pegasus | 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

General

Target
3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86
Size 19KB
Sample260601-wvddbsd17k
SHA256 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86
MD5 3a69bfbe5bc83c4df938177e05cd7c7c
SHA1 b6850881561265d89597d0d245b33dba3d7d3f47
SHA512 491088a3494ee77401032171378a13c46a12e15dc29bdb3840d902ec8b11c084e84f2fc92aa1ae75bf2683b4fc05097cdf5389cd39c86e1547debd4ebf143586
SSDEEP 384:ricGiJTcFQZYNXNUsjjjdyDqFpciWb1snmhdbTOOIMC0lCgFQA1TjgJ23lxzOx:ricBJTcp9Uq47bimfTO68fJ23Pe
TLSH
T17492D02C566251BDF0966838BE3B6546476608AB24EF71531A00FA732F148733F71EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer trojan pegasus

Malware Config

Signatures

Family: Pegasus
Pegasus is a commercial Android spyware first seen in 2016.
stealer trojan pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus2

Requests dangerous framework permissions 25 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to use SIP service.	android.permission.USE_SIP
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

File Explorer

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

.apk 19KB

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

SHA256 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86
MD5 3a69bfbe5bc83c4df938177e05cd7c7c
SHA1 b6850881561265d89597d0d245b33dba3d7d3f47
SHA512 491088a3494ee77401032171378a13c46a12e15dc29bdb3840d902ec8b11c084e84f2fc92aa1ae75bf2683b4fc05097cdf5389cd39c86e1547debd4ebf143586
SSDEEP 384:ricGiJTcFQZYNXNUsjjjdyDqFpciWb1snmhdbTOOIMC0lCgFQA1TjgJ23lxzOx:ricBJTcp9Uq47bimfTO68fJ23Pe
TLSH
T17492D02C566251BDF0966838BE3B6546476608AB24EF71531A00FA732F148733F71EDD
MD5 SHA1 SHA512 SSDEEP TLSH

android

Pegasus payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

42d3fd59fd5d047703de3d15d6a9661d613db426

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Android Debug,O=Android,C=US

