smsagent | d3dd159ba0a7e87026b59af0811955f6_JaffaCakes118

General

Target

d3dd159ba0a7e87026b59af0811955f6_JaffaCakes118
Size

6.2MB
MD5

d3dd159ba0a7e87026b59af0811955f6
SHA1

d113da8200d83847810d384d9c284e8b9dcd9d71
SHA256

1e7842e24d20e00543d03d83e6f0eac33a37617879238ab6b40e75b3c79c421e
SHA512

d80355be57b6f2eeb93c74fc47f74406f05ccd0d137483a44b6b35e315f1ea66e7f077bacfccc0d56f81f1017b23afcb4a3bc8a420045c610eeb1eb943d8fab1
SSDEEP

98304:DVJ8/S4dIOCENjjhpS4Mx9AHe8ZvaTn9L3Q:hyNnhyTH8ZvaTn9Lg

Score

10^/10

smsagent

Malware Config

Signatures

SmsAgent payload 1 IoCs

Processes:

resource yara_rule

sample family_smsagent
Smsagent family
smsagent

resource	yara_rule
sample	family_smsagent

Declares broadcast receivers with permission to handle system events 1 IoCs

Processes:

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 6 IoCs

Processes:

description	ioc
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 22 IoCs

Processes:

description	ioc
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to access data from sensors that the user uses to measure what is happening inside their body, such as heart rate.	android.permission.BODY_SENSORS
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Files

d3dd159ba0a7e87026b59af0811955f6_JaffaCakes118
.apk android

net.dinglisch.android.taskerm

net.dinglisch.android.taskerm.Tasker

Activities

net.dinglisch.android.taskerm.Tasker

android.intent.action.MAIN

net.dinglisch.android.taskerm.LongPressSearch

android.intent.action.SEARCH_LONG_PRESS

net.dinglisch.android.taskerm.Settings

net.dinglisch.android.tasker.ACTION_OPEN_PREFS
android.service.quicksettings.action.QS_TILE_PREFERENCES

net.dinglisch.android.taskerm.USBHandler

android.hardware.usb.action.USB_DEVICE_ATTACHED
android.hardware.usb.action.USB_DEVICE_DETACHED

net.dinglisch.android.taskerm.MIDIHandler

android.hardware.usb.action.USB_DEVICE_ATTACHED

net.dinglisch.android.taskerm.WebSearchHandler

android.speech.action.WEB_SEARCH

net.dinglisch.android.taskerm.AssistHandler

android.intent.action.ASSIST

net.dinglisch.android.taskerm.IntentHandler

net.dinglisch.android.tasker.WIDICKYUM
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

net.dinglisch.android.taskerm.TaskSelect

net.dinglisch.android.tasker.ACTION_TASK_SELECT

net.dinglisch.android.taskerm.DockActivityCar

android.intent.action.MAIN

net.dinglisch.android.taskerm.DockActivityDesk

android.intent.action.MAIN

net.dinglisch.android.taskerm.TaskerAppWidgetConfigure

android.appwidget.action.APPWIDGET_CONFIGURE

net.dinglisch.android.taskerm.TaskerAppWidgetConfigureShortcut

android.intent.action.CREATE_SHORTCUT

net.dinglisch.android.taskerm.TaskerAppWidgetCountdownConfigure

android.appwidget.action.APPWIDGET_CONFIGURE

net.dinglisch.android.taskerm.IpackIconSelect

net.dinglisch.android.ipack.actions.ICON_SELECT

com.joaomgcd.taskerm.datashare.import.ActivityImportTaskerDataFromXml

android.intent.action.SEND
android.intent.action.SEND
android.intent.action.SEND
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

