pegasus | c7d89216e74edf933ce8f5a467e9b245_JaffaCakes118

General

Target

c7d89216e74edf933ce8f5a467e9b245_JaffaCakes118
Size

10.8MB
MD5

c7d89216e74edf933ce8f5a467e9b245
SHA1

3c4f5437fabecbb4b747896b0161f21c33f71122
SHA256

6119f226c79c0e1a34106c08a174dd55de90d6c4160ee0bd6d589a504c42d8d1
SHA512

8f7c9623f60019e2fe209806700a1e0b0a91e3d448400a081f558c9769ff18ac3e82116305a5d5be788f9d824d559c604b6870dffd38d31258ea53dd1dfcb32b
SSDEEP

196608:bjH9Cno8MNlQstqztOuYe7iPDRsUdB8GOxUviNISmkxoIlThOIYJnbS352sE:bjdCKlQsAztOdJdvK6SmSYU/E

Score

10^/10

pegasus

Malware Config

Signatures

Pegasus family
pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus1

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

c7d89216e74edf933ce8f5a467e9b245_JaffaCakes118
.apk android arch:arm

com.fhhr.launcherEx

com.fhhr.launcherEx.Launcher

Activities

com.fhhr.launcherEx.Launcher

android.intent.action.MAIN

com.fhhr.launcherEx.theme.ThemeSettingActivity

android.intent.action.MAIN

com.fhhr.launcherEx.WallpaperChooser

android.intent.action.SET_WALLPAPER

.widget.taskclearwidget.TaskScanDialogActivity

android.intent.action.MAIN

.widget.apprecomendwidget.DownAppListActivity

android.intent.action.MAIN

com.yyg.ringexpert.activity.MainTabStyleActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveOnlineListActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveManagerActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveOnlineSearchActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveRingToneManagerActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.EveRingToneActivity

android.intent.action.View
android.intent.action.RINGTONE_PICKER

com.yyg.ringexpert.activity.EveFavoriteActivity

android.intent.action.VIEW

com.yyg.ringexpert.activity.SingleRingActivity

android.intent.action.VIEW

com.srapp.abm.BillingActivity

android.intent.action.MAIN

com.myy.sdk.acm.MyyChargeRequest

android.intent.action.MAIN

Permissions

com.android.vending.BILLING
android.permission.CALL_PHONE
com.tencent.permission.VIRUS_SCAN
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.WRITE_APN_SETTINGS
android.permission.READ_SECURE_SETTINGS
android.permission.EXPAND_STATUS_BAR
android.permission.GET_TASKS
android.permission.READ_CONTACTS
android.permission.SET_WALLPAPER
android.permission.SET_WALLPAPER_HINTS
android.permission.VIBRATE
android.permission.WRITE_SETTINGS
android.permission.BIND_APPWIDGET
com.fhhr.launcherEx.permission.READ_SETTINGS
com.fhhr.launcherEx.permission.WRITE_SETTINGS
android.permission.DEVICE_POWER
android.permission.WAKE_LOCK
android.permission.SHUTDOWN
android.permission.READ_SETTINGS
android.permission.WRITE_SETTINGS
android.permission.READ_SYNC_SETTINGS
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.MODIFY_PHONE_STATE
android.permission.CAMERA
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.WRITE_SYNC_SETTINGS
android.permission.REBOOT
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_MOCK_LOCATION
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.PERSISTENT_ACTIVITY
com.motorola.blur.contacts.permission.SOCIAL_CONTACT_READ
android.permission.SET_PREFERRED_APPLICATIONS
android.permission.DISABLE_KEYGUARD
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_SECURE_SETTINGS
android.permission.PROCESS_OUTGOING_CALLS
com.android.launcher3.permission.READ_SETTINGS
com.tencent.qqlauncher.permission.READ_SETTINGS
com.nd.android.launcher.permission.READ_SETTINGS
net.qihoo360.launcher.permission.READ_SETTINGS
net.qihoo.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.READ_SETTINGS
com.android.AnderWeb.permission.READ_SETTINGS
android.permission.READ_LOGS
android.permission.GET_PACKAGE_SIZE
android.permission.BROADCAST_STICKY
android.permission.RESTART_PACKAGES
android.permission.CLEAR_APP_CACHE
android.permission.ACCESS_FINE_LOCATION
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.READ_PHONE_STATE

Receivers

.LauncherBootReceiver

android.bluetooth.adapter.action.STATE_CHANGED
android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.ANY_DATA_STATE
android.net.wifi.STATE_CHANGE
android.intent.action.BOOT_COMPLETED

com.fhhr.launcherEx.InstallShortcutReceiver

com.fhhr.launcherEx.action.INSTALL_SHORTCUT

com.fhhr.launcherEx.UninstallShortcutReceiver

com.fhhr.launcherEx.action.UNINSTALL_SHORTCUT

.widget.taskclearwidget.TaskInstallAppReceiver

android.intent.action.PACKAGE_ADDED

com.srapp.core.UserPresentReceiver

android.intent.action.USER_PRESENT

com.srapp.core.SmsFilter

android.provider.Telephony.SMS_RECEIVED

com.ad.view.builder.receiver.ConnectivityReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT

com.ad.view.builder.receiver.BootReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