Chains

Jan 1, 0001

com.network.android

android.permission.INTERNET android.permission.ACCESS_CHECKIN_PROPERTIES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_LOCATION_EXTRA_COMMANDS android.permission.ACCESS_MOCK_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_SURFACE_FLINGER android.permission.ACCESS_WIFI_STATE android.permission.ACCOUNT_MANAGER android.permission.AUTHENTICATE_ACCOUNTS android.permission.BATTERY_STATS android.permission.BIND_APPWIDGET android.permission.BIND_DEVICE_ADMIN android.permission.BIND_INPUT_METHOD android.permission.BIND_REMOTEVIEWS android.permission.BIND_WALLPAPER android.permission.BLUETOOTH android.permission.BLUETOOTH_ADMIN android.permission.BRICK android.permission.BROADCAST_PACKAGE_REMOVED android.permission.BROADCAST_SMS android.permission.BROADCAST_STICKY android.permission.BROADCAST_WAP_PUSH android.permission.CALL_PHONE android.permission.CALL_PRIVILEGED android.permission.CAMERA android.permission.CHANGE_COMPONENT_ENABLED_STATE android.permission.CHANGE_CONFIGURATION android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_MULTICAST_STATE android.permission.CHANGE_WIFI_STATE android.permission.CLEAR_APP_CACHE android.permission.CLEAR_APP_USER_DATA android.permission.CONTROL_LOCATION_UPDATES android.permission.DELETE_CACHE_FILES android.permission.DELETE_PACKAGES android.permission.DEVICE_POWER android.permission.DIAGNOSTIC android.permission.DISABLE_KEYGUARD android.permission.DUMP android.permission.EXPAND_STATUS_BAR android.permission.FACTORY_TEST android.permission.FLASHLIGHT android.permission.FORCE_BACK android.permission.GET_ACCOUNTS android.permission.GET_PACKAGE_SIZE android.permission.GET_TASKS android.permission.GLOBAL_SEARCH android.permission.HARDWARE_TEST android.permission.INJECT_EVENTS android.permission.INSTALL_LOCATION_PROVIDER android.permission.INSTALL_PACKAGES android.permission.INTERNAL_SYSTEM_WINDOW android.permission.INTERNET android.permission.KILL_BACKGROUND_PROCESSES android.permission.MANAGE_ACCOUNTS android.permission.MANAGE_APP_TOKENS android.permission.MASTER_CLEAR android.permission.MODIFY_AUDIO_SETTINGS android.permission.MODIFY_PHONE_STATE android.permission.MOUNT_FORMAT_FILESYSTEMS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.NFC android.permission.PROCESS_OUTGOING_CALLS android.permission.READ_CALENDAR android.permission.READ_CONTACTS android.permission.READ_EXTERNAL_STORAGE android.permission.READ_FRAME_BUFFER android.permission.READ_HISTORY_BOOKMARKS android.permission.READ_INPUT_STATE android.permission.READ_LOGS android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.READ_SYNC_SETTINGS android.permission.READ_SYNC_STATS android.permission.REBOOT android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECEIVE_MMS android.permission.RECEIVE_SMS android.permission.RECEIVE_WAP_PUSH android.permission.RECORD_AUDIO android.permission.REORDER_TASKS android.permission.RESTART_PACKAGES android.permission.SEND_SMS android.permission.SET_ACTIVITY_WATCHER android.permission.SET_ALARM android.permission.SET_ALWAYS_FINISH android.permission.SET_ANIMATION_SCALE android.permission.SET_DEBUG_APP android.permission.SET_ORIENTATION android.permission.SET_POINTER_SPEED android.permission.SET_PROCESS_LIMIT android.permission.SET_TIME android.permission.SET_TIME_ZONE android.permission.SET_WALLPAPER android.permission.SET_WALLPAPER_HINTS android.permission.SIGNAL_PERSISTENT_PROCESSES android.permission.STATUS_BAR android.permission.SUBSCRIBED_FEEDS_READ android.permission.SUBSCRIBED_FEEDS_WRITE android.permission.SYSTEM_ALERT_WINDOW android.permission.UPDATE_DEVICE_STATS android.permission.USE_CREDENTIALS android.permission.USE_SIP android.permission.VIBRATE android.permission.WAKE_LOCK android.permission.WRITE_APN_SETTINGS android.permission.WRITE_CALENDAR android.permission.WRITE_CONTACTS android.permission.WRITE_EXTERNAL_STORAGE android.permission.WRITE_GSERVICES android.permission.WRITE_HISTORY_BOOKMARKS android.permission.WRITE_SECURE_SETTINGS android.permission.WRITE_SETTINGS android.permission.WRITE_SMS android.permission.WRITE_SYNC_SETTINGS android.permission.BIND_ACCESSIBILITY_SERVICE android.permission.BIND_TEXT_SERVICE android.permission.BIND_VPN_SERVICE android.permission.PERSISTENT_ACTIVITY android.permission.READ_CALL_LOG android.permission.READ_EXTERNAL_STORAGE com.android.browser.permission.READ_HISTORY_BOOKMARKS android.permission.READ_PROFILE android.permission.READ_SOCIAL_STREAM android.permission.READ_USER_DICTIONARY com.android.alarm.permission.SET_ALARM android.permission.SET_PREFERRED_APPLICATIONS android.permission.WRITE_CALL_LOG com.android.browser.permission.WRITE_HISTORY_BOOKMARKS android.permission.WRITE_PROFILE android.permission.WRITE_SOCIAL_STREAM android.permission.WRITE_USER_DICTIONARY

Android Permissions

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

Permissions

android.permission.INTERNET

android.permission.ACCESS_CHECKIN_PROPERTIES

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.ACCESS_MOCK_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_SURFACE_FLINGER

android.permission.ACCESS_WIFI_STATE

android.permission.ACCOUNT_MANAGER

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.BATTERY_STATS

android.permission.BIND_APPWIDGET

android.permission.BIND_DEVICE_ADMIN

android.permission.BIND_INPUT_METHOD

android.permission.BIND_REMOTEVIEWS

android.permission.BIND_WALLPAPER

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.BRICK

android.permission.BROADCAST_PACKAGE_REMOVED

android.permission.BROADCAST_SMS

android.permission.BROADCAST_STICKY

android.permission.BROADCAST_WAP_PUSH

android.permission.CALL_PHONE

android.permission.CALL_PRIVILEGED

android.permission.CAMERA

android.permission.CHANGE_COMPONENT_ENABLED_STATE

android.permission.CHANGE_CONFIGURATION

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_MULTICAST_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.CLEAR_APP_CACHE

android.permission.CLEAR_APP_USER_DATA

android.permission.CONTROL_LOCATION_UPDATES

android.permission.DELETE_CACHE_FILES

android.permission.DELETE_PACKAGES

android.permission.DEVICE_POWER

android.permission.DIAGNOSTIC

android.permission.DISABLE_KEYGUARD

android.permission.DUMP

android.permission.EXPAND_STATUS_BAR

android.permission.FACTORY_TEST

android.permission.FLASHLIGHT

android.permission.FORCE_BACK

android.permission.GET_ACCOUNTS

android.permission.GET_PACKAGE_SIZE

android.permission.GET_TASKS

android.permission.GLOBAL_SEARCH

android.permission.HARDWARE_TEST

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86

File Signature issue

com.network.android.NetworkMain

Android Permissions

3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86