95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118

General

Target
95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118
Size 30.3MB
Sample240604-vv7fqsed35
SHA256 4b44d9f37c12b019bd37a7e858a04cc256babd4232cc4818e0f125dc1845b565
MD5 95a7d2c96ae5ec2ebcf8bbe27f161b43
SHA1 0c21310a690c59ff5a20d2ffb78d99c5cd151ea7
SHA512 d55690b5d262df721f8d9770be35a682439955087ed6f64b618dd0121388ce8af9ed6086b1630b26c35d16080fe9db142d15add36d45848141e43c7fb3b6bf38
SSDEEP 786432:OsUmn26jOru89GOBdkW1a0ijLHiayHB4E6Sen:Ovmn+u8Tla0YLife0en
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

File Explorer

95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118

.apk 30.3MB
oppo_game_service_201502.so

.apk 4.0MB

95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118

SHA256 4b44d9f37c12b019bd37a7e858a04cc256babd4232cc4818e0f125dc1845b565
MD5 95a7d2c96ae5ec2ebcf8bbe27f161b43
SHA1 0c21310a690c59ff5a20d2ffb78d99c5cd151ea7
SHA512 d55690b5d262df721f8d9770be35a682439955087ed6f64b618dd0121388ce8af9ed6086b1630b26c35d16080fe9db142d15add36d45848141e43c7fb3b6bf38
SSDEEP 786432:OsUmn26jOru89GOBdkW1a0ijLHiayHB4E6Sen:Ovmn+u8Tla0YLife0en
MD5 SHA1 SHA512 SSDEEP

android arch:arm

com.cqwx.mmbwdyxcqll4.nearme.gamecenter

oppo_game_service_201502.so

SHA256 46c357afba1e7773312156efc729888daaa66ac8165dd6a393f7ab01f23ab5a3
MD5 fc370ef2928affc169ff3f3e1c856791
SHA1 97177d0eca18f7ef0c382739becb744556b4b268
SHA512 944bbd29a21a121caa6e0f5cfcb12e6c1db635698add1bcc59b1cc8e882d4858698afb92f653cefcf4b79b37d003647a7e02433f95ecf1e906f9a131abc4a7f3
SSDEEP 98304:dVAO2eFa6e3A5NIHcyOxMA5Wf3PcRDeVmMNvn4U2CUE6F6jOU:dDs33A5EcDxFWkmpCURUE6F6jOU
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

com.nearme.game.service

Android Permissions

95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RESTART_PACKAGES

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.READ_EXTERNAL_STORAGE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.GET_TASKS

95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118

org.cocos2dx.javascript.AppActivity

com.nearme.game.sdk.component.proxy.ProxyActivity

com.nearme.game.sdk.component.proxy.ProxyApiService

oppo_game_service_201502.so

com.nearme.atlas.offlinepay.application.ui.activities.OppoOfflinePayHostActivity

com.alipay.sdk.app.H5PayActivity

com.ipaynow.wechatpay.plugin.inner_plugin.wechat_plugin.activity.WeChatNotifyActivity

com.nearme.atlas.offlinepay.application.third.wxpayh5.WxWapPayTaskActivity

com.oneplus.accountsdk.auth.OPAuthorizeActivity

com.oppo.usercenter.opensdk.dialog.register.UserCenterOperateActivity

com.oppo.usercenter.opensdk.dialog.country.UCCountryCallingcodeSelectActivity

com.oppo.usercenter.opensdk.register.RegisterClauseActivity

com.oppo.usercenter.opensdk.setpsw.SetPswActivity

com.oppo.usercenter.opensdk.visitor.UcVisitorUpgradeActivity

com.oppo.usercenter.opensdk.realname.verified.UCRealNameVerifiedActivity

com.oppo.usercenter.opensdk.captcha.UCCaptchaVerifyActivity

com.oppo.usercenter.opensdk.captcha.UCCaptchaDialogActivity

com.oppo.usercenter.opensdk.dialog.web.LoadingWebActivity

com.oppo.usercenter.sdk.helper.UserCenterOperateReceiver

Sharing

General

Malware Config

Signatures

File Explorer

95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118

org.cocos2dx.javascript.AppActivity

com.nearme.game.sdk.component.proxy.ProxyActivity

com.nearme.game.sdk.component.proxy.ProxyApiService

oppo_game_service_201502.so

com.nearme.atlas.offlinepay.application.ui.activities.OppoOfflinePayHostActivity

com.alipay.sdk.app.H5PayActivity

com.ipaynow.wechatpay.plugin.inner_plugin.wechat_plugin.activity.WeChatNotifyActivity

com.nearme.atlas.offlinepay.application.third.wxpayh5.WxWapPayTaskActivity

com.oneplus.accountsdk.auth.OPAuthorizeActivity

com.oppo.usercenter.opensdk.dialog.register.UserCenterOperateActivity

com.oppo.usercenter.opensdk.dialog.country.UCCountryCallingcodeSelectActivity

com.oppo.usercenter.opensdk.register.RegisterClauseActivity

com.oppo.usercenter.opensdk.setpsw.SetPswActivity

com.oppo.usercenter.opensdk.visitor.UcVisitorUpgradeActivity

com.oppo.usercenter.opensdk.realname.verified.UCRealNameVerifiedActivity

com.oppo.usercenter.opensdk.captcha.UCCaptchaVerifyActivity

com.oppo.usercenter.opensdk.captcha.UCCaptchaDialogActivity

com.oppo.usercenter.opensdk.dialog.web.LoadingWebActivity

com.oppo.usercenter.sdk.helper.UserCenterOperateReceiver

Android Permissions

95a7d2c96ae5ec2ebcf8bbe27f161b43_JaffaCakes118