29d6182086fe15310a487677c0082309_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29d6182086fe15310a487677c0082309_JaffaCakes118
Size

16.9MB
MD5

29d6182086fe15310a487677c0082309
SHA1

49044e84ed6d499990b57beb85f8831159648265
SHA256

7e39824853ca04c30a9f71bbb2463533130f98238efdc23f8006253109621fdc
SHA512

859f42bd32e899bf9721e665c2ddd5861cafb0d7ec764835d618d48f4ea18583133cbfc515d4cd7a89ba4eba22d4189b9b27609c3cdc1379ce691484b8e80a33
SSDEEP

393216:LFXkQNikcSAJ4lk99/y95EWKlDcD4CJ4v1A7anIBf3+XKnvXP3xlA6fO:xX6kG4mr/yTbKlDcDFs1tIUXKnvXP3xS

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Required to be able to access the camera device.	android.permission.CAMERA

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

29d6182086fe15310a487677c0082309_JaffaCakes118
.apk android arch:arm

com.tencent.qqmusic

com.tencent.qqmusic.activity.AppStarterActivity

Activities

com.tencent.qqmusic.activity.ShareAccountActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.NewGuideActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.NullActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.BillInfoEditActivityNew

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.AppStarterActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE
android.intent.action.MAIN
android.intent.action.VIEW

com.tencent.qqmusic.activity.WebViewActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.MVPlayerActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.WeiXinShareSongListActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE
android.intent.action.VIEW

com.tencent.qqmusic.activity.MediaScannerActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.CheckScanResultListActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.MediaScannerFilterActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.FolderFilterActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.CustomScanActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.EditSongListActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.EditLocalDirListActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.RecognizerActivity

com.tencent.qqmusic.recognizer

com.tencent.qqmusic.recognize.RecognizeActivity

com.tencent.qqmusic.recognizer

com.tencent.qqmusic.third.DispacherActivityForThird

com.tencent.qqmusic.forthird.activity.MY_MUSIC
com.tencent.qqmusic.forthird.activity.APP_LIST
com.tencent.qqmusic.forthird.activity.THEME_PAGE
com.tencent.qqmusic.forthird.activity.RECOGNIZER
com.tencent.qqmusic.forthird.activity.PUSH
com.tencent.qqmusic.forthird.activity.PUSH_2
com.tencent.qqmusic.forthird.activity.PLAYER
com.tencent.qqmusic.forthird.activity.PLAYER2
android.intent.action.VIEW
android.intent.action.VIEW

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

com.tencent.midas.qq.APMidasQQWalletActivity

android.intent.action.VIEW

com.tencent.qqmusic.activity.GeneOperationActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.EditFolderListActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

com.tencent.qqmusic.activity.DownloadLyricAndAlbumActivity

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

jackpal.androidterm.Term

com.tencent.qqmusiccommon.PLAYLIST_VIEWER.PHONE

Permissions

android.permission.GET_TASKS
com.tencent.qqmusic.permission.MMOAUTH_CALLBACK
com.tencent.qqmusic.permission.MM_MESSAGE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.BROADCAST_STICKY
com.tencent.qqmusic.permission.SEND_BROADCAST_PERMISSION
android.permission.WRITE_SETTINGS
android.permission.WAKE_LOCK
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.android.launcher.permission.READ_SETTINGS
com.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.WRITE_MEDIA_STORAGE
android.permission.RECORD_AUDIO
android.permission.VIBRATE
android.permission.CHANGE_WIFI_STATE
android.permission.CHANGE_WIFI_MULTICAST_STATE
android.permission.RESTART_PACKAGES
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SYSTEM_ALERT_WINDOW
android.permission.DISABLE_KEYGUARD
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.RECEIVE_SMS
android.permission.qqmusic.qqcbdm
android.permission.EXPAND_STATUS_BAR
android.permission.READ_LOGS
com.tencent.qqmusic.theme.permission
android.permission.CHANGE_NETWORK_STATE
android.permission.REORDER_TASKS
android.permission.CAMERA

