pegasus | 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

General

Target
9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae
Size 57KB
Sample260805-tqdgesck2x
SHA256 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae
MD5 cc9517aafb58279091ac17533293edc1
SHA1 28f570754274db96bffa7ac4a53a5ede3508d82c
SHA512 2fb55d4ceb8da9a01d5bf0a9725ee601a252b541f29186311bbc3c515b4cfa3e52107f856f381cfb643b1d2398099c6c0747f1b01baf37e68fd273684fc93fe5
SSDEEP 1536:kdJw+W4W0bQjcK2eZk7A6loQ17y23V9zEj:n/sQQK2mkE6l5I2Fxw
TLSH
T1DA43E18187D08726E23F93302AF1655074753C411E9AE72A1181F65B8FABFF89B41B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer trojan pegasus

Malware Config

Signatures

Family: Pegasus
Pegasus is a commercial Android spyware first seen in 2016.
stealer trojan pegasus

Pegasus payload 1 IoCs

resource	yara_rule
sample	family_pegasus1

Requests dangerous framework permissions 21 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to use SIP service.	android.permission.USE_SIP
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

File Explorer

9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

.apk 57KB

9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

SHA256 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae
MD5 cc9517aafb58279091ac17533293edc1
SHA1 28f570754274db96bffa7ac4a53a5ede3508d82c
SHA512 2fb55d4ceb8da9a01d5bf0a9725ee601a252b541f29186311bbc3c515b4cfa3e52107f856f381cfb643b1d2398099c6c0747f1b01baf37e68fd273684fc93fe5
SSDEEP 1536:kdJw+W4W0bQjcK2eZk7A6loQ17y23V9zEj:n/sQQK2mkE6l5I2Fxw
TLSH
T1DA43E18187D08726E23F93302AF1655074753C411E9AE72A1181F65B8FABFF89B41B7E
MD5 SHA1 SHA512 SSDEEP TLSH

android

Pegasus payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

8ad951b33e3303183c11cac0cccd21c926b0875c

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=android,OU=android

Chains

Jan 1, 0001

com.binary.sms.receiver

android.permission.FORCE_STOP_PACKAGES android.permission.ACCESS_CHECKIN_PROPERTIES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_LOCATION_EXTRA_COMMANDS android.permission.ACCESS_MOCK_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_SURFACE_FLINGER android.permission.ACCESS_WIFI_STATE android.permission.ACCOUNT_MANAGER android.permission.AUTHENTICATE_ACCOUNTS android.permission.BATTERY_STATS android.permission.BIND_APPWIDGET android.permission.BIND_DEVICE_ADMIN android.permission.BIND_INPUT_METHOD android.permission.BIND_REMOTEVIEWS android.permission.BIND_WALLPAPER android.permission.BLUETOOTH android.permission.BLUETOOTH_ADMIN android.permission.BRICK android.permission.BROADCAST_PACKAGE_REMOVED android.permission.BROADCAST_SMS android.permission.BROADCAST_STICKY android.permission.BROADCAST_WAP_PUSH android.permission.CALL_PHONE android.permission.CALL_PRIVILEGED android.permission.CAMERA android.permission.CHANGE_COMPONENT_ENABLED_STATE android.permission.CHANGE_CONFIGURATION android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_MULTICAST_STATE android.permission.CHANGE_WIFI_STATE android.permission.CLEAR_APP_CACHE android.permission.CLEAR_APP_USER_DATA android.permission.CONTROL_LOCATION_UPDATES android.permission.DELETE_CACHE_FILES android.permission.DELETE_PACKAGES android.permission.DEVICE_POWER android.permission.DIAGNOSTIC android.permission.DISABLE_KEYGUARD android.permission.DUMP android.permission.EXPAND_STATUS_BAR android.permission.FACTORY_TEST android.permission.FLASHLIGHT android.permission.FORCE_BACK android.permission.GET_ACCOUNTS android.permission.GET_PACKAGE_SIZE android.permission.GET_TASKS android.permission.GLOBAL_SEARCH android.permission.HARDWARE_TEST android.permission.INJECT_EVENTS android.permission.INSTALL_LOCATION_PROVIDER android.permission.INSTALL_PACKAGES android.permission.INTERNAL_SYSTEM_WINDOW android.permission.INTERNET android.permission.KILL_BACKGROUND_PROCESSES android.permission.MANAGE_ACCOUNTS android.permission.MANAGE_APP_TOKENS android.permission.MASTER_CLEAR android.permission.MODIFY_AUDIO_SETTINGS android.permission.MODIFY_PHONE_STATE android.permission.MOUNT_FORMAT_FILESYSTEMS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.NFC android.permission.PERSISTENT_ACTIVITY android.permission.PROCESS_OUTGOING_CALLS android.permission.READ_CALENDAR android.permission.READ_CONTACTS android.permission.READ_FRAME_BUFFER android.permission.READ_HISTORY_BOOKMARKS android.permission.READ_INPUT_STATE android.permission.READ_LOGS android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.READ_SYNC_SETTINGS android.permission.READ_SYNC_STATS android.permission.REBOOT android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECEIVE_MMS android.permission.RECEIVE_SMS android.permission.RECEIVE_WAP_PUSH android.permission.RECORD_AUDIO android.permission.REORDER_TASKS android.permission.RESTART_PACKAGES android.permission.SEND_SMS android.permission.SET_ACTIVITY_WATCHER android.permission.SET_ALARM android.permission.SET_ALWAYS_FINISH android.permission.SET_ANIMATION_SCALE android.permission.SET_DEBUG_APP android.permission.SET_ORIENTATION android.permission.SET_PREFERRED_APPLICATIONS android.permission.SET_PROCESS_LIMIT android.permission.SET_TIME android.permission.SET_TIME_ZONE android.permission.SET_WALLPAPER android.permission.SET_WALLPAPER_HINTS android.permission.SIGNAL_PERSISTENT_PROCESSES android.permission.STATUS_BAR android.permission.SUBSCRIBED_FEEDS_READ android.permission.SUBSCRIBED_FEEDS_WRITE android.permission.SYSTEM_ALERT_WINDOW android.permission.UPDATE_DEVICE_STATS android.permission.USE_CREDENTIALS android.permission.USE_SIP android.permission.VIBRATE android.permission.WAKE_LOCK android.permission.WRITE_APN_SETTINGS android.permission.WRITE_CALENDAR android.permission.WRITE_CONTACTS android.permission.WRITE_EXTERNAL_STORAGE android.permission.WRITE_GSERVICES android.permission.WRITE_HISTORY_BOOKMARKS com.android.browser.permission.WRITE_HISTORY_BOOKMARKS android.permission.WRITE_SECURE_SETTINGS android.permission.WRITE_SETTINGS android.permission.WRITE_SMS android.permission.WRITE_SYNC_SETTINGS com.android.browser.permission.READ_HISTORY_BOOKMARKS com.android.email.permission.ACCESS_PROVIDER com.android.email.provider.EmailProvider android.permission.WRITE_APN_SETTINGS

