de4835d44fd13a39f8156089605127f7_JaffaCakes118

General

Target

de4835d44fd13a39f8156089605127f7_JaffaCakes118
Size

12.5MB
MD5

de4835d44fd13a39f8156089605127f7
SHA1

5ce1d532019a5f3501ebf0e534e228c03cc00e06
SHA256

8c55c47bab480876d65353bb258e9b3b0810c244ff713951e567d64de62ef1e7
SHA512

d8eaeba46efc6a8d6ee13028d2d84a5f9567d97c972b29c6533e671d2cc49220f16319c7ee4fdbdeb74b2d6cb5bec6430e61a67a23ed8a00c7cd9451c6f8db38
SSDEEP

393216:oARi1Z1+PIYXHtmKa9TBmaotm+X7MbZO7zx4:9k+PIOHtmhgL9zx4

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Files

de4835d44fd13a39f8156089605127f7_JaffaCakes118
.apk android arch:arm

com.rednovo.weibo

com.rednovo.weibo.activity.EntryActivity

Activities

com.rednovo.weibo.activity.EntryActivity

android.intent.action.MAIN

com.rednovo.weibo.activity.MainActivity

com.rednovo.weibo.main

com.rednovo.weibo.activity.LiveActivity

com.rednovo.weibo.exportedAction
android.intent.action.VIEW

com.rednovo.weibo.push.PushWebViewActivity

jpush.pushWebViewAction

com.rednovo.weibo.push.PushLiveActivity

jpush.pushLiveAction

com.rednovo.weibo.push.PushPopupActivity

jpush.pushPopupAction

com.rednovo.weibo.activity.BannerActivity

com.remote.open.banner

com.rednovo.weibo.pay.PayActivity

android.intent.action.VIEW

cn.jpush.android.ui.PushActivity

cn.jpush.android.ui.PushActivity

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

Permissions

android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.VIBRATE
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.android.launcher.permission.READ_SETTINGS
android.webkit.permission.PLUGIN
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.DISABLE_KEYGUARD
android.permission.WAKE_LOCK
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.SEND_SMS
android.permission.WRITE_SMS
android.permission.READ_SMS
android.permission.GET_TASKS
android.permission.REORDER_TASKS
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECORD_AUDIO
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_SETTINGS
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

Receivers

com.umeng.message.RegistrationReceiver

android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_REMOVED

com.umeng.message.UmengBroadcastReceiver

org.agoo.android.intent.action.RECEIVE
com.rednovo.weibo.intent.action.COMMAND
org.agoo.android.intent.action.RE_ELECTION_V2

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

com.rednovo.weibo.push.PushReceiver

cn.jpush.android.intent.REGISTRATION
cn.jpush.android.intent.UNREGISTRATION
cn.jpush.android.intent.MESSAGE_RECEIVED
cn.jpush.android.intent.NOTIFICATION_RECEIVED
cn.jpush.android.intent.NOTIFICATION_OPENED
cn.jpush.android.intent.ACTION_RICHPUSH_CALLBACK
cn.jpush.android.intent.CONNECTION

.PlayReciver

frontSong
nextSong

Services

com.umeng.message.UmengService

com.rednovo.weibo.intent.action.START
com.rednovo.weibo.intent.action.COCKROACH
org.agoo.android.intent.action.PING

org.android.agoo.service.ElectionService

org.agoo.android.intent.action.ELECTION_V2

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER
cn.jpush.android.intent.REPORT
cn.jpush.android.intent.PushService
cn.jpush.android.intent.PUSH_TIME
UPPayPluginEx.apk
.apk android arch:arm

com.unionpay.uppay

com.unionpay.uppay.PayActivity

Activities

com.unionpay.uppay.PayActivity

android.intent.action.Run

com.unionpay.uppay.PayActivityEx

android.intent.action.Run
android.intent.action.VIEW

Permissions

android.webkit.permission.PLUGIN
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
com.tencent.mtt.extension.Player

Services

com.UCMobile.PayPlugin.PayPluginService

android.webkit.PLUGIN
alipay_plugin_20121018.apk
.apk android arch:arm

com.alipay.android.app

.activity.Cashier

Activities

.activity.Cashier

android.intent.action.MAIN

.activity.Alerter

android.intent.action.MAIN

.activity.Welcome

android.intent.action.MAIN

.activity.Updater

android.intent.action.MAIN

.activity.PageForBrowser

android.intent.action.VIEW

.activity.CertBiz

android.intent.action.MAIN

.activity.MessageActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.SEND_SMS
com.aliyun.xiaoyunmi.alipay

Receivers

.AlixReceiver

com.aliyun.xiaoyunmi.alipay_exit

Services

.AlixService

com.alipay.android.app.IAlixPay
com.alipay.android.app.IAliPay

Android Permissions

de4835d44fd13a39f8156089605127f7_JaffaCakes118

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.VIBRATE

android.permission.READ_LOGS

android.permission.READ_PHONE_STATE

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

android.webkit.permission.PLUGIN

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.DISABLE_KEYGUARD

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.READ_SMS

android.permission.GET_TASKS

android.permission.REORDER_TASKS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SETTINGS

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

Sharing

General

Malware Config

Signatures

Files

com.rednovo.weibo

com.rednovo.weibo.activity.EntryActivity

Activities

com.rednovo.weibo.activity.EntryActivity

com.rednovo.weibo.activity.MainActivity

com.rednovo.weibo.activity.LiveActivity

com.rednovo.weibo.push.PushWebViewActivity

com.rednovo.weibo.push.PushLiveActivity

com.rednovo.weibo.push.PushPopupActivity

com.rednovo.weibo.activity.BannerActivity

com.rednovo.weibo.pay.PayActivity

cn.jpush.android.ui.PushActivity

com.tencent.tauth.AuthActivity

Permissions

Receivers

com.umeng.message.RegistrationReceiver

com.umeng.message.UmengBroadcastReceiver

cn.jpush.android.service.PushReceiver

com.rednovo.weibo.push.PushReceiver

.PlayReciver

Services

com.umeng.message.UmengService

org.android.agoo.service.ElectionService

cn.jpush.android.service.PushService

com.unionpay.uppay

com.unionpay.uppay.PayActivity

Activities

com.unionpay.uppay.PayActivity

com.unionpay.uppay.PayActivityEx

Permissions

Services

com.UCMobile.PayPlugin.PayPluginService

com.alipay.android.app

.activity.Cashier

Activities

.activity.Cashier

.activity.Alerter

.activity.Welcome

.activity.Updater

.activity.PageForBrowser

.activity.CertBiz

.activity.MessageActivity

Permissions

Receivers

.AlixReceiver

Services

.AlixService

Android Permissions

de4835d44fd13a39f8156089605127f7_JaffaCakes118