privateloader | 3052f098b40e14811eb8f75924dc83c7_JaffaCakes118

General

Target
3052f098b40e14811eb8f75924dc83c7_JaffaCakes118
Size 26.7MB
Sample240510-whp7csda42
SHA256 6aa5b771a8e2414a936daf01672e27b3fc0c332458bcf925799f4f9bb1567ae0
MD5 3052f098b40e14811eb8f75924dc83c7
SHA1 3b6a0665c6802a485007479f9ec5e64c0bf2bbc2
SHA512 50d0811190d200cdb58695d5acd43e2adbf3bf5877ee8607305575df3558e8dc7b22410c35c13072af87758511199074712c1b3ab4539fcfd6fb4b5172c8b298
SSDEEP 786432:UzmxQXmEo83z8UMs+O54YjGDxVAH2E1RQDq2ph4z:UaxQ2EooMajGDxVAH2YQDxp+z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

File Explorer

3052f098b40e14811eb8f75924dc83c7_JaffaCakes118

.apk 26.7MB
zsy24_30.png

.apk 2.5MB

3052f098b40e14811eb8f75924dc83c7_JaffaCakes118

SHA256 6aa5b771a8e2414a936daf01672e27b3fc0c332458bcf925799f4f9bb1567ae0
MD5 3052f098b40e14811eb8f75924dc83c7
SHA1 3b6a0665c6802a485007479f9ec5e64c0bf2bbc2
SHA512 50d0811190d200cdb58695d5acd43e2adbf3bf5877ee8607305575df3558e8dc7b22410c35c13072af87758511199074712c1b3ab4539fcfd6fb4b5172c8b298
SSDEEP 786432:UzmxQXmEo83z8UMs+O54YjGDxVAH2E1RQDq2ph4z:UaxQ2EooMajGDxVAH2YQDxp+z
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86

com.fgs.rsonw

zsy24_30.png

SHA256 4a4e3489af659b040032a1d8e9fd5b82122203c2ec791166ec9e364a11006d23
MD5 7b7fcd4926b83c3d77e4b41592df24a6
SHA1 cd4d484d09b7fa81c2e573fcef2dff1a852b8a1e
SHA512 e6eeea2c4af58e3e30c30769a0300737aed6c45d20a2f3241f3569fe994a370fe9fc281b29899fc05ba162b1485697228c26027c4693fb458bba6aac0a6cd61d
SSDEEP 49152:QzGO+0NaQL4Tbl4KgNnP+6jbrcnuGB6Q8duhyUqst+NAEil4Z0W:6GO+0EIP+6jLGB6duhfLt2i2Zj
MD5 SHA1 SHA512 SSDEEP

android arch:arm

com.rtk.app

com.rtk.app.Welcome

android.intent.action.MAIN

com.rtk.app.MainActivity

com.rtk.app.DownloadWebview

com.rtk.app.Download

com.rtk.app.SecondPage

com.rtk.app.Filter

com.rtk.app.AutoInstallDialog

com.rtk.app.APPDetailActivity

com.rtk.app.GiftFiltter

com.rtk.app.MyGiftActivity

com.rtk.app.AdActivity

com.rtk.app.GiftBagActivity

com.rtk.app.OpenServerActivity

com.rtk.app.GiftDetailActivity

com.rtk.app.APPPictureDetai

com.rtk.app.Login

com.rtk.app.Register

com.rtk.app.ApkManager

com.rtk.app.AppManager

com.rtk.app.Setting

com.rtk.app.MyTheam

com.rtk.app.Forget

com.rtk.app.PersonData

com.rtk.app.PersonItem1

com.rtk.app.PersonItem2

com.rtk.app.PersonItem3

com.rtk.app.SetEmail

com.rtk.app.SetNickname

com.rtk.app.SetQQ

com.rtk.app.SetBirthday

com.rtk.app.SetSex

com.rtk.app.SetSignature

com.rtk.app.Words

com.rtk.app.About

com.rtk.app.UpdatePwd

com.rtk.app.SelectPicPopupWindow

com.rtk.app.Pic

com.rtk.app.SignValidateActivity

com.rtk.app.UninstallAPKActivity

com.rtk.app.UninstallZIPActivity

com.zbar.lib.CaptureActivity

com.mob.tools.MobUIShell

android.intent.action.VIEW

.wxapi.WXEntryActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

Android Permissions

3052f098b40e14811eb8f75924dc83c7_JaffaCakes118

Permissions

android.permission.INTERNET

com.android.vending.BILLING

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_EXTERNAL_STORAGE

Sharing

General

Malware Config

Signatures

File Explorer

3052f098b40e14811eb8f75924dc83c7_JaffaCakes118

com.unity3d.player.UnityPlayerActivity

com.unity.purchasing.googleplay.PurchaseActivity

com.unity.purchasing.googleplay.VRPurchaseActivity

com.unity3d.ads.adunit.AdUnitActivity

com.unity3d.ads.adunit.AdUnitTransparentActivity

com.unity3d.ads.adunit.AdUnitTransparentSoftwareActivity

com.unity3d.ads.adunit.AdUnitSoftwareActivity

com.bangcle.everisk.stub.NewActivity

com.hippogames.simpleandroidnotifications.Controller

com.hippogames.simpleandroidnotifications.RebootManager

com.bangcle.everisk.stub.AlarmReceiver

android.support.v4.content.FileProvider

zsy24_30.png

com.rtk.app.Welcome

com.rtk.app.MainActivity

com.rtk.app.DownloadWebview

com.rtk.app.Download

com.rtk.app.SecondPage

com.rtk.app.Filter

com.rtk.app.AutoInstallDialog

com.rtk.app.APPDetailActivity

com.rtk.app.GiftFiltter

com.rtk.app.MyGiftActivity

com.rtk.app.AdActivity

com.rtk.app.GiftBagActivity

com.rtk.app.OpenServerActivity

com.rtk.app.GiftDetailActivity

com.rtk.app.APPPictureDetai

com.rtk.app.Login

com.rtk.app.Register

com.rtk.app.ApkManager

com.rtk.app.AppManager

com.rtk.app.Setting

com.rtk.app.MyTheam

com.rtk.app.Forget

com.rtk.app.PersonData

com.rtk.app.PersonItem1

com.rtk.app.PersonItem2

com.rtk.app.PersonItem3

com.rtk.app.SetEmail

com.rtk.app.SetNickname

com.rtk.app.SetQQ

com.rtk.app.SetBirthday

com.rtk.app.SetSex

com.rtk.app.SetSignature

com.rtk.app.Words

com.rtk.app.About

com.rtk.app.UpdatePwd

com.rtk.app.SelectPicPopupWindow

com.rtk.app.Pic

com.rtk.app.SignValidateActivity

com.rtk.app.UninstallAPKActivity

com.rtk.app.UninstallZIPActivity

com.zbar.lib.CaptureActivity

com.mob.tools.MobUIShell

.wxapi.WXEntryActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

com.igexin.sdk.PushService

com.igexin.sdk.PushServiceUser

com.igexin.download.DownloadService

com.rtk.tools.MyAccessibilityService

com.rtk.tools.BootReceiver

com.getui.demo.PushDemoReceiver

com.igexin.sdk.PushReceiver

com.igexin.sdk.PushManagerReceiver

com.igexin.download.DownloadReceiver

com.igexin.download.DownloadProvider

Android Permissions

3052f098b40e14811eb8f75924dc83c7_JaffaCakes118