivity

.ui.msg.privatemsg.PrivateContactActivity

.ui.msg.privatemsg.CheckLoginActivity

.ui.contact.FocusQuickCallTempActivity

.ui.msg.privatemsg.PrivateSettingsActivity

.ui.profile.InviteActivity

.ui.PhoneNumSelectDialogActivity

android.intent.action.VIEW

.ui.contact.ContactEditActivity

android.intent.action.EDIT android.intent.action.INSERT

.ui.contact.SimContactEditActivity

.ui.contact.MergeContactActivity

.ui.contact.AutoMergeContactActivity

.component.qqpimsecure.ui.activity.InterruptCenterActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.HelpActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.BWContactEditActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.FilterSettingActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.FilterModeSettingActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.KeyWordSettingActivity

.ui.contact.GroupManageActivity

.ui.contact.GroupSortActivity

.ui.contact.GroupEditBatchActivity

.ui.contact.FocusBatchActivity

.ui.CreateShortCutForDial

android.intent.action.CREATE_SHORTCUT

.ui.CreateShortCutForContacts

android.intent.action.CREATE_SHORTCUT

.ui.CreateShortCutForMMS

android.intent.action.CREATE_SHORTCUT

.ui.FirstGuideActivity

.ui.sync.SyncAuthorizationActivity

.ui.setting.PBDefaultTempActivity

.ui.setting.PbSettingActivity

.ui.customcall.CallTempActivity

.ui.lock.Lock

.ui.sync.SyncLoginForPrivateMsg

.ui.lock.LockForTab

.ui.lock.LockSettingActivity

.ui.lock.LockScopeSetting

.ui.lock.LockSafeActivity

.ui.lock.LockPasswordSettingActivity

.ui.lock.LockFilterAppList

.ui.profile.SignatureSetActivity

.ui.customcall.InCallScreen

.views.otherview.CropImage

.ui.setting.VoipSettingActivity

.ui.msg.GroupmemberListActivity

.ui.sync.SyncMainSettingActivity

.ui.sync.SynSetting

.ui.msg.SystemMsgActivity

.ui.msg.CloudSmsCategorySelectActivity

.ui.msg.CloudSmsSelectActivity

.ui.contact.ContactInsertOrNewActivity

android.intent.action.INSERT_OR_EDIT

.ui.pengyou.LoadPengyouNetInfoActivity

.ui.pengyou.ShowPengyouContactListActivity

.ui.msg.EditRecipientNicknameActivity

.ui.msg.LockMsgAcitivity

.ui.setting.FontSizeSetting

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.ContactSelectActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.FilterCommonSettingActivity

com.tencent.qqphonebook.component.qqpimsecure.ui.activity.DoubleCallDialog

com.tencent.feedback.eup.ConfirmDialog

com.tencent.mqq.wsd.fb.eup.comfirm

.ui.setting.MainSettingActivity

com.tencent.qqphonebook.ui.toolbox.ToolsListActivity

.ui.setting.ContactSettingActivity

.ui.customcall.CallSettingActivity

.ui.setting.RootSettingActivity

.ui.setting.MmsSettingActivity

.ui.setting.DisplaySettingActivity

.ui.setting.AccountSelectActivity

.ui.contact.birthday.BirthdayContactsActivity

.ui.contact.birthday.BirthdaySettingActivity

.ui.scheduletask.ScheduleTaskEditActivity

.ui.scheduletask.ScheduleHistoryTaskActivity

.ui.msg.ViewAnimateSmileyActivity

.ui.setting.TestThemeActivity

.ui.scheduletask.ScheduleNotifyActivity

.ui.ipcall.IPCallActivity

.ui.ipcall.IPHelpActivity

.ui.ipcall.IPNOCallPhoneNumActivity

com.google.zxing.client.android.CaptureActivity

com.google.zxing.client.android.ShowQRCodeActivity

com.google.zxing.client.android.TextActivity

.ui.widget.QQPhoneBookWidgetProvider

com.tencent.action.PHONEBOOK_WIDGET_MSGUNREAD com.tencent.action.PHONEBOOK_WIDGET_CALLUNREAD android.appwidget.action.APPWIDGET_UPDATE