Android Permissions

9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

Permissions

android.permission.FORCE_STOP_PACKAGES

android.permission.ACCESS_CHECKIN_PROPERTIES

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.ACCESS_MOCK_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_SURFACE_FLINGER

android.permission.ACCESS_WIFI_STATE

android.permission.ACCOUNT_MANAGER

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.BATTERY_STATS

android.permission.BIND_APPWIDGET

android.permission.BIND_DEVICE_ADMIN

android.permission.BIND_INPUT_METHOD

android.permission.BIND_REMOTEVIEWS

android.permission.BIND_WALLPAPER

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.BRICK

android.permission.BROADCAST_PACKAGE_REMOVED

android.permission.BROADCAST_SMS

android.permission.BROADCAST_STICKY

android.permission.BROADCAST_WAP_PUSH

android.permission.CALL_PHONE

android.permission.CALL_PRIVILEGED

android.permission.CAMERA

android.permission.CHANGE_COMPONENT_ENABLED_STATE

android.permission.CHANGE_CONFIGURATION

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_MULTICAST_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.CLEAR_APP_CACHE

android.permission.CLEAR_APP_USER_DATA

android.permission.CONTROL_LOCATION_UPDATES

android.permission.DELETE_CACHE_FILES

android.permission.DELETE_PACKAGES

android.permission.DEVICE_POWER

android.permission.DIAGNOSTIC

android.permission.DISABLE_KEYGUARD

android.permission.DUMP

android.permission.EXPAND_STATUS_BAR

android.permission.FACTORY_TEST

android.permission.FLASHLIGHT

android.permission.FORCE_BACK

android.permission.GET_ACCOUNTS

android.permission.GET_PACKAGE_SIZE

android.permission.GET_TASKS

android.permission.GLOBAL_SEARCH

android.permission.HARDWARE_TEST

9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

File Signature issue

com.binary.sms.receiver.SkeletonActivity

com.binary.sms.receiver.SmsReceiver

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae

File Signature issue

com.binary.sms.receiver.SkeletonActivity

com.binary.sms.receiver.SmsReceiver

Android Permissions

9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae