5878e275685b971b7c244350dfbae17b_JaffaCakes118

General

Target
5878e275685b971b7c244350dfbae17b_JaffaCakes118
Size 3.5MB
Sample240519-epdngahf4s
SHA256 3310976ddfb38b163a4472a0633cf38d8d4e94ce2fb758de49ab06482d82191d
MD5 5878e275685b971b7c244350dfbae17b
SHA1 cda5ccc1b5dd48f8a7720b4cdf7899b29e960038
SHA512 5584ae4410e79d0e7ac26afa92ee2440dab729acfb499e9ade5954fbd4cf6339a4ef2939e92783e4aba37ecdfc34d03e31dffc9756067ab5161d9c135fc7022a
SSDEEP 98304:pD+CRsWBkOsETaKOV9xplaGOSt7rviQQxxk6X:5+CXuOsTUGpZvijP
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

File Explorer

5878e275685b971b7c244350dfbae17b_JaffaCakes118

.apk 3.5MB
__pasys_remote_banner.jar

.apk 108KB
gdtadv2.jar

.apk 73KB

5878e275685b971b7c244350dfbae17b_JaffaCakes118

SHA256 3310976ddfb38b163a4472a0633cf38d8d4e94ce2fb758de49ab06482d82191d
MD5 5878e275685b971b7c244350dfbae17b
SHA1 cda5ccc1b5dd48f8a7720b4cdf7899b29e960038
SHA512 5584ae4410e79d0e7ac26afa92ee2440dab729acfb499e9ade5954fbd4cf6339a4ef2939e92783e4aba37ecdfc34d03e31dffc9756067ab5161d9c135fc7022a
SSDEEP 98304:pD+CRsWBkOsETaKOV9xplaGOSt7rviQQxxk6X:5+CXuOsTUGpZvijP
MD5 SHA1 SHA512 SSDEEP

android arch:arm

com.ivali.qhbao

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

com.tencent.connect.common.AssistActivity

com.ivali.qhbao.MainActivity

android.intent.action.MAIN

com.ivali.qhbao.SplashActivity

android.intent.action.MAIN

com.ivali.qhbao.CleanAcvitity

com.ivali.qhbao.questiontips.NewRankingActivity

com.ivali.qhbao.questiontips.CommonQuestionActivity

com.ivali.qhbao.questiontips.Speed_Up_activity

com.ivali.qhbao.questiontips.Send_Proplem_activity

android.intent.action.MAIN

com.ivali.qhbao.questiontips.SettingActivity

com.ivali.qhbao.UpdateActivity

com.ivali.qhbao.SpecialThanksActivity

com.ivali.qhbao.questiontips.HelpActivity

com.ivali.qhbao.ActivityIntruductionActivity

com.ivali.qhbao.questiontips.ForbidReadActivity

com.ivali.qhbao.wxapi.WXEntryActivity

com.ivali.qhbao.questiontips.FeedbackActivity

com.ivali.qhbao.questiontips.FeedbackActivity_qq

com.ivali.qhbao.WxUtility

android.intent.action.MAIN

com.qq.e.ads.ADActivity

com.ivali.qhbao.NeedToRootActivity

com.ivali.qhbao.NativeStreamActivity

com.ivali.qhbao.ProtectorActivity

com.ivali.qhbao.MarketAppActivity

com.baidu.mobads.AppActivity

com.ivali.qhbao.common.FloatingTopActivity

android.intent.action.MAIN

Android Permissions

5878e275685b971b7c244350dfbae17b_JaffaCakes118

Permissions

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.DISABLE_KEYGUARD

android.permission.GET_TASKS

android.permission.INTERNET

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.PACKAGE_USAGE_STATS

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WAKE_LOCK

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

com.ivali.qhbao.permission.PRIVATE_SERVICE

5878e275685b971b7c244350dfbae17b_JaffaCakes118

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

com.ivali.qhbao.MainActivity

com.ivali.qhbao.SplashActivity

com.ivali.qhbao.CleanAcvitity

com.ivali.qhbao.questiontips.NewRankingActivity

com.ivali.qhbao.questiontips.CommonQuestionActivity

com.ivali.qhbao.questiontips.Speed_Up_activity

com.ivali.qhbao.questiontips.Send_Proplem_activity

com.ivali.qhbao.questiontips.SettingActivity

com.ivali.qhbao.UpdateActivity

com.ivali.qhbao.SpecialThanksActivity

com.ivali.qhbao.questiontips.HelpActivity

com.ivali.qhbao.ActivityIntruductionActivity

com.ivali.qhbao.questiontips.ForbidReadActivity

com.ivali.qhbao.wxapi.WXEntryActivity

com.ivali.qhbao.questiontips.FeedbackActivity

com.ivali.qhbao.questiontips.FeedbackActivity_qq

com.ivali.qhbao.WxUtility

com.qq.e.ads.ADActivity

com.ivali.qhbao.NeedToRootActivity

com.ivali.qhbao.NativeStreamActivity

com.ivali.qhbao.ProtectorActivity

com.ivali.qhbao.MarketAppActivity

com.baidu.mobads.AppActivity

com.ivali.qhbao.common.FloatingTopActivity

com.ivali.qhbao.WxAccessibilityService

com.qq.e.comm.DownloadService

com.ivali.qhbao.DaemonService

__pasys_remote_banner.jar

gdtadv2.jar

Sharing

General

Malware Config

Signatures

File Explorer

5878e275685b971b7c244350dfbae17b_JaffaCakes118

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

com.ivali.qhbao.MainActivity

com.ivali.qhbao.SplashActivity

com.ivali.qhbao.CleanAcvitity

com.ivali.qhbao.questiontips.NewRankingActivity

com.ivali.qhbao.questiontips.CommonQuestionActivity

com.ivali.qhbao.questiontips.Speed_Up_activity

com.ivali.qhbao.questiontips.Send_Proplem_activity

com.ivali.qhbao.questiontips.SettingActivity

com.ivali.qhbao.UpdateActivity

com.ivali.qhbao.SpecialThanksActivity

com.ivali.qhbao.questiontips.HelpActivity

com.ivali.qhbao.ActivityIntruductionActivity

com.ivali.qhbao.questiontips.ForbidReadActivity

com.ivali.qhbao.wxapi.WXEntryActivity

com.ivali.qhbao.questiontips.FeedbackActivity

com.ivali.qhbao.questiontips.FeedbackActivity_qq

com.ivali.qhbao.WxUtility

com.qq.e.ads.ADActivity

com.ivali.qhbao.NeedToRootActivity

com.ivali.qhbao.NativeStreamActivity

com.ivali.qhbao.ProtectorActivity

com.ivali.qhbao.MarketAppActivity

com.baidu.mobads.AppActivity

com.ivali.qhbao.common.FloatingTopActivity

com.ivali.qhbao.WxAccessibilityService

com.qq.e.comm.DownloadService

com.ivali.qhbao.DaemonService

__pasys_remote_banner.jar

gdtadv2.jar

Android Permissions

5878e275685b971b7c244350dfbae17b_JaffaCakes118