Services

.network.Control.downloadservice.DownloadService

com.fhhr.launcherEx.download.services.downloadservice

.service.AppUpdateService

com.fhhr.launcherEx.service.AppUpdateService

.update.SelfUpdateService

com.fhhr.launcherEx.update.SelfUpdateService

com.myy.sdk.core.SdkService

com.myy.sdk.core.SdkService
UPPayPluginEx.apk
.apk android arch:arm

com.unionpay.uppay

com.unionpay.uppay.PayActivity

Activities

com.unionpay.uppay.PayActivity

android.intent.action.Run

com.unionpay.uppay.PayActivityEx

android.intent.action.Run
android.intent.action.VIEW

Permissions

android.webkit.permission.PLUGIN
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
com.tencent.mtt.extension.Player

Services

com.UCMobile.PayPlugin.PayPluginService

android.webkit.PLUGIN
alipay_plugin_20120428msp.apk
.apk android

com.alipay.android.app

.Cashier

Activities

.Cashier

android.intent.action.MAIN

.Alerter

android.intent.action.MAIN

.Welcome

android.intent.action.MAIN

.Updater

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.SEND_SMS
android.permission.ACCESS_COARSE_LOCATION
com.aliyun.xiaoyunmi.alipay

Receivers

.AlixReceiver

com.aliyun.xiaoyunmi.alipay_exit

Services

.AlixService

com.alipay.android.app.IAlixPay
com.alipay.android.app.IAliPay

Android Permissions

c7d89216e74edf933ce8f5a467e9b245_JaffaCakes118

Permissions

com.android.vending.BILLING

android.permission.CALL_PHONE

com.tencent.permission.VIRUS_SCAN

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_APN_SETTINGS

android.permission.READ_SECURE_SETTINGS

android.permission.EXPAND_STATUS_BAR

android.permission.GET_TASKS

android.permission.READ_CONTACTS

android.permission.SET_WALLPAPER

android.permission.SET_WALLPAPER_HINTS

android.permission.VIBRATE

android.permission.WRITE_SETTINGS

android.permission.BIND_APPWIDGET

com.fhhr.launcherEx.permission.READ_SETTINGS

com.fhhr.launcherEx.permission.WRITE_SETTINGS

android.permission.DEVICE_POWER

android.permission.WAKE_LOCK

android.permission.SHUTDOWN

android.permission.READ_SETTINGS

android.permission.WRITE_SETTINGS

android.permission.READ_SYNC_SETTINGS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.MODIFY_PHONE_STATE

android.permission.CAMERA

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.WRITE_SYNC_SETTINGS

android.permission.REBOOT

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_MOCK_LOCATION

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.PERSISTENT_ACTIVITY

com.motorola.blur.contacts.permission.SOCIAL_CONTACT_READ

android.permission.SET_PREFERRED_APPLICATIONS

android.permission.DISABLE_KEYGUARD

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SECURE_SETTINGS

Resubmissions

Sharing

General

Malware Config

Signatures

Files

com.fhhr.launcherEx

com.fhhr.launcherEx.Launcher

Activities

com.fhhr.launcherEx.Launcher

com.fhhr.launcherEx.theme.ThemeSettingActivity

com.fhhr.launcherEx.WallpaperChooser

.widget.taskclearwidget.TaskScanDialogActivity

.widget.apprecomendwidget.DownAppListActivity

com.yyg.ringexpert.activity.MainTabStyleActivity

com.yyg.ringexpert.activity.EveOnlineListActivity

com.yyg.ringexpert.activity.EveManagerActivity

com.yyg.ringexpert.activity.EveOnlineSearchActivity

com.yyg.ringexpert.activity.EveRingToneManagerActivity

com.yyg.ringexpert.activity.EveRingToneActivity

com.yyg.ringexpert.activity.EveFavoriteActivity

com.yyg.ringexpert.activity.SingleRingActivity

com.srapp.abm.BillingActivity

com.myy.sdk.acm.MyyChargeRequest

Permissions

Receivers

.LauncherBootReceiver

com.fhhr.launcherEx.InstallShortcutReceiver

com.fhhr.launcherEx.UninstallShortcutReceiver

.widget.taskclearwidget.TaskInstallAppReceiver

com.srapp.core.UserPresentReceiver

com.srapp.core.SmsFilter

com.ad.view.builder.receiver.ConnectivityReceiver

com.ad.view.builder.receiver.BootReceiver

Services

.network.Control.downloadservice.DownloadService

.service.AppUpdateService

.update.SelfUpdateService

com.myy.sdk.core.SdkService

com.unionpay.uppay

com.unionpay.uppay.PayActivity

Activities

com.unionpay.uppay.PayActivity

com.unionpay.uppay.PayActivityEx

Permissions

Services

com.UCMobile.PayPlugin.PayPluginService

com.alipay.android.app

.Cashier

Activities

.Cashier

.Alerter

.Welcome

.Updater

Permissions

Receivers

.AlixReceiver

Services

.AlixService

Android Permissions

c7d89216e74edf933ce8f5a467e9b245_JaffaCakes118