Receivers

com.tencent.qqmusic.OverInstallDexInjectReceiver

android.intent.action.PACKAGE_REPLACED

com.tencent.qqmusicplayerprocess.servicenew.listener.MediaButtonReceiver

android.intent.action.MEDIA_BUTTON
android.intent.action.HEADSET_PLUG
android.media.AUDIO_BECOMING_NOISY

com.tencent.qqmusiccommon.WidgetProviderSmall

android.appwidget.action.APPWIDGET_UPDATE

com.tencent.qqmusiccommon.WidgetProviderMiddle

android.appwidget.action.APPWIDGET_UPDATE

com.tencent.qqmusiccommon.WidgetProviderLarge

android.appwidget.action.APPWIDGET_UPDATE

com.tencent.qqmusic.BootBroadcastReceiver

android.intent.action.BOOT_COMPLETED

com.tencent.qqmusic.ShutdownBroadcastReceiver

android.intent.action.ACTION_SHUTDOWN

com.tencent.qqmusic.third.BroadcastReceiverCenterForThird

com.tencent.qqmusic.forthird.activity.APP_LIST
com.tencent.qqmusic.forthird.activity.THEME_PAGE
com.tencent.qqmusic.forthird.activity.RECOGNIZER
com.tencent.qqmusic.forthird.activity.PUSH
com.tencent.qqmusic.forthird.activity.PUSH_2
com.tencent.qqmusic.forthird.activity.PLAYER
com.tencent.qqmusic.forthird.activity.PLAYER2
com.tencent.qqmusic.forthird.activity.THEME_DETAIL
com.tencent.qqmusic.forthird.activity.RADIO_PAGE
com.tencent.qqmusic.forthird.activity.RANK_PAGE
com.tencent.qqmusic.forthird.activity.NEW_SONG_PAGE
com.tencent.qqmusic.forthird.activity.SINGLE_NEW_SONG
com.tencent.qqmusic.forthird.activity.SINGER_PAGE
com.tencent.qqmusic.forthird.activity.ALBUM_PAGE
com.tencent.qqmusic.forthird.activity.HTML_PAGE
com.tencent.qqmusic.forthird.activity.BILL
com.tencent.qqmusic.forthird.activity.PROFILE
com.tencent.qqmusic.forthird.activity.MVPLAYER
com.tencent.qqmusic.forthird.activity.MV_THEME
com.tencent.qqmusic.forthird.activity.MV_THEME_DETAIL
com.tencent.qqmusic.forthird.activity.ASSORT_LIST
com.tencent.qqmusic.forthird.activity.ASSORT_FRAGMENT
com.tencent.qqmusic.forthird.activity.SKIN_THEME_DETAIL
com.tencent.qqmusic.forthird.activity.DAILY_RC_DETAIL
com.tencent.qqmusic.forthird.activity.PC_WIFI_IMPORT

com.tencent.qqmusic.business.local.MediaScannReceiver

com.tencent.qqpimsecure.ACTION_MEDIA_CACHE_CHANGE
com.tencent.qqmusic.ACTION_GOTO_LOCAL

com.tencent.base.os.clock.AlarmClockReceiver

wns.heartbeat

com.tencent.qqmusic.business.ford.AppLinkReceiver

android.bluetooth.adapter.action.STATE_CHANGED
android.bluetooth.device.action.ACL_CONNECTED
android.bluetooth.device.action.ACL_DISCONNECTED

Services

com.tencent.qqmusic.service.MainService

com.tencent.qqmusic.service.IMainService
wns.push.to.com.tencent.qqmusic

oicq.wlogin_sdk.sharemem.sharemem_service

oicq.wlogin_sdk.sharemem.sharemem_service

com.tencent.qqmusic.third.QQMusicServiceForThird

com.tencent.qqmusic.third.IQQMusicServiceForThird

com.tencent.qqmusic.business.lockscreen.LockScreenService

com.tencent.qqmusic.business.lockscreen.ILockScreenService

com.tencent.qqmusicplayerprocess.network.NetworkService

com.tencent.qqmusicplayerprocess.network.INetworkService

com.tencent.qqmusicplayerprocess.wns.PullService

com.tencent.qqmusicplayerprocess.wns.PullService

com.tencent.wns.service.WnsMain

com.tencent.wns.service.WnsMain
MidasEmptyRes1.apk
.apk android

com.midas.emptyresfirst
MidasEmptyRes2.apk
.apk android

com.midas.emptyressecond

Android Permissions

29d6182086fe15310a487677c0082309_JaffaCakes118

Permissions

android.permission.GET_TASKS

com.tencent.qqmusic.permission.MMOAUTH_CALLBACK

com.tencent.qqmusic.permission.MM_MESSAGE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.BROADCAST_STICKY

