97ead4a118afeabf2f0c8c168b78ca14_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
97ead4a118afeabf2f0c8c168b78ca14_JaffaCakes118
Size 25.5MB
Sample240605-mv5cdaec58
SHA256 cd8b692296472d2a13a4418fe6b4842b5b7384537ddcc3a8c539df84b59aa138
MD5 97ead4a118afeabf2f0c8c168b78ca14
SHA1 2cc9bbb9da7007b0d8167081aa8dba5caf58aa74
SHA512 2e352c1202ce1854190cc41edbeeec2a9dfa12ccfa8feba4789a150197107062bcb730386eadaee1aa27ab71903d878d6026afe4034b27a07dd2548266f95b52
SSDEEP 786432:ameOy66QfXSlAqcUyywizs+T8T9pe3yxCWmAHz:ameO6wXaAqcUy1M8wuZ1z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

File Explorer

97ead4a118afeabf2f0c8c168b78ca14_JaffaCakes118

.apk 25.5MB
amap_resource1_0_0.png

.apk 24KB

97ead4a118afeabf2f0c8c168b78ca14_JaffaCakes118

SHA256 cd8b692296472d2a13a4418fe6b4842b5b7384537ddcc3a8c539df84b59aa138
MD5 97ead4a118afeabf2f0c8c168b78ca14
SHA1 2cc9bbb9da7007b0d8167081aa8dba5caf58aa74
SHA512 2e352c1202ce1854190cc41edbeeec2a9dfa12ccfa8feba4789a150197107062bcb730386eadaee1aa27ab71903d878d6026afe4034b27a07dd2548266f95b52
SSDEEP 786432:ameOy66QfXSlAqcUyywizs+T8T9pe3yxCWmAHz:ameO6wXaAqcUy1M8wuZ1z
MD5 SHA1 SHA512 SSDEEP

android arch:arm

Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

com.caitiaobang.pro

com.caitiaobang.pro.activity.moudle.login.ProvatilPoctivActivity

com.caitiaobang.pro.activity.fragment.friends.SelectedFriendsActivity

com.caitiaobang.pro.activity.fragment.friends.SearchFriendsActivity

com.caitiaobang.pro.activity.moudle.me.ExpansionQuestionActivity

com.caitiaobang.pro.activity.moudle.message.SystemInformationDetailsActivity

com.caitiaobang.pro.activity.fragment.VideoActivity

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.LinkFriendActivity

com.caitiaobang.pro.activity.fragment.friends.FriendsToBeInputMsgConfirmedActivity

com.caitiaobang.pro.activity.moudle.me.ViewPersonalInformationActivity

com.caitiaobang.pro.activity.moudle.me.InfoChangePhoneActivity

com.caitiaobang.pro.activity.moudle.me.InfoChangePhoneVerficodeActivity

com.caitiaobang.pro.activity.moudle.message.TerritorialManagementActivity

com.caitiaobang.pro.activity.fragment.HuodongActivityDetails

com.caitiaobang.pro.activity.moudle.me.PersonalCenterChangeActivity

com.caitiaobang.pro.activity.fragment.ZhiTiaoFragmentDetails

com.caitiaobang.pro.activity.moudle.fabu.huodong.FaBuHuodongActivity

com.caitiaobang.pro.activity.moudle.me.HelpDetailsActivity

com.caitiaobang.pro.activity.moudle.me.HelpFeedbackActivity

com.caitiaobang.pro.activity.moudle.me.AccountSettingsActivity

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.AddHayouActivity

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.AddPhotosActivity

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.AddLianJieActivity

com.caitiaobang.pro.activity.moudle.me.MeSettingGroupActivity

com.caitiaobang.pro.activity.fragment.friends.FriendsToBeQueryConfirmedActivity

com.caitiaobang.pro.activity.fragment.friends.MeFriendsGroupActivity

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.CostomTagActivity

com.caitiaobang.pro.activity.moudle.channel.ChannelActivity

com.caitiaobang.pro.activity.moudle.fabu.lord.LordRequestActivity

com.caitiaobang.pro.activity.moudle.message.SystemInformationActivity

com.caitiaobang.pro.activity.moudle.channel.ChannelActivityDetailsItem

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.GetTagActivity

com.caitiaobang.pro.activity.moudle.fabu.zhitiao.FaBuZhiTiaoActivity

com.caitiaobang.pro.activity.moudle.login.InitializeActivity

com.caitiaobang.pro.activity.moudle.me.private_policy.PrivacyPolicyGroupActivity

com.caitiaobang.pro.activity.moudle.infofill.InfoPullSignatureActivity

com.caitiaobang.pro.activity.moudle.infofill.InfoPullNicknameActivity

com.caitiaobang.pro.activity.moudle.infofill.InfoSelectedAddressActivity

com.caitiaobang.pro.activity.moudle.infofill.InfoBirthDateActivity

com.caitiaobang.pro.activity.moudle.infofill.InfoSelectedSexActivity

com.caitiaobang.pro.activity.fragment.friends.NewFragmentsActivity

com.caitiaobang.pro.activity.fragment.MoreFriendsActivity

com.caitiaobang.pro.activity.fragment.MoreFriendsFaqiActivity

com.caitiaobang.pro.activity.utils.webview.BrowserActivity

com.caitiaobang.pro.activity.moudle.login.SplashActivity

android.intent.action.MAIN

com.caitiaobang.pro.activity.moudle.login.ResetPasswordActivity

com.caitiaobang.pro.activity.moudle.login.LoginPasswordActivity

com.caitiaobang.pro.activity.utils.webview.WebActivity

com.caitiaobang.pro.activity.moudle.login.RegisterActivity

com.caitiaobang.pro.activity.moudle.login.GetVerifyCodeActivity

com.caitiaobang.pro.activity.moudle.login.LoginActivity

com.caitiaobang.pro.rongyun.ConversationActivity

android.intent.action.VIEW

com.caitiaobang.pro.rongyun.ConversationListActivity

android.intent.action.VIEW

com.caitiaobang.pro.wxapi.WXEntryActivity

com.caitiaobang.pro.MainActivity

android.intent.action.VIEW

cn.jpush.android.ui.PopWinActivity

cn.jpush.android.ui.PushActivity

io.rong.imkit.plugin.location.AMapLocationActivity

io.rong.imkit.plugin.location.AMapLocationActivity2D

io.rong.imkit.plugin.location.AMapPreviewActivity

io.rong.imkit.plugin.location.AMapPreviewActivity2D

io.rong.imkit.plugin.location.AMapRealTimeActivity

io.rong.imkit.plugin.location.AMapRealTimeActivity2D

io.rong.imkit.plugin.location.SearchLocationActivity

io.rong.imkit.plugin.image.PictureSelectorActivity

io.rong.imkit.plugin.image.PicturePreviewActivity

io.rong.imkit.tools.RongWebviewActivity

io.rong.imkit.intent.action.webview

io.rong.imkit.widget.provider.TakingPicturesActivity

io.rong.imkit.activity.PicturePagerActivity

io.rong.imkit.intent.action.picturepagerview

io.rong.imkit.mention.MemberMentionedActivity

io.rong.imkit.activity.FileManagerActivity

io.rong.imkit.activity.FileListActivity

io.rong.imkit.activity.FilePreviewActivity

io.rong.imkit.intent.action.openfile

io.rong.imkit.activity.CSLeaveMessageActivity

com.zhaoss.weixinrecorded.activity.RecordedActivity

com.zhaoss.weixinrecorded.activity.EditVideoActivity

com.zhaoss.weixinrecorded.activity.CutSizeActivity

com.zhaoss.weixinrecorded.activity.CutTimeActivity

com.zhihu.matisse.ui.MatisseActivity

com.zhihu.matisse.internal.ui.AlbumPreviewActivity

com.zhihu.matisse.internal.ui.SelectedPreviewActivity

com.previewlibrary.GPreviewActivity

com.previewlibrary.GPVideoPlayerActivity

com.lzy.imagepicker.ui.ImageBaseActivity

com.lzy.imagepicker.ui.ImageGridActivity

com.lzy.imagepicker.ui.ImageCropActivity

com.lzy.imagepicker.ui.ImagePreviewActivity

com.lzy.imagepicker.ui.ImagePreviewDelActivity

com.lzy.ninegrid.preview.ImagePreviewActivity

com.mob.tools.MobUIShell

com.sina.weibo.sdk.action.ACTION_SDK_REQ_ACTIVITY

cn.sharesdk.tencent.qq.ReceiveActivity

android.intent.action.VIEW

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

Android Permissions

97ead4a118afeabf2f0c8c168b78ca14_JaffaCakes118

Permissions

android.permission.INTERNET

com.huawei.android.launcher.permission.CHANGE_BADGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

com.caitiaobang.pro.permission.JPUSH_MESSAGE

android.permission.RECEIVE_USER_PRESENT

android.permission.WAKE_LOCK

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.VIBRATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.GET_TASKS

android.permission.ACCESS_FINE_LOCATION

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_CONFIGURATION

android.permission.READ_CONTACTS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.WRITE_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_SETTINGS

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.INSTALL_PACKAGES

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.majeur.launcher.permission.UPDATE_BADGE