5039d7038eb55d127685f3bc28601d44_JaffaCakes118

General

Target
5039d7038eb55d127685f3bc28601d44_JaffaCakes118
Size 15.3MB
Sample240517-s3pjsaee24
SHA256 60fa38ba267e5cbebe9c10ca95dd93fa01f27aa982ca759fde1f7296b80bf1c0
MD5 5039d7038eb55d127685f3bc28601d44
SHA1 8d0710b5e15cc73f2b98ca905195cbf042e515c7
SHA512 79ff97587ce36d562d2d4508287d6275c3b3d8e96a07d38375676735d66693afef6e9319fd046ce487b248498a833f1af6cd67e7398b06f947962c9812cee93c
SSDEEP 393216:ZKmqaL7Qkzv21yRwqTilIk3C/Y8nvsEeQEtPKSkCBdlbAA:ZOa3BztTWlzCQ8EcEcfCBdp
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA

File Explorer

5039d7038eb55d127685f3bc28601d44_JaffaCakes118

.apk 15.3MB
amap_resource1_0_0.png

.apk 24KB

5039d7038eb55d127685f3bc28601d44_JaffaCakes118

SHA256 60fa38ba267e5cbebe9c10ca95dd93fa01f27aa982ca759fde1f7296b80bf1c0
MD5 5039d7038eb55d127685f3bc28601d44
SHA1 8d0710b5e15cc73f2b98ca905195cbf042e515c7
SHA512 79ff97587ce36d562d2d4508287d6275c3b3d8e96a07d38375676735d66693afef6e9319fd046ce487b248498a833f1af6cd67e7398b06f947962c9812cee93c
SSDEEP 393216:ZKmqaL7Qkzv21yRwqTilIk3C/Y8nvsEeQEtPKSkCBdlbAA:ZOa3BztTWlzCQ8EcEcfCBdp
MD5 SHA1 SHA512 SSDEEP

android arch:arm

Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

com.vigo.tongchengservice

com.vigo.tongchengservice.ui.AppSplashActivity

android.intent.action.MAIN

com.vigo.tongchengservice.ui.SplashAcitvity

com.vigo.tongchengservice.ui.MainActivity

com.vigo.tongchengservice.ui.LoginActivity

com.vigo.tongchengservice.ui.WebviewActivity

com.vigo.tongchengservice.ui.BangdingshoujiActivity

com.vigo.tongchengservice.ui.OrderInfoActivity

com.vigo.tongchengservice.ui.ChuxingShensuActivity

com.vigo.tongchengservice.ui.OrderListActivity

com.vigo.tongchengservice.ui.ChuxingShowMessageActivity

com.vigo.tongchengservice.ui.QianbaoActivity

com.vigo.tongchengservice.wxapi.WXEntryActivity

com.vigo.tongchengservice.ui.RememberPasswordActivity

com.vigo.tongchengservice.ui.EditAvatarActivity

com.vigo.tongchengservice.ui.EditpassActivity

com.vigo.tongchengservice.ui.RegisterActivity

com.vigo.tongchengservice.ui.MessageActivity

com.vigo.tongchengservice.ui.ShezhiActivity

com.vigo.tongchengservice.ui.DingweiActivity

com.vigo.tongchengservice.ui.RouteSearchActivity

com.vigo.tongchengservice.ui.JiedanShezhiActivity

com.lwkandroid.imagepicker.ui.grid.view.ImageDataActivity

com.lwkandroid.imagepicker.ui.pager.view.ImagePagerActivity

com.lwkandroid.imagepicker.ui.pager.view.ImageViewActivity

com.lwkandroid.imagepicker.ui.crop.ImageCropActivity

Android Permissions

5039d7038eb55d127685f3bc28601d44_JaffaCakes118

Permissions

android.permission.READ_EXTERNAL_STORAGE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CALL_PHONE

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

android.permission.DISABLE_KEYGUARD

android.permission.CAMERA

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

android.permission.BROADCAST_PACKAGE_ADDED

android.permission.BROADCAST_PACKAGE_CHANGED

android.permission.BROADCAST_PACKAGE_INSTALL

android.permission.BROADCAST_PACKAGE_REPLACED

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.ACCESS_DOWNLOAD_MANAGER

android.permission.CAMERA

android.permission.CHANGE_CONFIGURATION

android.permission.RESTART_PACKAGES

android.permission.GET_TASKS

android.permission.CHANGE_NETWORK_STATE

com.vigo.tongchengservice.permission.MIPUSH_RECEIVE

com.meizu.flyme.push.permission.RECEIVE

com.vigo.tongchengservice.push.permission.MESSAGE

com.meizu.c2dm.permission.RECEIVE

com.vigo.tongchengservice.permission.C2D_MESSAGE

Sharing

General

Malware Config

Signatures

File Explorer

5039d7038eb55d127685f3bc28601d44_JaffaCakes118

com.vigo.tongchengservice.ui.AppSplashActivity

com.vigo.tongchengservice.ui.SplashAcitvity

com.vigo.tongchengservice.ui.MainActivity

com.vigo.tongchengservice.ui.LoginActivity

com.vigo.tongchengservice.ui.WebviewActivity

com.vigo.tongchengservice.ui.BangdingshoujiActivity

com.vigo.tongchengservice.ui.OrderInfoActivity

com.vigo.tongchengservice.ui.ChuxingShensuActivity

com.vigo.tongchengservice.ui.OrderListActivity

com.vigo.tongchengservice.ui.ChuxingShowMessageActivity

com.vigo.tongchengservice.ui.QianbaoActivity

com.vigo.tongchengservice.wxapi.WXEntryActivity

com.vigo.tongchengservice.ui.RememberPasswordActivity

com.vigo.tongchengservice.ui.EditAvatarActivity

com.vigo.tongchengservice.ui.EditpassActivity

com.vigo.tongchengservice.ui.RegisterActivity

com.vigo.tongchengservice.ui.MessageActivity

com.vigo.tongchengservice.ui.ShezhiActivity

com.vigo.tongchengservice.ui.DingweiActivity

com.vigo.tongchengservice.ui.RouteSearchActivity

com.vigo.tongchengservice.ui.JiedanShezhiActivity

com.lwkandroid.imagepicker.ui.grid.view.ImageDataActivity

com.lwkandroid.imagepicker.ui.pager.view.ImagePagerActivity

com.lwkandroid.imagepicker.ui.pager.view.ImageViewActivity

com.lwkandroid.imagepicker.ui.crop.ImageCropActivity

com.amap.api.location.APSService

com.taobao.accs.ChannelService

com.taobao.accs.data.MsgDistributeService

com.taobao.accs.internal.AccsJobService

com.taobao.accs.ChannelService$KernelService

org.android.agoo.accs.AgooService

com.umeng.message.UmengIntentService

com.umeng.message.XiaomiIntentService

com.umeng.message.UmengMessageIntentReceiverService

com.umeng.message.UmengMessageCallbackHandlerService

com.umeng.message.UmengDownloadResourceService

com.xiaomi.mipush.sdk.PushMessageHandler

com.xiaomi.mipush.sdk.MessageHandleService

com.vigo.tongchengservice.utils.ApkInstallReceiver

com.taobao.accs.EventReceiver

com.taobao.accs.ServiceReceiver

com.taobao.agoo.AgooCommondReceiver

com.umeng.message.NotificationProxyBroadcastReceiver

org.android.agoo.xiaomi.MiPushBroadcastReceiver

org.android.agoo.huawei.HuaWeiReceiver

com.lwkandroid.imagepicker.utils.ImagePickerFileProvider

com.umeng.message.provider.MessageProvider

amap_resource1_0_0.png

Android Permissions

5039d7038eb55d127685f3bc28601d44_JaffaCakes118