com.joaomgcd.taskerm.datashare.import.ActivityImportTaskerDataFromUri

android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

Permissions

net.dinglisch.android.zoom.permission.MAKE_CHANGES
android.permission.PACKAGE_USAGE_STATS
cyanogenmod.permission.PUBLISH_CUSTOM_TILE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.BODY_SENSORS
android.permission.WRITE_CALL_LOG
android.permission.READ_CALL_LOG
android.permission.RECEIVE_SMS
com.latedroid.juicedefender.permission.CONTROL_JUICEDEFENDER
com.latedroid.juicedefender.permission.TOGGLE_MOBILE_DATA
android.permission.MODIFY_PHONE_STATE
com.android.phone.CHANGE_NETWORK_MODE
android.permission.SET_TIME_ZONE
android.permission.WRITE_SYNC_SETTINGS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.GET_TASKS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_SETTINGS
android.permission.RECORD_AUDIO
android.permission.READ_PHONE_STATE
android.permission.SEND_SMS
android.permission.WRITE_SMS
android.permission.READ_SMS
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
com.android.alarm.permission.SET_ALARM
android.permission.EXPAND_STATUS_BAR
android.permission.CHANGE_NETWORK_STATE
android.permission.CAMERA
android.permission.DISABLE_KEYGUARD
android.permission.BLUETOOTH_ADMIN
android.permission.BLUETOOTH
android.permission.ACCESS_NETWORK_STATE
android.permission.SET_WALLPAPER
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS
android.permission.INTERNET
android.permission.CALL_PHONE
android.permission.READ_SYNC_SETTINGS
android.permission.READ_CALENDAR
android.permission.WRITE_CALENDAR
android.permission.WRITE_SECURE_SETTINGS
android.permission.DUMP
android.permission.CHANGE_CONFIGURATION
android.permission.TETHER_PRIVILEGED
com.joaomgcd.taskersettings.SET_SETTING
android.permission.ANSWER_PHONE_CALLS
android.permission.CAPTURE_AUDIO_OUTPUT
android.permission.FOREGROUND_SERVICE
android.permission.USE_BIOMETRIC
android.permission.RESTART_PACKAGES
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.ACCESS_WIMAX_STATE
android.permission.CHANGE_WIMAX_STATE
android.permission.SYSTEM_ALERT_WINDOW
com.android.vending.CHECK_LICENSE

Receivers

net.dinglisch.android.taskerm.IpackReceiver

net.dinglisch.android.ipack.actions.QUERY_PACKS
net.dinglisch.android.ipack.actions.QUERY_ICONS

net.dinglisch.android.taskerm.ReceiverStaticPhoneState

android.intent.action.PHONE_STATE

net.dinglisch.android.taskerm.ReceiverStaticNotification

net.dinglisch.android.tasker.NOTORUM

net.dinglisch.android.taskerm.ReceiverStaticCallRewriter

android.intent.action.NEW_OUTGOING_CALL

net.dinglisch.android.taskerm.ReceiverStaticCallBlocker

android.intent.action.NEW_OUTGOING_CALL

net.dinglisch.android.taskerm.ReceiverStaticAlwaysOn

android.intent.action.BOOT_COMPLETED
net.dinglisch.android.tasker.WILLYUM
net.dinglisch.android.tasker.AWAKEY
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_REMOVED
android.intent.action.MY_PACKAGE_REPLACED

net.dinglisch.android.taskerm.ReceiverStaticRunTasks

net.dinglisch.android.tasker.ACTION_TASK
net.dinglisch.android.tasker.ACTION_TASK

net.dinglisch.android.taskerm.ReceiverStaticInternal

net.dinglisch.android.tasker.ACTION_FILE_CHANGED
net.dinglisch.android.tasker.SMSEY
net.dinglisch.android.tasker.ALARUM
net.dinglisch.android.tasker.CALARUM
net.dinglisch.android.tasker.COOLORUM
net.dinglisch.android.tasker.WIDICKYUM
net.dinglisch.android.tasker.ANDPROFTUM
android.intent.action.DATE_CHANGED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
com.twofortyfouram.locale.intent.action.REQUEST_QUERY

net.dinglisch.android.taskerm.TaskerAppWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

net.dinglisch.android.taskerm.TaskerAppWidgetCountdownProvider

android.appwidget.action.APPWIDGET_UPDATE

net.dinglisch.android.taskerm.MyDeviceAdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED

Services

net.dinglisch.android.taskerm.QSTileService0

android.service.quicksettings.action.QS_TILE

net.dinglisch.android.taskerm.QSTileService1

android.service.quicksettings.action.QS_TILE

net.dinglisch.android.taskerm.QSTileService2

android.service.quicksettings.action.QS_TILE

net.dinglisch.android.taskerm.NotificationListenerService

android.service.notification.NotificationListenerService

net.dinglisch.android.taskerm.MyVpnService

android.net.VpnService

net.dinglisch.android.taskerm.MyAccessibilityService

android.accessibilityservice.AccessibilityService

com.joaomgcd.taskerm.plugin.ServiceRequestQuery

com.twofortyfouram.locale.intent.action.REQUEST_QUERY

Android Permissions

d3dd159ba0a7e87026b59af0811955f6_JaffaCakes118

Permissions

net.dinglisch.android.zoom.permission.MAKE_CHANGES

android.permission.PACKAGE_USAGE_STATS

cyanogenmod.permission.PUBLISH_CUSTOM_TILE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.BODY_SENSORS

android.permission.WRITE_CALL_LOG

android.permission.READ_CALL_LOG

android.permission.RECEIVE_SMS

com.latedroid.juicedefender.permission.CONTROL_JUICEDEFENDER

com.latedroid.juicedefender.permission.TOGGLE_MOBILE_DATA

android.permission.MODIFY_PHONE_STATE

com.android.phone.CHANGE_NETWORK_MODE

android.permission.SET_TIME_ZONE

android.permission.WRITE_SYNC_SETTINGS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.GET_TASKS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_SETTINGS

android.permission.RECORD_AUDIO

android.permission.READ_PHONE_STATE

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.READ_SMS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

com.android.alarm.permission.SET_ALARM

android.permission.EXPAND_STATUS_BAR

android.permission.CHANGE_NETWORK_STATE

android.permission.CAMERA

android.permission.DISABLE_KEYGUARD

android.permission.BLUETOOTH_ADMIN

android.permission.BLUETOOTH

android.permission.ACCESS_NETWORK_STATE

android.permission.SET_WALLPAPER

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.INTERNET

android.permission.CALL_PHONE

android.permission.READ_SYNC_SETTINGS

android.permission.READ_CALENDAR

android.permission.WRITE_CALENDAR

android.permission.WRITE_SECURE_SETTINGS

android.permission.DUMP

android.permission.CHANGE_CONFIGURATION

Sharing

General

Malware Config

Signatures

Files

net.dinglisch.android.taskerm

net.dinglisch.android.taskerm.Tasker

Activities

net.dinglisch.android.taskerm.Tasker

net.dinglisch.android.taskerm.LongPressSearch

net.dinglisch.android.taskerm.Settings

net.dinglisch.android.taskerm.USBHandler

net.dinglisch.android.taskerm.MIDIHandler

net.dinglisch.android.taskerm.WebSearchHandler

net.dinglisch.android.taskerm.AssistHandler

net.dinglisch.android.taskerm.IntentHandler

net.dinglisch.android.taskerm.TaskSelect

net.dinglisch.android.taskerm.DockActivityCar

net.dinglisch.android.taskerm.DockActivityDesk

net.dinglisch.android.taskerm.TaskerAppWidgetConfigure

net.dinglisch.android.taskerm.TaskerAppWidgetConfigureShortcut

net.dinglisch.android.taskerm.TaskerAppWidgetCountdownConfigure

net.dinglisch.android.taskerm.IpackIconSelect

com.joaomgcd.taskerm.datashare.import.ActivityImportTaskerDataFromXml

com.joaomgcd.taskerm.datashare.import.ActivityImportTaskerDataFromUri

Permissions

Receivers

net.dinglisch.android.taskerm.IpackReceiver

net.dinglisch.android.taskerm.ReceiverStaticPhoneState

net.dinglisch.android.taskerm.ReceiverStaticNotification

net.dinglisch.android.taskerm.ReceiverStaticCallRewriter

net.dinglisch.android.taskerm.ReceiverStaticCallBlocker

net.dinglisch.android.taskerm.ReceiverStaticAlwaysOn

net.dinglisch.android.taskerm.ReceiverStaticRunTasks

net.dinglisch.android.taskerm.ReceiverStaticInternal

net.dinglisch.android.taskerm.TaskerAppWidgetProvider

net.dinglisch.android.taskerm.TaskerAppWidgetCountdownProvider

net.dinglisch.android.taskerm.MyDeviceAdminReceiver

Services

net.dinglisch.android.taskerm.QSTileService0

net.dinglisch.android.taskerm.QSTileService1

net.dinglisch.android.taskerm.QSTileService2

net.dinglisch.android.taskerm.NotificationListenerService

net.dinglisch.android.taskerm.MyVpnService

net.dinglisch.android.taskerm.MyAccessibilityService

com.joaomgcd.taskerm.plugin.ServiceRequestQuery

Android Permissions

d3dd159ba0a7e87026b59af0811955f6_JaffaCakes118