a2f56380193098a50bf708e37afa485e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a2f56380193098a50bf708e37afa485e_JaffaCakes118
Size 30.4MB
Sample240612-3lr9fsvglc
SHA256 2b6bd2bcc06de25e402811a818dceeb5998f9730561d183572e3d92a47ae103d
MD5 a2f56380193098a50bf708e37afa485e
SHA1 c51b916bf4b3038dc3ff62f3476015c53fbef859
SHA512 ec74b1d511892c1733313420445e3f030fabc2d962350db04076a4e073c8b763dc0943fadbae4fa1160a4fff62b87de394212971c81e10f5d2a9b4d9310d3fb8
SSDEEP 786432:saOaDwLQMuMGJXXz47doy4frGOfCuTF1vxUm/qIC7RlVY:gaDwLQ/MOnZB0uBEm/a3C
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 2 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx
sample	patched_upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
sample	upx

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

a2f56380193098a50bf708e37afa485e_JaffaCakes118

.apk 30.4MB
amap_resource1_0_0.png

.apk 24KB

a2f56380193098a50bf708e37afa485e_JaffaCakes118

SHA256 2b6bd2bcc06de25e402811a818dceeb5998f9730561d183572e3d92a47ae103d
MD5 a2f56380193098a50bf708e37afa485e
SHA1 c51b916bf4b3038dc3ff62f3476015c53fbef859
SHA512 ec74b1d511892c1733313420445e3f030fabc2d962350db04076a4e073c8b763dc0943fadbae4fa1160a4fff62b87de394212971c81e10f5d2a9b4d9310d3fb8
SSDEEP 786432:saOaDwLQMuMGJXXz47doy4frGOfCuTF1vxUm/qIC7RlVY:gaDwLQ/MOnZB0uBEm/a3C
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86

Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

com.moxianba.chat

com.moxianba.chat.ui.entrance.MainActivity

android.intent.action.VIEW

com.moxianba.chat.ui.login.LoginActivity

com.moxianba.chat.ui.entrance.SplashActivity

android.intent.action.MAIN

com.moxianba.chat.ui.entrance.CompleteActivity

com.moxianba.chat.ui.login.FindPasswordActivity

com.moxianba.chat.ui.home.SearchActivity

com.moxianba.chat.wdiget.NineGridView.preview.ImagePreviewActivity

com.moxianba.chat.ui.dynamic.DynamicPublishActivity

com.moxianba.chat.ui.mine.TaskActivity

com.moxianba.chat.ui.mine.setting.SettingActivity

com.moxianba.chat.ui.mine.setting.NotifyActivity

com.moxianba.chat.ui.mine.setting.InvisibleActivity

com.moxianba.chat.ui.mine.setting.HideActivity

com.moxianba.chat.ui.mine.setting.NoDisturbActivity

com.moxianba.chat.ui.mine.setting.BlacklistActivity

com.moxianba.chat.ui.mine.setting.AboutActivity

com.moxianba.chat.ui.mine.pay.ExchangeActivity

com.moxianba.chat.ui.mine.pay.RecordActivity

com.moxianba.chat.ui.mine.VisitorActivity

com.moxianba.chat.ui.mine.pay.RechargeActivity

com.moxianba.chat.ui.mine.pay.RechargeItemActivity

com.moxianba.chat.ui.mine.pay.VipActivity

com.moxianba.chat.ui.mine.PostageActivity

com.moxianba.chat.ui.person.PersonActivity

com.moxianba.chat.ui.person.MyPhotoActivity

com.moxianba.chat.ui.person.ShowPhotoActivity

com.moxianba.chat.ui.person.OtherPhotoActivity

com.moxianba.chat.ui.person.DynamicActivity

com.moxianba.chat.ui.person.EditInfoActivity

com.moxianba.chat.ui.person.RealAuthActivity

com.moxianba.chat.ui.news.SettingBackgroundActivity

com.moxianba.chat.ui.mine.setting.ReadMeActivity

com.moxianba.chat.ui.news.ConversationActivity

android.intent.action.VIEW

com.huawei.hms.activity.BridgeActivity

com.huawei.android.hms.agent.common.HMSAgentActivity

com.vivo.push.sdk.LinkProxyClientActivity

io.rong.callkit.SingleCallActivity

io.rong.intent.action.voip.SINGLEVIDEO io.rong.intent.action.voip.SINGLEAUDIO

io.rong.callkit.MultiVideoCallActivity

io.rong.intent.action.voip.MULTIVIDEO

io.rong.callkit.MultiAudioCallActivity

io.rong.intent.action.voip.MULTIAUDIO

io.rong.callkit.CallSelectMemberActivity

com.moxianba.chat.ui.entrance.WebActivity

com.umeng.socialize.media.WBShareCallBackActivity

com.sina.weibo.sdk.web.WeiboSdkWebActivity

com.sina.weibo.sdk.share.WbShareTransActivity

com.sina.weibo.sdk.action.ACTION_SDK_REQ_ACTIVITY

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

com.tencent.connect.common.AssistActivity

com.umeng.socialize.editorpage.ShareActivity

com.moxianba.chat.ui.dynamic.VideoPlayerActivity

com.alipay.sdk.app.H5PayActivity

com.alipay.sdk.app.H5AuthActivity

com.moxianba.chat.wxapi.WXEntryActivity

com.moxianba.chat.wxapi.WXPayEntryActivity

com.moxianba.chat.ui.play.PublishDateActivity

com.moxianba.chat.ui.play.DateDetailActivity

com.moxianba.chat.ui.play.EvaluateActivity

com.moxianba.chat.ui.play.MyDateActivity

com.moxianba.chat.ui.person.AbilityActivity

com.moxianba.chat.ui.play.PlayMainActivity

com.moxianba.chat.ui.dynamic.LocationListActivity

com.moxianba.chat.ui.dynamic.CaptureVideoActivity

com.moxianba.chat.ui.person.FaceVerifyActivity

com.moxianba.chat.ui.mine.MyGiftActivity

com.moxianba.chat.ui.mine.AnchorActivity

com.moxianba.chat.ui.login.RegisterActivity

com.luck.picture.lib.PictureSelectorActivity

com.luck.picture.lib.PicturePreviewActivity

com.luck.picture.lib.PictureVideoPlayActivity

com.luck.picture.lib.PictureExternalPreviewActivity

com.yalantis.ucrop.UCropActivity

com.yalantis.ucrop.PictureMultiCuttingActivity

com.luck.picture.lib.PicturePlayAudioActivity

cn.rongcloud.contactcard.activities.ContactListActivity

cn.rongcloud.contactcard.activities.ContactDetailActivity

io.rong.sight.player.SightPlayerActivity

android.intent.action.VIEW

io.rong.sight.player.SightListActivity

io.rong.sight.record.SightRecordActivity

io.rong.imkit.plugin.location.AMapLocationActivity

io.rong.imkit.plugin.location.AMapLocationActivity2D

io.rong.imkit.plugin.location.AMapPreviewActivity

io.rong.imkit.plugin.location.AMapPreviewActivity2D

io.rong.imkit.plugin.location.AMapRealTimeActivity

io.rong.imkit.plugin.location.AMapRealTimeActivity2D

io.rong.imkit.plugin.location.SearchLocationActivity

io.rong.imkit.plugin.image.PictureSelectorActivity

io.rong.imkit.plugin.image.PicturePreviewActivity

io.rong.imkit.tools.RongWebviewActivity

io.rong.imkit.intent.action.webview

io.rong.imkit.widget.provider.TakingPicturesActivity

io.rong.imkit.activity.PicturePagerActivity

io.rong.imkit.intent.action.picturepagerview

io.rong.imkit.mention.MemberMentionedActivity

io.rong.imkit.activity.FileManagerActivity

io.rong.imkit.activity.FileListActivity

io.rong.imkit.activity.FilePreviewActivity

io.rong.imkit.intent.action.openfile

io.rong.imkit.activity.CSLeaveMessageActivity

cn.jpush.android.ui.PopWinActivity

cn.jpush.android.ui.PushActivity

com.moxianba.chat.message.MyNotificationReceiver

io.rong.push.intent.MESSAGE_ARRIVED io.rong.push.intent.MI_MESSAGE_ARRIVED io.rong.push.intent.MESSAGE_CLICKED io.rong.push.intent.MI_MESSAGE_CLICKED io.rong.push.intent.THIRD_PARTY_PUSH_STATE

com.xiaomi.push.service.receivers.NetworkStatusReceiver

android.net.conn.CONNECTIVITY_CHANGE

com.xiaomi.push.service.receivers.PingReceiver

com.xiaomi.push.PING_TIMER

io.rong.push.platform.mi.MiMessageReceiver

com.xiaomi.mipush.RECEIVE_MESSAGE com.xiaomi.mipush.MESSAGE_ARRIVED com.xiaomi.mipush.ERROR

io.rong.push.platform.hms.HMSReceiver

com.huawei.android.push.intent.REGISTRATION com.huawei.android.push.intent.RECEIVE com.huawei.android.push.intent.CLICK com.huawei.intent.action.PUSH_STATE

com.huawei.hms.support.api.push.PushEventReceiver

com.huawei.intent.action.PUSH

io.rong.push.platform.meizu.MeiZuReceiver

com.meizu.flyme.push.intent.MESSAGE com.meizu.flyme.push.intent.REGISTER.FEEDBACK com.meizu.flyme.push.intent.UNREGISTER.FEEDBACK com.meizu.c2dm.intent.REGISTRATION com.meizu.c2dm.intent.RECEIVE

io.rong.push.platform.vivo.VivoPushMessageReceiver

com.vivo.pushclient.action.RECEIVE

com.meizu.cloud.pushsdk.SystemReceiver

com.meizu.cloud.pushservice.action.PUSH_SERVICE_START

io.rong.imlib.ConnectChangeReceiver

io.rong.imlib.HeartbeatReceiver

io.rong.push.rongpush.PushReceiver

io.rong.push.intent.action.HEART_BEAT android.net.conn.CONNECTIVITY_CHANGE android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY android.intent.action.USER_PRESENT android.net.conn.CONNECTIVITY_CHANGE android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED

cn.jpush.android.service.AlarmReceiver

io.objectbox.android.AndroidObjectBrowserReceiver

io.objectbox.action.KEEP_ALIVE

Android Permissions

a2f56380193098a50bf708e37afa485e_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.GET_TASKS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CHANGE_NETWORK_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_LOGS

android.permission.WRITE_SETTINGS

android.permission.INTERACT_ACROSS_USERS_FULL

com.moxianba.chat.permission.MIPUSH_RECEIVE

com.meizu.flyme.push.permission.RECEIVE

com.moxianba.chat.push.permission.MESSAGE

com.meizu.c2dm.permission.RECEIVE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.CHANGE_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.BLUETOOTH

android.permission.CAPTURE_VIDEO_OUTPUT

android.permission.FLASHLIGHT

com.moxianba.chat.permission.JPUSH_MESSAGE

android.permission.RECEIVE_USER_PRESENT

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS