pegasus | ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

General

Target
ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5
Size 257KB
Sample260723-jrwpaaac83
SHA256 ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5
MD5 7c3ad8fec33465fed6563bbfabb5b13d
SHA1 e5920f3723e62e1850157f09baf556006bf80f74
SHA512 75da7c118879d9430fb13c5a51d76e1278f0c1474d5cc25c4b9684b7d8c0f93b2e44584eee0f8b0d12016bc1efad367b45ff9ca5609853ae345b6d802ff63d10
SSDEEP 6144:OiJF1SCwcTjQGPihLcfUmu9XuS0nbkDIyTkRJ0P1d41RiFV1iFuU:OqF1VHzqLcfIJ4bqIeP9d4jkKFuU
TLSH
T10C4423E5CA2E677BD102A3308F06F449960E2305C4A5B630FD96D57A1D528788BFBDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer trojan pegasus

Malware Config

Signatures

Family: Pegasus
Pegasus is a commercial Android spyware first seen in 2016.
stealer trojan pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus1

Requests dangerous framework permissions 21 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to use SIP service.	android.permission.USE_SIP
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

File Explorer

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

.apk 257KB

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

SHA256 ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5
MD5 7c3ad8fec33465fed6563bbfabb5b13d
SHA1 e5920f3723e62e1850157f09baf556006bf80f74
SHA512 75da7c118879d9430fb13c5a51d76e1278f0c1474d5cc25c4b9684b7d8c0f93b2e44584eee0f8b0d12016bc1efad367b45ff9ca5609853ae345b6d802ff63d10
SSDEEP 6144:OiJF1SCwcTjQGPihLcfUmu9XuS0nbkDIyTkRJ0P1d41RiFV1iFuU:OqF1VHzqLcfIJ4bqIeP9d4jkKFuU
TLSH
T10C4423E5CA2E677BD102A3308F06F449960E2305C4A5B630FD96D57A1D528788BFBDCB
MD5 SHA1 SHA512 SSDEEP TLSH

android

Pegasus payload
Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

145b1dd5d11f389f6678c333984a2cee904a8bfc

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Unknown,ST=Unknown,C=UK

Chains

Jan 1, 0001

com.network.android

android.permission.FORCE_STOP_PACKAGES android.permission.ACCESS_CHECKIN_PROPERTIES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_LOCATION_EXTRA_COMMANDS android.permission.ACCESS_MOCK_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_SURFACE_FLINGER android.permission.ACCESS_WIFI_STATE android.permission.ACCOUNT_MANAGER android.permission.AUTHENTICATE_ACCOUNTS android.permission.BATTERY_STATS android.permission.BIND_APPWIDGET android.permission.BIND_DEVICE_ADMIN android.permission.BIND_INPUT_METHOD android.permission.BIND_REMOTEVIEWS android.permission.BIND_WALLPAPER android.permission.BLUETOOTH android.permission.BLUETOOTH_ADMIN android.permission.BRICK android.permission.BROADCAST_PACKAGE_REMOVED android.permission.BROADCAST_SMS android.permission.BROADCAST_STICKY android.permission.BROADCAST_WAP_PUSH android.permission.CALL_PHONE android.permission.CALL_PRIVILEGED android.permission.CAMERA android.permission.CHANGE_COMPONENT_ENABLED_STATE android.permission.CHANGE_CONFIGURATION android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_MULTICAST_STATE android.permission.CHANGE_WIFI_STATE android.permission.CLEAR_APP_CACHE android.permission.CLEAR_APP_USER_DATA android.permission.CONTROL_LOCATION_UPDATES android.permission.DELETE_CACHE_FILES android.permission.DELETE_PACKAGES android.permission.DEVICE_POWER android.permission.DIAGNOSTIC android.permission.DISABLE_KEYGUARD android.permission.DUMP android.permission.EXPAND_STATUS_BAR android.permission.FACTORY_TEST android.permission.FLASHLIGHT android.permission.FORCE_BACK android.permission.GET_ACCOUNTS android.permission.GET_PACKAGE_SIZE android.permission.GET_TASKS android.permission.GLOBAL_SEARCH android.permission.HARDWARE_TEST android.permission.INJECT_EVENTS android.permission.INSTALL_LOCATION_PROVIDER android.permission.INSTALL_PACKAGES android.permission.INTERNAL_SYSTEM_WINDOW android.permission.INTERNET android.permission.KILL_BACKGROUND_PROCESSES android.permission.MANAGE_ACCOUNTS android.permission.MANAGE_APP_TOKENS android.permission.MASTER_CLEAR android.permission.MODIFY_AUDIO_SETTINGS android.permission.MODIFY_PHONE_STATE android.permission.MOUNT_FORMAT_FILESYSTEMS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.NFC android.permission.PERSISTENT_ACTIVITY android.permission.PROCESS_OUTGOING_CALLS android.permission.READ_CALENDAR android.permission.READ_CONTACTS android.permission.READ_FRAME_BUFFER android.permission.READ_HISTORY_BOOKMARKS android.permission.READ_INPUT_STATE android.permission.READ_LOGS android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.READ_SYNC_SETTINGS android.permission.READ_SYNC_STATS android.permission.REBOOT android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECEIVE_MMS android.permission.RECEIVE_SMS android.permission.RECEIVE_WAP_PUSH android.permission.RECORD_AUDIO android.permission.REORDER_TASKS android.permission.RESTART_PACKAGES android.permission.SEND_SMS android.permission.SET_ACTIVITY_WATCHER android.permission.SET_ALARM android.permission.SET_ALWAYS_FINISH android.permission.SET_ANIMATION_SCALE android.permission.SET_DEBUG_APP android.permission.SET_ORIENTATION android.permission.SET_PREFERRED_APPLICATIONS android.permission.SET_PROCESS_LIMIT android.permission.SET_TIME android.permission.SET_TIME_ZONE android.permission.SET_WALLPAPER android.permission.SET_WALLPAPER_HINTS android.permission.SIGNAL_PERSISTENT_PROCESSES android.permission.STATUS_BAR android.permission.SUBSCRIBED_FEEDS_READ android.permission.SUBSCRIBED_FEEDS_WRITE android.permission.SYSTEM_ALERT_WINDOW android.permission.UPDATE_DEVICE_STATS android.permission.USE_CREDENTIALS android.permission.USE_SIP android.permission.VIBRATE android.permission.WAKE_LOCK android.permission.WRITE_APN_SETTINGS android.permission.WRITE_CALENDAR android.permission.WRITE_CONTACTS android.permission.WRITE_EXTERNAL_STORAGE android.permission.WRITE_GSERVICES android.permission.WRITE_HISTORY_BOOKMARKS com.android.browser.permission.WRITE_HISTORY_BOOKMARKS android.permission.WRITE_SECURE_SETTINGS android.permission.WRITE_SETTINGS android.permission.WRITE_SMS android.permission.WRITE_SYNC_SETTINGS com.android.browser.permission.READ_HISTORY_BOOKMARKS com.android.email.permission.ACCESS_PROVIDER com.android.email.provider.EmailProvider android.permission.WRITE_APN_SETTINGS

Android Permissions

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

Permissions

android.permission.FORCE_STOP_PACKAGES

android.permission.ACCESS_CHECKIN_PROPERTIES

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.ACCESS_MOCK_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_SURFACE_FLINGER

android.permission.ACCESS_WIFI_STATE

android.permission.ACCOUNT_MANAGER

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.BATTERY_STATS

android.permission.BIND_APPWIDGET

android.permission.BIND_DEVICE_ADMIN

android.permission.BIND_INPUT_METHOD

android.permission.BIND_REMOTEVIEWS

android.permission.BIND_WALLPAPER

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.BRICK

android.permission.BROADCAST_PACKAGE_REMOVED

android.permission.BROADCAST_SMS

android.permission.BROADCAST_STICKY

android.permission.BROADCAST_WAP_PUSH

android.permission.CALL_PHONE

android.permission.CALL_PRIVILEGED

android.permission.CAMERA

android.permission.CHANGE_COMPONENT_ENABLED_STATE

android.permission.CHANGE_CONFIGURATION

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_MULTICAST_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.CLEAR_APP_CACHE

android.permission.CLEAR_APP_USER_DATA

android.permission.CONTROL_LOCATION_UPDATES

android.permission.DELETE_CACHE_FILES

android.permission.DELETE_PACKAGES

android.permission.DEVICE_POWER

android.permission.DIAGNOSTIC

android.permission.DISABLE_KEYGUARD

android.permission.DUMP

android.permission.EXPAND_STATUS_BAR

android.permission.FACTORY_TEST

android.permission.FLASHLIGHT

android.permission.FORCE_BACK

android.permission.GET_ACCOUNTS

android.permission.GET_PACKAGE_SIZE

android.permission.GET_TASKS

android.permission.GLOBAL_SEARCH

android.permission.HARDWARE_TEST

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

File Signature issue

com.network.android.NetworkMain

.roomTap.ShowDesktop

.roomTap.BlackScreen

com.network.android.android.monitor.AppService

com.network.android.android.monitor.AppServicePinger

com.network.android.android.monitor.NetworkManagerService

.roomTap.MediaPlayerHandlerService

com.network.ussd.CDUSSDService

com.network.android.SmsReceiver

com.network.android.agent.NetworkReceiver

.roomTap.AutoAnswerReceiver

com.network.android.AndroidCallDirectWatcher

com.network.android.BootReceiver

com.network.media.CoreReceiver

com.network.location.PingReceiver

com.network.location.OnAlarmReceiver

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5

File Signature issue

com.network.android.NetworkMain

.roomTap.ShowDesktop

.roomTap.BlackScreen

com.network.android.android.monitor.AppService

com.network.android.android.monitor.AppServicePinger

com.network.android.android.monitor.NetworkManagerService

.roomTap.MediaPlayerHandlerService

com.network.ussd.CDUSSDService

com.network.android.SmsReceiver

com.network.android.agent.NetworkReceiver

.roomTap.AutoAnswerReceiver

com.network.android.AndroidCallDirectWatcher

com.network.android.BootReceiver

com.network.media.CoreReceiver

com.network.location.PingReceiver

com.network.location.OnAlarmReceiver

Android Permissions

ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5