.common.service.DateTimeReceiver

android.intent.action.DATE_CHANGED android.intent.action.TIME_SET

.common.service.ConnectReceiver

android.net.conn.CONNECTIVITY_CHANGE

.component.qxin.QXinReceiver

com.msms.SEND_MESSAGE com.msms.MESSAGE_SENT com.msms.SMS_RECEIVED com.hipb.REG_SMS_ACTION com.hipb.REG_DELIVERY_ACTION

.component.remote.SmsNotifyReceiver

com.android.mms.transaction.MESSAGE_SENT android.intent.action.SEND_MESSAGE

.component.remote.SmsReceiver

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_RECEIVED2

.component.remote.SmsStatusReceiver

com.msms.MESSAGE_STATUS_RECEIVED com.android.mms.transaction.MessageStatusReceiver.MESSAGE_STATUS_RECEIVED

.common.service.SDCardReceiver

android.intent.action.MEDIA_MOUNTED android.intent.action.MEDIA_EJECT android.intent.action.MEDIA_UNMOUNTED android.intent.action.MEDIA_SHARED android.intent.action.MEDIA_CHECKING android.intent.action.MEDIA_REMOVED

.component.remote.BootReceiver

android.intent.action.BOOT_COMPLETED

.component.remote.PbPushReceiver

com.tencent.qqphonebook.action_push_tick com.tencent.qqphonebook.action_recieve_sms com.tencent.qqphonebook.action_recieve_mms

com.tencent.qqpim.sdk.receiver.CommReceiver

action.com.tencent.qqpim.comm

.component.customcall.CustomCallReceiver

android.intent.action.PHONE_STATE android.intent.action.PHONE_STATE_2 android.intent.action.PHONE_STATE2 android.intent.action.PHONE_STATE_EXT

.component.remote.CallStateReceiver

android.intent.action.NEW_OUTGOING_CALL android.intent.action.PHONE_STATE android.intent.action.PHONE_STATE_2 android.intent.action.PHONE_STATE2 android.intent.action.PHONE_STATE_EXT com.tencent.action.SHOW_LOCATION

com.android.mms.transaction.PushReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED android.provider.Telephony.WAP_PUSH_RECEIVED

com.android.mms.transaction.MmsSystemEventReceiver

android.intent.action.CONTENT_CHANGED android.intent.action.BOOT_COMPLETED

.component.vtalk.VoipCallinReceiver

VoipCallin

.component.qxin.AccountReceiver

detect_account

.component.remote.PkgInstallReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_RESTARTED android.intent.action.PACKAGE_CHANGED android.intent.action.PACKAGE_INSTALL

.component.customcall.HeadsetStateReceiver

android.intent.action.HEADSET_PLUG

com.tencent.qqphonebook.common.service.UserPresentReceiver

android.intent.action.USER_PRESENT

Android Permissions

2fc6435bd71cc4e52fb0526734b50000_JaffaCakes118

Permissions

android.permission.CAMERA

android.permission.WRITE_SETTINGS

android.permission.WRITE_CONTACTS

android.permission.READ_CONTACTS

android.permission.INTERNET

android.permission.MODIFY_PHONE_STATE

android.permission.READ_PHONE_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.permission.WRITE_OWNER_DATA

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_MMS

android.permission.CHANGE_CONFIGURATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CALL_PHONE

android.permission.SEND_SMS

android.permission.VIBRATE

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.GET_ACCOUNTS

android.permission.REORDER_TASKS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.RECORD_AUDIO

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_LOGS

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.DISABLE_KEYGUARD

android.permission.BATTERY_STATS

android.permission.GET_TASKS

android.permission.READ_LOGS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.tencent.tpf.permission.qxinAccount

com.tencent.permission.SHOW_LOCATION

com.tencent.permission.CONTENT_PROVIDER

com.tencent.tmsecure.permission.RECEIVE_SMS

com.sec.android.provider.logsprovider.permission.READ_LOGS

com.sec.android.provider.logsprovider.permission.WRITE_LOGS

android.permission.FLASHLIGHT