com.tencent.qqmusic.permission.SEND_BROADCAST_PERMISSION

android.permission.WRITE_SETTINGS

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_MEDIA_STORAGE

android.permission.RECORD_AUDIO

android.permission.VIBRATE

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_WIFI_MULTICAST_STATE

android.permission.RESTART_PACKAGES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SYSTEM_ALERT_WINDOW

android.permission.DISABLE_KEYGUARD

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.RECEIVE_SMS

android.permission.qqmusic.qqcbdm

android.permission.EXPAND_STATUS_BAR

android.permission.READ_LOGS

com.tencent.qqmusic.theme.permission

android.permission.CHANGE_NETWORK_STATE

android.permission.REORDER_TASKS

android.permission.CAMERA

Sharing

General

Malware Config

Signatures

Files

com.tencent.qqmusic

com.tencent.qqmusic.activity.AppStarterActivity

Activities

com.tencent.qqmusic.activity.ShareAccountActivity

com.tencent.qqmusic.activity.NewGuideActivity

com.tencent.qqmusic.activity.NullActivity

com.tencent.qqmusic.activity.BillInfoEditActivityNew

com.tencent.qqmusic.activity.AppStarterActivity

com.tencent.qqmusic.activity.WebViewActivity

com.tencent.qqmusic.activity.MVPlayerActivity

com.tencent.qqmusic.activity.WeiXinShareSongListActivity

com.tencent.qqmusic.activity.MediaScannerActivity

com.tencent.qqmusic.activity.CheckScanResultListActivity

com.tencent.qqmusic.activity.MediaScannerFilterActivity

com.tencent.qqmusic.activity.FolderFilterActivity

com.tencent.qqmusic.activity.CustomScanActivity

com.tencent.qqmusic.activity.EditSongListActivity

com.tencent.qqmusic.activity.EditLocalDirListActivity

com.tencent.qqmusic.activity.RecognizerActivity

com.tencent.qqmusic.recognize.RecognizeActivity

com.tencent.qqmusic.third.DispacherActivityForThird

com.tencent.tauth.AuthActivity

com.tencent.midas.qq.APMidasQQWalletActivity

com.tencent.qqmusic.activity.GeneOperationActivity

com.tencent.qqmusic.activity.EditFolderListActivity

com.tencent.qqmusic.activity.DownloadLyricAndAlbumActivity

jackpal.androidterm.Term

Permissions

Receivers

com.tencent.qqmusic.OverInstallDexInjectReceiver

com.tencent.qqmusicplayerprocess.servicenew.listener.MediaButtonReceiver

com.tencent.qqmusiccommon.WidgetProviderSmall

com.tencent.qqmusiccommon.WidgetProviderMiddle

com.tencent.qqmusiccommon.WidgetProviderLarge

com.tencent.qqmusic.BootBroadcastReceiver

com.tencent.qqmusic.ShutdownBroadcastReceiver

com.tencent.qqmusic.third.BroadcastReceiverCenterForThird

com.tencent.qqmusic.business.local.MediaScannReceiver

com.tencent.base.os.clock.AlarmClockReceiver

com.tencent.qqmusic.business.ford.AppLinkReceiver

Services

com.tencent.qqmusic.service.MainService

oicq.wlogin_sdk.sharemem.sharemem_service

com.tencent.qqmusic.third.QQMusicServiceForThird

com.tencent.qqmusic.business.lockscreen.LockScreenService

com.tencent.qqmusicplayerprocess.network.NetworkService

com.tencent.qqmusicplayerprocess.wns.PullService

com.tencent.wns.service.WnsMain

com.midas.emptyresfirst

com.midas.emptyressecond

Android Permissions

29d6182086fe15310a487677c0082309_JaffaCakes118