65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

Reason

error processing APK: checksum verification failed

Reason

error processing APK: checksum verification failed

Reason

error processing APK: checksum verification failed

General

Target
65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118
Size 3.4MB
Sample241021-gth5vstfql
SHA256 3c281c6fcc6acc3e654ec240c03399fc3ada7116afe4fcc02de9eb92aceb676c
MD5 65c3ad11d16e2e2a1bdec67d340c179a
SHA1 7dc58dee62cd4365134ff593612b3081d751515b
SHA512 052ded2bac9c2ab2ef18839f37a94043579acedff20d4815301f2443c8aa7607b88631f9ca6b7f575c01f7d735ca9dc56ce1b7b9ac18a37b7a715ecd9067acab
SSDEEP 98304:hfVHPwcHdGZLtvt7w0Eh1+P/andOEfDSY6Bn0URUE:FVvfGZLZt7w0E7F3DAVPR
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

File Explorer

65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118

.apk 3.4MB
com.skymobi.pay.plugin.main_v10017.pl

.apk 59KB
com.skymobi.pay.plugin.recordupload_v10011.pl

.apk 42KB
com.skymobi.pay.plugin.smspay_v10044.pl

.apk 254KB
skymobi_pay_wxplugin.apk

.apk 33KB
unicom_resource.dat

.apk 66KB

65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118

SHA256 3c281c6fcc6acc3e654ec240c03399fc3ada7116afe4fcc02de9eb92aceb676c
MD5 65c3ad11d16e2e2a1bdec67d340c179a
SHA1 7dc58dee62cd4365134ff593612b3081d751515b
SHA512 052ded2bac9c2ab2ef18839f37a94043579acedff20d4815301f2443c8aa7607b88631f9ca6b7f575c01f7d735ca9dc56ce1b7b9ac18a37b7a715ecd9067acab
SSDEEP 98304:hfVHPwcHdGZLtvt7w0Eh1+P/andOEfDSY6Bn0URUE:FVvfGZLZt7w0E7F3DAVPR
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86

XDccQl.dTBDZ.jmnfgcX

android.permission.INTERNET android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_EXTERNAL_STORAGE android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.ACCESS_WIFI_STATE android.permission.RECEIVE_BOOT_COMPLETED android.permission.VIBRATE android.permission.SEND_SMS android.permission.READ_SMS android.permission.WRITE_SMS android.permission.RECEIVE_SMS android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.GET_TASKS android.permission.WAKE_LOCK android.permission.READ_LOGS android.permission.WRITE_APN_SETTINGS android.permission.SYSTEM_ALERT_WINDOW android.permission.WRITE_SETTINGS android.permission.BLUETOOTH com.android.launcher.permission.INSTALL_SHORTCUT android.permission.RESTART_PACKAGES android.permission.GET_ACCOUNTS com.android.launcher.permission.READ_SETTINGS android.permission.DISABLE_KEYGUARD android.permission.RECEIVE_WAP_PUSH android.permission.READ_CONTACTS android.permission.CHANGE_CONFIGURATION android.permission.RUN_INSTRUMENTATION android.webkit.permission.PLUGIN android.permission.UPDATE_APP_OPS_STATS com.android.launcher.permission.READ_SETTINGS com.android.launcher.permission.WRITE_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher2.permission.WRITE_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.android.launcher3.permission.WRITE_SETTINGS org.adw.launcher.permission.READ_SETTINGS org.adw.launcher.permission.WRITE_SETTINGS com.htc.launcher.permission.READ_SETTINGS com.htc.launcher.permission.WRITE_SETTINGS com.qihoo360.launcher.permission.READ_SETTINGS com.qihoo360.launcher.permission.WRITE_SETTINGS com.lge.launcher.permission.READ_SETTINGS com.lge.launcher.permission.WRITE_SETTINGS net.qihoo.launcher.permission.READ_SETTINGS net.qihoo.launcher.permission.WRITE_SETTINGS org.adwfreak.launcher.permission.READ_SETTINGS org.adwfreak.launcher.permission.WRITE_SETTINGS org.adw.launcher_donut.permission.READ_SETTINGS org.adw.launcher_donut.permission.WRITE_SETTINGS com.huawei.launcher3.permission.READ_SETTINGS com.huawei.launcher3.permission.WRITE_SETTINGS com.fede.launcher.permission.READ_SETTINGS com.fede.launcher.permission.WRITE_SETTINGS com.sec.android.app.twlauncher.settings.READ_SETTINGS com.sec.android.app.twlauncher.settings.WRITE_SETTINGS com.anddoes.launcher.permission.READ_SETTINGS com.anddoes.launcher.permission.WRITE_SETTINGS com.tencent.qqlauncher.permission.READ_SETTINGS com.tencent.qqlauncher.permission.WRITE_SETTINGS com.huawei.launcher2.permission.READ_SETTINGS com.huawei.launcher2.permission.WRITE_SETTINGS com.android.mylauncher.permission.READ_SETTINGS com.android.mylauncher.permission.WRITE_SETTINGS com.ebproductions.android.launcher.permission.READ_SETTINGS com.ebproductions.android.launcher.permission.WRITE_SETTINGS com.oppo.launcher.permission.READ_SETTINGS com.oppo.launcher.permission.WRITE_SETTINGS com.lenovo.launcher.permission.READ_SETTINGS com.lenovo.launcher.permission.WRITE_SETTINGS com.huawei.android.launcher.permission.READ_SETTINGS com.huawei.android.launcher.permission.WRITE_SETTINGS telecom.mdesk.permission.READ_SETTINGS telecom.mdesk.permission.WRITE_SETTINGS dianxin.permission.ACCESS_LAUNCHER_DATA android.permission.REQUEST_INSTALL_PACKAGES android.permission.SYSTEM_ALERT_WINDOW android.permission.GET_TASKS android.permission.CALL_PHONE android.permission.WAKE_LOCK android.permission.DOWNLOAD_WITHOUT_NOTIFICATION android.permission.READ_CALL_LOG android.permission.READ_CONTACTS android.permission.CHANGE_CONFIGURATION android.permission.RUN_INSTRUMENTATION android.permission.UPDATE_APP_OPS_STATS

