91f6b3c138cd394561c17210c5c31652_JaffaCakes118

General

Target

91f6b3c138cd394561c17210c5c31652_JaffaCakes118
Size

2.8MB
MD5

91f6b3c138cd394561c17210c5c31652
SHA1

7d66783ef5c8ac059b84d49a57429af435fc6fa8
SHA256

0687c7db19333a3831f1b259c5d18762bf0bdf21bdc4cf9f12452ac8a2f460e1
SHA512

3b15db696e8bfb27c711f3c8b3eab9a143400a9c63af1fac16afef6434861f7df3bb600973f23f630ff5debf75a2c4dc4835458a0da336d0e036435d37779a64
SSDEEP

49152:ErpwdjgZoxXIBT/7kudJBUCpjULwhwL3Yepk11A5lTJQqZcCXyoYlgqEmtne+W0W:EWdjgZoWBT73JBUrLwhEw1A7TJHDYlvy

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Files

91f6b3c138cd394561c17210c5c31652_JaffaCakes118
.apk android arch:arm arch:mips arch:x86

com.haoye.security.cn

.VpnActivity

Activities

.VpnActivity

android.intent.action.MAIN

de.blinkt.openvpn.LaunchVPN

android.intent.action.MAIN

mm.purchasesdk.iapservice.BillingLayoutActivity

com.haoye.security.cn.com.mmiap.activity

safiap.framework.ui.UpdateHintActivity

safiap.framework.ACTION_TO_INSTALL
safiap.framework.ACTION_TO_INSTALL_IAP
safiap.framework.ACTION_NETWORK_ERROR_IAP
safiap.framework.ACTION_NETWORK_ERROR_FRAMEWORK

Permissions

android.permission.KILL_BACKGROUND_PROCESSES
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_SETTINGS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.BROADCAST_STICKY
android.permission.VIBRATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_DOWNLOAD_MANAGER
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
android.permission.SYSTEM_ALERT_WINDOW
android.permission.DISABLE_KEYGUARD
android.permission.CHANGE_CONFIGURATION

Receivers

.push.PushMessageReceiver

com.baidu.android.pushservice.action.MESSAGE
com.baidu.android.pushservice.action.RECEIVE
com.baidu.android.pushservice.action.notification.CLICK

com.baidu.android.pushservice.PushServiceReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
com.baidu.android.pushservice.action.notification.SHOW
com.baidu.android.pushservice.action.media.CLICK

com.baidu.android.pushservice.RegistrationReceiver

com.baidu.android.pushservice.action.METHOD
com.baidu.android.pushservice.action.BIND_SYNC
android.intent.action.PACKAGE_REMOVED

safiap.framework.CheckUpdateReceiver

safiap.framework.ACTION_CANCEL_NOTIFICATION
safiap.GET_SHARED_DATA
safiap.framework.ACTION_SET_TIMER

Services

de.blinkt.openvpn.OpenVpnService

android.net.VpnService

mm.purchasesdk.iapservice.PurchaseService

com.aspire.purchaseservice.BIND
android.intent.action.MAIN

safiap.framework.SafFrameworkManager

safiap.framework.sdk.ISAFFramework
safiap.framework.ACTION_START_DOWNLOAD
safiap.framework.ACTION_CHECK_UPDATE
alipay.apk
.apk android arch:arm

com.alipay.android.app

.activity.Cashier

Activities

.activity.Cashier

android.intent.action.MAIN

.activity.Alerter

android.intent.action.MAIN

.activity.Welcome

android.intent.action.MAIN

.activity.Updater

android.intent.action.MAIN

.activity.PageForBrowser

android.intent.action.VIEW

.activity.CertBiz

android.intent.action.MAIN

.activity.MessageActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.SEND_SMS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_USER_PRESENT
android.permission.VIBRATE
android.permission.CHANGE_NETWORK_STATE
com.alipay.notify.permission.PUSHSERVICE
com.alipay.android.permission.BOOT_COMPLETED
com.alipay.android.app.gphone.SHARE

Receivers

com.alipay.notify.BroadcastActionReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.intent.action.PACKAGE_ADDED

Services

.AlixService

com.alipay.android.app.IAlixPay
com.alipay.android.app.IAliPay

com.alipay.notify.push.NotificationService

com.alipay.notify.push.NotificationService

com.alipay.notify.poll.config.ConfigService

com.alipay.notify.poll.config.ConfigService

Android Permissions

91f6b3c138cd394561c17210c5c31652_JaffaCakes118

Permissions

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_SETTINGS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.BROADCAST_STICKY

android.permission.VIBRATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_DOWNLOAD_MANAGER

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

android.permission.SYSTEM_ALERT_WINDOW

android.permission.DISABLE_KEYGUARD

android.permission.CHANGE_CONFIGURATION

Sharing

General

Malware Config

Signatures

Files

com.haoye.security.cn

.VpnActivity

Activities

.VpnActivity

de.blinkt.openvpn.LaunchVPN

mm.purchasesdk.iapservice.BillingLayoutActivity

safiap.framework.ui.UpdateHintActivity

Permissions

Receivers

.push.PushMessageReceiver

com.baidu.android.pushservice.PushServiceReceiver

com.baidu.android.pushservice.RegistrationReceiver

safiap.framework.CheckUpdateReceiver

Services

de.blinkt.openvpn.OpenVpnService

mm.purchasesdk.iapservice.PurchaseService

safiap.framework.SafFrameworkManager

com.alipay.android.app

.activity.Cashier

Activities

.activity.Cashier

.activity.Alerter

.activity.Welcome

.activity.Updater

.activity.PageForBrowser

.activity.CertBiz

.activity.MessageActivity

Permissions

Receivers

com.alipay.notify.BroadcastActionReceiver

Services

.AlixService

com.alipay.notify.push.NotificationService

com.alipay.notify.poll.config.ConfigService

Android Permissions

91f6b3c138cd394561c17210c5c31652_JaffaCakes118