pegasus | d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118
Size

10.3MB
MD5

d3cf74fcfef339f4e29ba3361e34422f
SHA1

02a818bc9be6bf6280337f926845848f7058f1a9
SHA256

dc71dd28c88d47cd47d8fb85dced15340d0021c0704bc39f5b4582ba0faf1f51
SHA512

cb2074392af936e2689a554d5229faa36a378e19bbcc6dae6e305e69d3541fe0763ddadea3710f173b829fdde6ebc558f16ef421f0bee10762ec92aa2f79495f
SSDEEP

196608:PLxnqfTin248xoBGLogstTHQB9QvtR9dGvLBhS/NIj4nsBzTR:ThqMmqWolt20R9OrS1Ij4nsh1

Score

10^/10

pegasus

Malware Config

Signatures

Pegasus family
pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus1

Requests dangerous framework permissions 16 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS

Files

d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118
.apk android arch:arm

com.tencent.qqphonebook

.ui.PhoneBookActivity

Activities

.ui.PhoneBookActivity

android.intent.action.DIAL
android.intent.action.DIAL
android.intent.action.DIAL
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.DIAL
android.intent.action.VIEW
android.intent.action.CALL_BUTTON
android.intent.action.MAIN
android.intent.action.MAIN
android.intent.action.VIEW

.ui.contact.TabContactActivity

com.android.contacts.action.LIST_DEFAULT
com.android.contacts.action.LIST_CONTACTS
com.android.contacts.action.LIST_ALL_CONTACTS
com.android.contacts.action.LIST_CONTACTS_WITH_PHONES
com.android.contacts.action.LIST_STARRED
com.android.contacts.action.LIST_FREQUENT
com.android.contacts.action.LIST_STREQUENT

.ui.dial.TabDialActivity

com.android.phone.action.TOUCH_DIALER

.ui.msg.CombineComposeMsgActivity

android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.SENDTO
android.intent.action.SEND

.ui.contact.ContactDetailActivity

android.intent.action.VIEW

.ui.msg.ShareByMMsIntentAcitivity

android.intent.action.SEND

.ui.msg.ShareByQxinIntentAcitivity

android.intent.action.SEND

.ui.PhoneNumSelectDialogActivity

android.intent.action.VIEW

.ui.contact.ContactEditActivity

android.intent.action.EDIT
android.intent.action.INSERT

.ui.CreateShortCutForDial

android.intent.action.CREATE_SHORTCUT

.ui.CreateShortCutForContacts

android.intent.action.CREATE_SHORTCUT

.ui.CreateShortCutForMMS

android.intent.action.CREATE_SHORTCUT

.ui.contact.ContactInsertOrNewActivity

android.intent.action.INSERT_OR_EDIT

com.tencent.feedback.eup.ConfirmDialog

com.tencent.mqq.wsd.fb.eup.comfirm

Permissions

android.permission.CAMERA
android.permission.WRITE_SETTINGS
android.permission.WRITE_CONTACTS
android.permission.READ_CONTACTS
android.permission.INTERNET
android.permission.MODIFY_PHONE_STATE
android.permission.READ_PHONE_STATE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.WRITE_OWNER_DATA
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_MMS
android.permission.CHANGE_CONFIGURATION
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.CALL_PHONE
android.permission.SEND_SMS
android.permission.VIBRATE
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.GET_ACCOUNTS
android.permission.REORDER_TASKS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
android.permission.RECORD_AUDIO
android.permission.PROCESS_OUTGOING_CALLS
android.permission.READ_LOGS
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.DISABLE_KEYGUARD
android.permission.BATTERY_STATS
android.permission.GET_TASKS
android.permission.READ_LOGS
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.android.launcher.permission.READ_SETTINGS
com.tencent.tpf.permission.qxinAccount
com.tencent.permission.SHOW_LOCATION
com.tencent.permission.CONTENT_PROVIDER
com.tencent.tmsecure.permission.RECEIVE_SMS
com.sec.android.provider.logsprovider.permission.READ_LOGS
com.sec.android.provider.logsprovider.permission.WRITE_LOGS
android.permission.FLASHLIGHT

Receivers

.ui.widget.QQPhoneBookWidgetProvider

com.tencent.action.PHONEBOOK_WIDGET_MSGUNREAD
com.tencent.action.PHONEBOOK_WIDGET_CALLUNREAD
android.appwidget.action.APPWIDGET_UPDATE

.common.service.DateTimeReceiver

android.intent.action.DATE_CHANGED
android.intent.action.TIME_SET

.common.service.ConnectReceiver

android.net.conn.CONNECTIVITY_CHANGE

.component.qxin.QXinReceiver

com.msms.SEND_MESSAGE
com.msms.MESSAGE_SENT
com.msms.SMS_RECEIVED
com.hipb.REG_SMS_ACTION
com.hipb.REG_DELIVERY_ACTION

.component.remote.SmsNotifyReceiver

com.android.mms.transaction.MESSAGE_SENT
android.intent.action.SEND_MESSAGE

.component.remote.SmsReceiver

android.provider.Telephony.SMS_DELIVER
android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.GET_SMSC
android.provider.Telephony.SMS_RECEIVED2

.component.remote.SmsStatusReceiver

com.msms.MESSAGE_STATUS_RECEIVED
com.android.mms.transaction.MessageStatusReceiver.MESSAGE_STATUS_RECEIVED

.common.service.SDCardReceiver

android.intent.action.MEDIA_MOUNTED
android.intent.action.MEDIA_EJECT
android.intent.action.MEDIA_UNMOUNTED
android.intent.action.MEDIA_SHARED
android.intent.action.MEDIA_CHECKING
android.intent.action.MEDIA_REMOVED

.component.remote.BootReceiver

android.intent.action.BOOT_COMPLETED

.component.remote.PbPushReceiver

com.tencent.qqphonebook.action_push_tick
com.tencent.qqphonebook.action_recieve_sms
com.tencent.qqphonebook.action_recieve_mms

com.tencent.qqpim.sdk.receiver.CommReceiver

action.com.tencent.qqpim.comm

.component.customcall.CustomCallReceiver

android.intent.action.PHONE_STATE
android.intent.action.PHONE_STATE_2
android.intent.action.PHONE_STATE2
android.intent.action.PHONE_STATE_EXT

.component.remote.CallStateReceiver

android.intent.action.NEW_OUTGOING_CALL
android.intent.action.PHONE_STATE
android.intent.action.PHONE_STATE_2
android.intent.action.PHONE_STATE2
android.intent.action.PHONE_STATE_EXT
com.tencent.action.SHOW_LOCATION

com.android.mms.transaction.PushReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED
android.provider.Telephony.WAP_PUSH_DELIVER
android.provider.Telephony.WAP_PUSH_RECEIVED

com.android.mms.transaction.MmsSystemEventReceiver

android.intent.action.CONTENT_CHANGED
android.intent.action.BOOT_COMPLETED

.component.vtalk.VoipCallinReceiver

VoipCallin

.component.qxin.AccountReceiver

detect_account

.component.remote.PkgInstallReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_RESTARTED
android.intent.action.PACKAGE_CHANGED
android.intent.action.PACKAGE_INSTALL

.component.customcall.HeadsetStateReceiver

android.intent.action.HEADSET_PLUG

com.tencent.qqphonebook.common.service.UserPresentReceiver

android.intent.action.USER_PRESENT

Services

.component.remote.HeadlessSmsSendService

android.intent.action.RESPOND_VIA_MESSAGE

com.tencent.qqphonebook.component.remote.PhoneBookTMSService

com.tencent.tmsecure.action.SMS_RECEIVED
RootRobot
.apk android

com.tencent.qqphonebook.component.rootrobot

Permissions

android.permission.CALL_PHONE
android.permission.CALL_PRIVILEGED

Android Permissions

d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118

Permissions

android.permission.CAMERA

android.permission.WRITE_SETTINGS

android.permission.WRITE_CONTACTS

android.permission.READ_CONTACTS

android.permission.INTERNET

android.permission.MODIFY_PHONE_STATE

android.permission.READ_PHONE_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.permission.WRITE_OWNER_DATA

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_MMS

android.permission.CHANGE_CONFIGURATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CALL_PHONE

android.permission.SEND_SMS

android.permission.VIBRATE

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.GET_ACCOUNTS

android.permission.REORDER_TASKS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.RECORD_AUDIO

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_LOGS

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.DISABLE_KEYGUARD

android.permission.BATTERY_STATS

android.permission.GET_TASKS

android.permission.READ_LOGS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.tencent.tpf.permission.qxinAccount

com.tencent.permission.SHOW_LOCATION

com.tencent.permission.CONTENT_PROVIDER

com.tencent.tmsecure.permission.RECEIVE_SMS

com.sec.android.provider.logsprovider.permission.READ_LOGS

com.sec.android.provider.logsprovider.permission.WRITE_LOGS

android.permission.FLASHLIGHT

Sharing

General

Malware Config

Signatures

Files

com.tencent.qqphonebook

.ui.PhoneBookActivity

Activities

.ui.PhoneBookActivity

.ui.contact.TabContactActivity

.ui.dial.TabDialActivity

.ui.msg.CombineComposeMsgActivity

.ui.contact.ContactDetailActivity

.ui.msg.ShareByMMsIntentAcitivity

.ui.msg.ShareByQxinIntentAcitivity

.ui.PhoneNumSelectDialogActivity

.ui.contact.ContactEditActivity

.ui.CreateShortCutForDial

.ui.CreateShortCutForContacts

.ui.CreateShortCutForMMS

.ui.contact.ContactInsertOrNewActivity

com.tencent.feedback.eup.ConfirmDialog

Permissions

Receivers

.ui.widget.QQPhoneBookWidgetProvider

.common.service.DateTimeReceiver

.common.service.ConnectReceiver

.component.qxin.QXinReceiver

.component.remote.SmsNotifyReceiver

.component.remote.SmsReceiver

.component.remote.SmsStatusReceiver

.common.service.SDCardReceiver

.component.remote.BootReceiver

.component.remote.PbPushReceiver

com.tencent.qqpim.sdk.receiver.CommReceiver

.component.customcall.CustomCallReceiver

.component.remote.CallStateReceiver

com.android.mms.transaction.PushReceiver

com.android.mms.transaction.MmsSystemEventReceiver

.component.vtalk.VoipCallinReceiver

.component.qxin.AccountReceiver

.component.remote.PkgInstallReceiver

.component.customcall.HeadsetStateReceiver

com.tencent.qqphonebook.common.service.UserPresentReceiver

Services

.component.remote.HeadlessSmsSendService

com.tencent.qqphonebook.component.remote.PhoneBookTMSService

com.tencent.qqphonebook.component.rootrobot

Permissions

Android Permissions

d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118