com.conve.rtino.LoadActivity

android.intent.action.MAIN

com.conve.rtino.ScrollableTabHost

android.intent.action.Xbkgactivity

com.conve.rtino.SelectActivity

android.intent.action.Select

com.conve.rtino.PlayVideoActivity

com.conve.rtino.HejuActivity

com.ehoo.tasks.other.PayResultActivity

com.skymobi.pay.sdk.normal.zimon.EpsActivity

com.unicom.wostore.unipay.paysecurity.SecurityActivity

com.alipay.sdk.app.H5PayActivity

com.ipaynow.plugin.inner_plugin.prepay_plugin.activity.PrePayActivity

com.ipaynow.plugin.inner_plugin.prepay_plugin.activity.NotifyActivity

com.unionpay.uppay.PayActivityEx

com.alipay.sdk.auth.AuthActivity

com.switfpass.pay.activity.QQWapPayWebView

com.hoxq.lpve.uwisuq.a.a.c.a

com_hoxq_lpve.activity

com.iapppay.pay.channel.weixinpay.WeixinWapPayActivity

com.iapppay.ui.activity.ServiceCenterActivity

com.iapppay.ui.activity.normalpay.PayHubActivity

com.iapppay.pay.channel.gamepay.GamepayActivity

com.iapppay.pay.channel.unionpay.UpPayResultActivity

com.unionpay.uppay.PayActivity

com.unionpay.UPPayWapActivity

com.iapppay.pay.channel.tenpay.wap.TenpayWapPayActivity

com.iapppay.pay.channel.tenpay.wap.WebActivity

com.longyou.haitunpay.HaiTunPayActivity

com.longyou.haitunpay.HaiTunWebPayActivity

com.iyou.iyoupay.StartServiceActivity

com.iyou.iyoupay.ThreePayAcivity

com.iyou.iyoupay.action.ThreePayAcivity

org.android.zzsdk.wx.WxActiviy

Android Permissions

65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.VIBRATE

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_SMS

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.GET_TASKS

android.permission.WAKE_LOCK

android.permission.READ_LOGS

android.permission.WRITE_APN_SETTINGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_SETTINGS

android.permission.BLUETOOTH

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.RESTART_PACKAGES

android.permission.GET_ACCOUNTS

com.android.launcher.permission.READ_SETTINGS

android.permission.DISABLE_KEYGUARD

android.permission.RECEIVE_WAP_PUSH

android.permission.READ_CONTACTS

android.permission.CHANGE_CONFIGURATION

android.permission.RUN_INSTRUMENTATION

android.webkit.permission.PLUGIN

android.permission.UPDATE_APP_OPS_STATS

com.android.launcher.permission.READ_SETTINGS

com.android.launcher.permission.WRITE_SETTINGS

com.android.launcher2.permission.READ_SETTINGS

com.android.launcher2.permission.WRITE_SETTINGS

com.android.launcher3.permission.READ_SETTINGS

com.android.launcher3.permission.WRITE_SETTINGS

org.adw.launcher.permission.READ_SETTINGS

org.adw.launcher.permission.WRITE_SETTINGS

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.WRITE_SETTINGS

com.qihoo360.launcher.permission.READ_SETTINGS

com.qihoo360.launcher.permission.WRITE_SETTINGS

com.lge.launcher.permission.READ_SETTINGS

com.lge.launcher.permission.WRITE_SETTINGS

net.qihoo.launcher.permission.READ_SETTINGS

Sharing

Errors

General

Malware Config

Signatures

File Explorer

65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118

com.conve.rtino.LoadActivity

com.conve.rtino.ScrollableTabHost

com.conve.rtino.SelectActivity

com.conve.rtino.PlayVideoActivity

com.conve.rtino.HejuActivity

com.ehoo.tasks.other.PayResultActivity

com.skymobi.pay.sdk.normal.zimon.EpsActivity

com.unicom.wostore.unipay.paysecurity.SecurityActivity

com.alipay.sdk.app.H5PayActivity

com.ipaynow.plugin.inner_plugin.prepay_plugin.activity.PrePayActivity

com.ipaynow.plugin.inner_plugin.prepay_plugin.activity.NotifyActivity

com.unionpay.uppay.PayActivityEx

com.alipay.sdk.auth.AuthActivity

com.switfpass.pay.activity.QQWapPayWebView

com.hoxq.lpve.uwisuq.a.a.c.a

com.iapppay.pay.channel.weixinpay.WeixinWapPayActivity

com.iapppay.ui.activity.ServiceCenterActivity

com.iapppay.ui.activity.normalpay.PayHubActivity

com.iapppay.pay.channel.gamepay.GamepayActivity

com.iapppay.pay.channel.unionpay.UpPayResultActivity

com.unionpay.uppay.PayActivity

com.unionpay.UPPayWapActivity

com.iapppay.pay.channel.tenpay.wap.TenpayWapPayActivity

com.iapppay.pay.channel.tenpay.wap.WebActivity

com.longyou.haitunpay.HaiTunPayActivity

com.longyou.haitunpay.HaiTunWebPayActivity

com.iyou.iyoupay.StartServiceActivity

com.iyou.iyoupay.ThreePayAcivity

org.android.zzsdk.wx.WxActiviy

com.sdky.jzp.srvi.DrdSrvi

com.skpay.dk.qqq.TpService

com.conve.rtino.SpService

org.hj201606.lib.sms.MonitorService

com.ehoo.sms.receiver.SMSReceiveService

com.skymobi.pay.sdk.normal.zimon.EpsService

com.skymobi.pay.sdk.normal.zimon.sms.PayCtrlService

com.skymobi.pay.sdk.normal.zimon.sms.SkyPayRemoteService

com.unicom.wostore.unipay.paysecurity.SecurityServiceFramework

com.hoxq.lpve.uwisuq.a.a.c.c

com.iyou.iyoupay.BackgroundService

com.ehoo.sms.receiver.BootReceiver

com.skymobi.pay.sdk.normal.zimon.EpsReceiver

com.hoxq.lpve.uwisuq.a.a.c.b

cm.pass.sdk.broadcastreceiver.SsoSyncReceiver

com.iyou.iyoupay.BootCompletedBroadcastReceiver

com.skymobi.pay.plugin.main_v10017.pl

com.skymobi.pay.plugin.recordupload_v10011.pl

com.skymobi.pay.plugin.smspay_v10044.pl

skymobi_pay_wxplugin.apk

com.skymobi.pay.wxplugin.wxapi.WXPayEntryActivity

unicom_resource.dat

Android Permissions

65c3ad11d16e2e2a1bdec67d340c179a_JaffaCakes118