pegasus | Pegasus[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Pegasus.zip
Size 7.7MB
Sample260808-c2m2ka1wex
SHA256 316fac5ae2d4e250b1c0f10b4388fa2c6c3407b118e539a7d865613e373628d9
MD5 4261312a1666ccaeb48d55ddd1d64559
SHA1 620947ef46f8e8f7efbf9442845b81901c8034b6
SHA512 e0677d4202c94df0bf67f24b2f49cfe4a301a2a724282769e22e47c245233670ccf3ce14e5aa2c3535d3dd00b603560e399f521c0ba7232b71a84d27acfc50c8
SSDEEP 196608:NeX/gzDmUkWxyaB/VDM2tR+vI6FXu7VkpU54rbfKEqedf:NC/+oWxf/tRc3peG9Xqedf
TLSH
T186863311B3BB67AAD451303551D3712B7A748C073A13DFE20E9A9C43AD33DAA1A5FB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer trojan pegasus

Malware Config

Signatures

Family: Pegasus
Pegasus is a commercial Android spyware first seen in 2016.
stealer trojan pegasus

Pegasus payload 2 IoCs

resource	yara_rule
static1/unpack001/Pegasus/144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e	family_pegasus1
static1/unpack001/Pegasus/cc9517aafb58279091ac17533293edc1	family_pegasus1

Requests dangerous framework permissions 23 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS

Codesign digest Mismatch 2 IoCs

File was altered after it was signed.

resource
unpack001/Pegasus/144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e
unpack001/Pegasus/bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a

Insecure Codesign Algorithm 6 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/Pegasus/144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e
unpack002/LenovoSafeBox455.apk
unpack002/LenovoSafeWidget115.apk
unpack001/Pegasus/bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a
unpack001/Pegasus/cc9517aafb58279091ac17533293edc1
unpack001/Pegasus/d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320

Untrusted Codesign Signers 6 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/Pegasus/144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e
unpack002/LenovoSafeBox455.apk
unpack002/LenovoSafeWidget115.apk
unpack001/Pegasus/bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a
unpack001/Pegasus/cc9517aafb58279091ac17533293edc1
unpack001/Pegasus/d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320

File Explorer

Pegasus.zip

.zip 7.7MB
Pegasus/144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e

.apk 7.0MB
LenovoSafeBox455.apk

.apk 927KB
LenovoSafeWidget115.apk

.apk 123KB
Pegasus/530b4f4d139f3ef987d661b2a9f74f5f

27KB
Pegasus/bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a

.apk 1.1MB
Pegasus/cc9517aafb58279091ac17533293edc1

.apk 57KB
Pegasus/d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320

.apk 367KB

Pegasus.zip

SHA256 316fac5ae2d4e250b1c0f10b4388fa2c6c3407b118e539a7d865613e373628d9
MD5 4261312a1666ccaeb48d55ddd1d64559
SHA1 620947ef46f8e8f7efbf9442845b81901c8034b6
SHA512 e0677d4202c94df0bf67f24b2f49cfe4a301a2a724282769e22e47c245233670ccf3ce14e5aa2c3535d3dd00b603560e399f521c0ba7232b71a84d27acfc50c8
SSDEEP 196608:NeX/gzDmUkWxyaB/VDM2tR+vI6FXu7VkpU54rbfKEqedf:NC/+oWxf/tRc3peG9Xqedf
TLSH
T186863311B3BB67AAD451303551D3712B7A748C073A13DFE20E9A9C43AD33DAA1A5FB09
MD5 SHA1 SHA512 SSDEEP TLSH

Pegasus/144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e

SHA256 144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e
MD5 29183814f45616d831fdc139e3113718
SHA1 aa47b601dd3a01cf0ec5e2e6da5c4f90c49ba71d
SHA512 c255f6751e97692b4517c9a4d240393098c58e626e09b0d0189b81a8f6cd20967a2f15ce9d793fa8aec76246cafc7d9b2326bf06f6adbd547f458a7d04b17d1d
SSDEEP 196608:pJVfGouCB8oMxqANNjYYUMLRoCRMggq2k+E9p+o3k:prf7uC/Mxq4YSLRowMPqj+E9Io3k
TLSH
T1777612B3F749E8A5D0E3A2339671521660224C708F13EAA33E5EB5341FF7EC45689E85
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Pegasus payload
Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b09dd99b771468df40565e07c94567646216c2d7

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=LeOS,OU=Research,O=Lenovo,L=Beijing View,ST=BJ,C=CN,1.2.840.113549.1.9.1=#0c116c656e6f766f406c656e6f766f2e636f6d

Chains

Jan 1, 0001

com.lenovo.safecenter

android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.READ_CONTACTS android.permission.READ_SMS android.permission.CALL_PHONE android.permission.SEND_SMS android.permission.RECEIVE_SMS android.permission.RECEIVE_MMS android.permission.READ_CALENDAR android.permission.WRITE_CALENDAR android.permission.WRITE_CONTACTS android.permission.WRITE_SMS android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.KILL_BACKGROUND_PROCESSES android.permission.BROADCAST_PACKAGE_REMOVED android.permission.RESTART_PACKAGES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_MOCK_LOCATION android.permission.ACCESS_NETWORK_STATE com.android.browser.permission.READ_HISTORY_BOOKMARKS com.android.browser.permission.WRITE_HISTORY_BOOKMARKS android.permission.FORCE_STOP_PACKAGES android.permission.PACKAGE_USAGE_STATS android.permission.KILL_BACKGROUND_PROCESSES android.permission.WAKE_LOCK android.permission.VIBRATE android.permission.MODIFY_PHONE_STATE android.permission.PROCESS_OUTGOING_CALLS android.permission.RECEIVE_BOOT_COMPLETED android.permission.STATUS_BAR_SERVICE android.permission.SYSTEM_ALERT_WINDOW android.permission.READ_NETWORK_USAGE_HISTORY android.permission.DELETE_PACKAGES android.permission.GET_PACKAGE_SIZE android.permission.READ_LOGS android.permission.WRITE_EXTERNAL_STORAGE android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.CHANGE_NETWORK_STATE android.permission.GET_TASKS android.permission.MOUNT_FORMAT_FILESYSTEMS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.BROADCAST_WAP_PUSH android.permission.RECEIVE_WAP_PUSH android.permission.ACCESS_WIFI_STATE android.permission.BATTERY_STATUS android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_WIFI_STATE android.permission.BLUETOOTH_ADMIN android.permission.BLUETOOTH android.permission.VIBRATE android.permission.FORCE_STOP_PACKAGES android.permission.KILL_BACKGROUND_PROCESSES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.WRITE_SYNC_SETTINGS android.permission.DEVICE_POWER android.permission.SYSTEM_ALERT_WINDOW android.permission.DELETE_CACHE_FILES android.permission.BROADCAST_PACKAGE_REMOVED android.permission.RESTART_PACKAGES android.permission.ACCESS_MOCK_LOCATION com.android.browser.permission.READ_HISTORY_BOOKMARKS com.android.browser.permission.WRITE_HISTORY_BOOKMARKS android.permission.PACKAGE_USAGE_STATS android.permission.WAKE_LOCK android.permission.MODIFY_PHONE_STATE android.permission.PROCESS_OUTGOING_CALLS android.permission.STATUS_BAR_SERVICE android.permission.SET_ACTIVITY_WATCHER android.permission.WRITE_MEDIA_STORAGE android.permission.MASTER_CLEAR com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT com.android.launcher.permission.READ_SETTINGS android.permission.MOVE_PACKAGE android.permission.CLEAR_APP_CACHE android.permission.ACCESS_WIFI_SATAE android.permission.BATTERY_STATUS android.permission.BLUETOOTH

.MainTab.SplashActivity

android.intent.action.MAIN

.MainTab.LeSafeMainActivity

com.lenovo.safecenter.mainTab

.MainTab.VersionUpdateDIalogActivity

.MainTab.FirstUsePasswordSettingActivity

.MainTab.UpdateVersionActivity

com.lenovo.safecenter.updateAndPassword

.HealthCheck.HealthCheckupActivity

.AppsManager.AppsManager

.AppsManager.PermissionControlNew

.AppsManager.ChargeSafeNew

.platform.AgainstTheftSet

com.lenovo.safecenter.AgainstTheftSet

.AppsManager.ApplicationList

.AppsManager.MessageBlackList

.Laboratory.ForbiddenApplication

com.lenovo.safecenter.view.ForbiddenApplication

.Laboratory.GuestModeSet

com.lenovo.safecenter.view.GuestModeSet

.AppsManager.DisplayLog

.AppsManager.CheckDisplayLog

.platform.NotiSMSActivity

.AppsManager.AntiTappingActivity

.AppsManager.DialogActivity

com.lenovo.safecenter.view.DialogActivity

.AppsManager.AppPermManager

.safemode.WhiteSms

.safemode.ErrorWhiteSms

.safemode.SofeModeMain

com.lenovo.safecenter.safemode.SofeModeMain

.safemode.WhiteCall

.safemode.ManWhiteSms

.safemode.WhiteSmsShowByNumber

.safemode.WhiteContract

.safemode.ErrorWhiteContract

.safemode.AddContract

.safemode.ErrorAddContract

.safemode.ContractSetting

.safemode.HandActivity

.MainTab.CallNotifyActivity

.MainTab.SMSNotifyActivity

.Laboratory.SafePaymentDialogActivity

com.lenovo.safecenter.view.LaboratoryActivity

.Laboratory.SafePaymentActivity

com.lenovo.safecenter.SafePaymentActivity

.platform.AgainstTheftSafePhoneSetActivity

.platform.AgainstTheftSafeMailSetActivity

.platform.AgainstTheftPromptActivity

.lenovoAntiSpam.MainActivity

com.lenovo.safecenter.main

.lenovoAntiSpam.views.NightPreActivity

.lenovoAntiSpam.views.ManLocalBlackActivity

.lenovoAntiSpam.views.HandBlackActivity

.lenovoAntiSpam.views.ManLocalBlackAddActivity

.lenovoAntiSpam.views.ManLocalBlackAddContract

.lenovoAntiSpam.views.ManLocalWhiteActivity

.lenovoAntiSpam.views.ManAddWhiteContract

.antivirus.MainActivity

com.lenovo.safecenter.antivirus.main

.antivirus.views.FlashProActivity

com.lenovo.antivirus.gifmain

.antivirus.views.LogActivity

.antivirus.views.FullSystemScanActivity

.antivirus.views.ScanVirusActivity

.antivirus.views.ShowVirusActivity

.antivirus.views.VirusInfo

.antivirus.views.AntiVirusSetting

.antivirus.views.NotiSMSActivity

com.lenovo.antivirus.notice

.lenovoAntiSpam.newview.AntiSpamMain

.lenovoAntiSpam.newview.SignActivity

.lenovoAntiSpam.newview.HarassSet

.safemode.PrivateMainActivity

com.lenovo.safecenter.privatezone

com.lenovo.lps.sus.control.SUSPromptActivity

com.lenovo.lps.sus.control.SUSCustdefNotificationActivity

com.lenovo.lps.sus.control.SUSNotificationActivity

.net.correct.TrafficCorrectSetting

.net.TrafficDailog

.net.TrafficShowDataDailog

.net.LowLevelNetFilter

.net.NetFilter

.AppsManager.SmsSettingsActivity

.net.TrafficStatistics

com.lenovo.safecenter.net.traffic

.net.doublemode.TrafficStatisticsDoubleMode

.net.doublemode.NetSetting

com.lenovo.safecenter.net.setting

.MainTab.HelpActivity

.AppsManager.SettingsActivity

.MainTab.LabUpdateDialogActivity

.lenovoAntiSpam.newview.FirstSignActivity

.lenovoAntiSpam.newview.FirstHarssActivity

.lenovoAntiSpam.newview.ShowConfirm

.lenovoAntiSpam.views.SpamConfirm

.antivirus.views.VirusDeepInfo

.Laboratory.AppUninstall

com.lenovo.safecenter.appuninstall

com.lenovo.performancecenter.performance.TaskManagerActivity

com.lenovo.performancecenter.performance.BootSpeedActivity

com.lenovo.performancecenter.performance.IgnorePreferenceActivity

com.lenovo.performancecenter.performance.WhiteListSelectActivity

com.lenovo.performancecenter.performance.PerfWhitelistActivity

com.lenovo.performancecenter.performance.ClearCacheActivity

com.lenovo.performancecenter.performance.WisdomSpeedPreferenceActivity

com.lenovo.performancecenter.performance.PhoneAccelerateActivity

.shortcut.CleanAcitivty

android.intent.action.MAIN android.intent.action.CREATE_SHORTCUT

.MainTab.AppDownloadActivity

.notificationintercept.NotificationTabActivity

.notificationintercept.NotificationRecordActivity

.notificationintercept.AdManager

.MainTab.QuestionAndAnswer

.lenovoAntiSpam.newview.NumberArea

com.lenovo.safecenter.systeminfo.ui.activity.CommonNumberActivity

com.lenovo.safecenter.systeminfo.ui.activity.SystemExamActivity

com.lenovo.safecenter.systeminfo.ui.activity.ScreenTestActivity

com.lenovo.safecenter.systeminfo.ui.activity.DailyTools

.floatwindow.shortcut.ShortcutActivity

android.intent.action.CREATE_SHORTCUT

.floatwindow.view.FloatwindowCache

.MainTab.AppLockMustUpdateDialogActivity

.Laboratory.RootIntroduction

.lenovoAntiSpam.newview.WhiteABlackMain

com.lenovo.safecenter.manblack com.lenovo.safecenter.manwhite

.safemode.EditSettingActivity

com.lenovo.install.InstallActivity

android.intent.action.VIEW

com.lenovo.install.InstallProgress

com.lenovo.install.InstallErrorActivity

com.lenovo.install.ShowPkgInfoActivity

.MainTab.AboutActivity

.broadcast.SafePaymenUninstallService

.broadcast.AlarmService

com.lenovo.antitheft.ALARM

.broadcast.sendMsgService

com.lenovo.antitheft.SENDMESSAGE

.broadcast.SendSmsService

.support.SecurityService

.support.SafeCenterService

.lenovoAntiSpam.support.DownSysService

com.lenovo.antispam.sysupdate com.lenovo.antispam.sysquery

.lenovoAntiSpam.support.DownNetBlackService

com.lenovo.antispam.netblackupdate com.lenovo.antispam.netblackquery

.lenovoAntiSpam.support.DownSignCallService

com.lenovo.antispam.signcallquery com.lenovo.antispam.signcallupdate

.lenovoAntiSpam.support.UpdateService

.lenovoAntiSpam.support.PhoneListenService

.antivirus.support.InitService

.antivirus.support.SyncDownService

.antivirus.support.installJudgeService

.antivirus.support.dowmdataService

com.lenovo.antivirus.query com.lenovo.antivirus.update

.broadcast.LaboratoryInstallJudgeService

.broadcast.SafePaymentInstallJudgeService

.broadcast.FormatSDService

.broadcast.LockScreenService

com.lenovo.safecenter.lockscreenservice

.net.support.InitializeService

com.lenovo.safecenter.traffic.service.RTC com.lenovo.safecenter.deletetraffic.service.RTC com.lenovo.safecenter.updatetrafficbar.service.RTC com.lenovo.safecenter.correct.traffic.SIM.service.RTC com.lenovo.safecenter.correct.traffic.SIM2.service.RTC com.lenovo.safecenter.notice.traffic.ui.service.RTC

.broadcast.CheckPermissionService

com.lenovo.safecenter.aidl.killvirus.RemoteScanVirusService

com.lenovo.safecenter.aidl.killvirus.RemoteScanVirus

com.lenovo.safecenter.aidl.healthcheck.RemoteHealthCheckService

com.lenovo.safecenter.aidl.healthcheck.RemoteHealthCheck

com.lenovo.safecenter.aidl.usbdebugmode.RemoteUsbDebugModeService

com.lenovo.safecenter.aidl.usbdebugmode.RemoteSetUsbDebugMode

com.lenovo.performancecenter.framework.PolicyService

com.lenovo.performancecenter.framework.CustomerWhiteListService

.shortcut.CleanViewService

.utils.update.LeSafeDownLoadApk

com.lenovo.lps.sus.control.SUSReceiver

com.lenovo.lps.sus.ACTION_UPDATE

.platform.BootBroadcast

android.intent.action.BOOT_COMPLETED android.intent.action.SIM_STATE_CHANGED

.platform.NoticeBroadcast

lenovo.use.permission.denied com.safecenter.broadcast.openChildMode com.safecenter.broadcast.openPrivacyMode com.safecenter.broadcast.openGuestMode com.lenovo.safecenter.view.DialogActivity

.broadcast.AppBroadcast

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED

.broadcast.HarassLogBroadcast

ACTION_BLACK_MESSAGE ACTION_BLACK_PHONE com.lenovo.antivirus.notify

.broadcast.SmsBroadcast

lenovo.backgroud.sendsms SENT_SMS_ACTION

.support.SMSCheckReceiver

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_RECEIVED_ON_SIM

.support.OutPhoneReceiver

android.intent.action.USER_PRESENT

.support.CheckInterChangeReceiver

com.lenovo.antispam.blackperson.change com.lenovo.antispam.whiteperson.change com.lenovo.antispam.netperson.change com.lenovo.securityperson.change com.lenovo.antispam.blackperson..provider.change

.utils.updateLab.UpdateLabReceiver

com.lenovo.antivirus.updateresult com.lenovo.antivirus.queryresult com.lenovo.antispam.blackupdateresult com.lenovo.antispam.blackqueryresult com.lenovo.antispam.sysupdateresult com.lenovo.antispam.sysqueryresult com.lenovo.safecenter.Broadcast.updateLab com.lenovo.antispam.signcallupdateresult com.lenovo.antispam.signcallqueryresult

.utils.updateLab.WifiConnectedReceiver

android.net.wifi.STATE_CHANGE

.lenovoAntiSpam.support.SMSCheckReceiver

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_RECEIVED_ON_SIM

.broadcast.SafeInputMethodBroadcast

com.lenovo.safecenter.safeinputmethod

.broadcast.UpdateTrafficReceiver

com.lenovo.safecenter.updatetrafficbar.broadcast com.lenovo.safecenter.init.trafficbar

.antivirus.support.BootBroadcastReceiver

action.forcestop.antivirus action.antivirus.init

.antivirus.support.AppBroadcast

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_REPLACED

.antivirus.support.alarmreceiver

android.net.conn.CONNECTIVITY_CHANGE

.net.support.BootBroadcast

android.intent.action.BOOT_COMPLETED android.intent.action.ACTION_SHUTDOWN android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.net.conn.CONNECTIVITY_CHANGE com.lenovo.safecenter.traffic.correction android.intent.action.AIRPLANE_MODE

.support.MMSReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED

.antivirus.support.DeleteSDFileBroadcast

action.antivirus.delete.sdfile

.broadcast.InputMethodChangeBroadcast

android.intent.action.INPUT_METHOD_CHANGED com.safecenter.boot.safeinput

com.lenovo.performancecenter.service.object.KillAllPackageReceiver

com.lenovo.safecenter.PERFORMANCE_KILL_ALL_PROCESSES com.lenovo.safecenter.PERFORMANCE_KILL_SINGLE_PROCESS com.lenovo.safecenterwidget.RECORD_KILL_EVENT com.lenovo.safecenter.clearapp

com.lenovo.performancecenter.framework.LeemCenterReceiver

android.intent.action.BOOT_COMPLETED com.lenovo.safecenter.activityswitch

.mmsutils.PushReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED

.Laboratory.SafeHomePageBroadcast

com.lenovo.safecenter.activityswitch

LenovoSafeBox455.apk

SHA256 e0a9bdf5dc4481d913038e6509635b12d12016e820ecc58a5971be3bb72dcb2b
MD5 02297e27886d758b1f6892b5047ff9ff
SHA1 bf03f835c42a8734d9d862741a235ea3491036ea
SHA512 d9784281450f91cc32b4feadc0dbf8d76b10bbcf35e7dcd362bc940103317b4e8fafba9fa9dbe0b954d20478d700b92df4f661f53edc6022d67f3bcd85276c8d
SSDEEP 24576:wtMiI2b4apsiko9W8C/2htK3JdFgdXlQ53RJ3J:5iD5pUoW8e0tqVgdXGhJ
TLSH
T1C1151275FB9AEC26D977C033469242867614CC504782DBA31716B4181DBFE988BCBECC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

c827c4a041bbb8ccab44ceb725a1421a6abbef34

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=LeOS,OU=Research,O=Lenovo,L=Beijing View,ST=BJ,C=CN,1.2.840.113549.1.9.1=#0c116c656e6f766f406c656e6f766f2e636f6d

Chains

Jan 1, 0001

com.lenovo.safebox

LenovoSafeWidget115.apk

SHA256 6972ef902f648ec405adec1a8ac2843048fe269e0570cfa71379545d9b0fbe77
MD5 12c89f415f86784edddeb18072f5113f
SHA1 135c18ae3ca1878895391abe5bd69f858b73fb8c
SHA512 8c4e31290a966db551ae53ca720247779929f2e6ab93166bdd11ba46d6872d328e2670ce2ebd56f95bcbe225f821a4c07856aed9f5ccf677b2876bec1c3cbff0
SSDEEP 3072:znyleVG+yjnp0qWhjKJE0hil5uBl1n8HFZAhCWij:IeM+y7iXWJEyvIz
TLSH
T1BAC3E0C0FB60E436C8739B32D2E59702BE19C8619249B773211DB1944EFBE68778A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

d995e548526b77d083273c0b2854b9d3010322cd

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=LeOS,OU=Research,O=Lenovo,L=Beijing View,ST=BJ,C=CN,1.2.840.113549.1.9.1=#0c116c656e6f766f406c656e6f766f2e636f6d

Chains

Jan 1, 0001

com.lenovo.safecenterwidget

Pegasus/bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a

SHA256 bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a
MD5 8d4b77fa3546149f25bd17357d41fbf0
SHA1 7289737c1dc462726abbe89335a7702c130bbdcc
SHA512 a9a10115072a66d89158a09649ace3702bee021a47195aec0d6046bdf8fae8927b3d36d0a6d7a7302125b5f06d711419390edf2da3c3fbd11a5a3228e6abd9ff
SSDEEP 24576:RkVMvDz5Q6P8aJnB94XqMOkkXLjD+F5VCq7ncRL4GchuT:qKvDlhP8aj9bMvk7jDJqTmsGch0
TLSH
T1FB35330B3523959FF88353B6D50884CB3564A7A70E4F90BB28FDC8BEC6518E26631D4A
MD5 SHA1 SHA512 SSDEEP TLSH

android

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ee9b1b6fc73bf535d8d57461416cde111b2fa4e0

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Unknown,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown

Chains

Jan 1, 0001

seC.dujmehn.qdtheyt

android.permission.FORCE_STOP_PACKAGES android.permission.ACCESS_CHECKIN_PROPERTIES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_LOCATION_EXTRA_COMMANDS android.permission.ACCESS_MOCK_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_SURFACE_FLINGER android.permission.ACCESS_WIFI_STATE android.permission.ACCOUNT_MANAGER android.permission.AUTHENTICATE_ACCOUNTS android.permission.BATTERY_STATS android.permission.BIND_APPWIDGET android.permission.BIND_DEVICE_ADMIN android.permission.BIND_INPUT_METHOD android.permission.BIND_REMOTEVIEWS android.permission.BIND_WALLPAPER android.permission.BLUETOOTH android.permission.BLUETOOTH_ADMIN android.permission.BRICK android.permission.BROADCAST_PACKAGE_REMOVED android.permission.BROADCAST_SMS android.permission.BROADCAST_STICKY android.permission.BROADCAST_WAP_PUSH android.permission.CALL_PHONE android.permission.CALL_PRIVILEGED android.permission.CAMERA android.permission.CHANGE_COMPONENT_ENABLED_STATE android.permission.CHANGE_CONFIGURATION android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_MULTICAST_STATE android.permission.CHANGE_WIFI_STATE android.permission.CLEAR_APP_CACHE android.permission.CLEAR_APP_USER_DATA android.permission.CONTROL_LOCATION_UPDATES android.permission.DELETE_CACHE_FILES android.permission.DELETE_PACKAGES android.permission.DEVICE_POWER android.permission.DIAGNOSTIC android.permission.DISABLE_KEYGUARD android.permission.DUMP android.permission.EXPAND_STATUS_BAR android.permission.FACTORY_TEST android.permission.FLASHLIGHT android.permission.FORCE_BACK android.permission.GET_ACCOUNTS android.permission.GET_PACKAGE_SIZE android.permission.GET_TASKS android.permission.GLOBAL_SEARCH android.permission.HARDWARE_TEST android.permission.INJECT_EVENTS android.permission.INSTALL_LOCATION_PROVIDER android.permission.INSTALL_PACKAGES android.permission.INTERNAL_SYSTEM_WINDOW android.permission.INTERNET android.permission.KILL_BACKGROUND_PROCESSES android.permission.MANAGE_ACCOUNTS android.permission.MANAGE_APP_TOKENS android.permission.MASTER_CLEAR android.permission.MODIFY_AUDIO_SETTINGS android.permission.MODIFY_PHONE_STATE android.permission.MOUNT_FORMAT_FILESYSTEMS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.NFC android.permission.PERSISTENT_ACTIVITY android.permission.PROCESS_OUTGOING_CALLS android.permission.READ_CALENDAR android.permission.READ_CONTACTS android.permission.READ_FRAME_BUFFER android.permission.READ_HISTORY_BOOKMARKS android.permission.READ_INPUT_STATE android.permission.READ_LOGS android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.READ_SYNC_SETTINGS android.permission.READ_SYNC_STATS android.permission.REBOOT android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECEIVE_MMS android.permission.RECEIVE_SMS android.permission.RECEIVE_WAP_PUSH android.permission.RECORD_AUDIO android.permission.REORDER_TASKS android.permission.RESTART_PACKAGES android.permission.SEND_SMS android.permission.SET_ACTIVITY_WATCHER android.permission.SET_ALARM android.permission.SET_ALWAYS_FINISH android.permission.SET_ANIMATION_SCALE android.permission.SET_DEBUG_APP android.permission.SET_ORIENTATION android.permission.SET_PREFERRED_APPLICATIONS android.permission.SET_PROCESS_LIMIT android.permission.SET_TIME android.permission.SET_TIME_ZONE android.permission.SET_WALLPAPER android.permission.SET_WALLPAPER_HINTS android.permission.SIGNAL_PERSISTENT_PROCESSES android.permission.STATUS_BAR android.permission.SUBSCRIBED_FEEDS_READ android.permission.SUBSCRIBED_FEEDS_WRITE android.permission.SYSTEM_ALERT_WINDOW android.permission.UPDATE_DEVICE_STATS android.permission.USE_CREDENTIALS android.permission.USE_SIP android.permission.VIBRATE android.permission.WAKE_LOCK android.permission.WRITE_APN_SETTINGS android.permission.WRITE_CALENDAR android.permission.WRITE_CONTACTS android.permission.WRITE_EXTERNAL_STORAGE android.permission.WRITE_GSERVICES android.permission.WRITE_HISTORY_BOOKMARKS com.android.browser.permission.WRITE_HISTORY_BOOKMARKS android.permission.WRITE_SECURE_SETTINGS android.permission.WRITE_SETTINGS android.permission.WRITE_SMS android.permission.WRITE_SYNC_SETTINGS com.android.browser.permission.READ_HISTORY_BOOKMARKS com.android.email.permission.ACCESS_PROVIDER com.android.email.provider.EmailProvider android.permission.WRITE_APN_SETTINGS android.permission.MODIFY_AUDIO_SETTINGS android.permission.WAKE_LOCK android.permission.SET_WALLPAPER_HINTS android.permission.READ_SYNC_SETTINGS android.permission.READ_SYNC_STATS android.permission.NFC android.permission.READ_SYNC_SETTINGS android.permission.UNINSTALL_SHORTCUT android.permission.CHANGE_WIFI_MULTICAST_STATE android.permission.INTERNET android.permission.NFC android.permission.ACCESS_NOTIFICATION_POLICY android.permission.CHANGE_NETWORK_STATE android.permission.READ_SYNC_STATS android.permission.UNINSTALL_SHORTCUT

Pegasus/cc9517aafb58279091ac17533293edc1

SHA256 9fae5d148b89001555132c896879652fe1ca633d35271db34622248e048c78ae
MD5 cc9517aafb58279091ac17533293edc1
SHA1 28f570754274db96bffa7ac4a53a5ede3508d82c
SHA512 2fb55d4ceb8da9a01d5bf0a9725ee601a252b541f29186311bbc3c515b4cfa3e52107f856f381cfb643b1d2398099c6c0747f1b01baf37e68fd273684fc93fe5
SSDEEP 1536:kdJw+W4W0bQjcK2eZk7A6loQ17y23V9zEj:n/sQQK2mkE6l5I2Fxw
TLSH
T1DA43E18187D08726E23F93302AF1655074753C411E9AE72A1181F65B8FABFF89B41B7E
MD5 SHA1 SHA512 SSDEEP TLSH

android

Pegasus payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

8ad951b33e3303183c11cac0cccd21c926b0875c

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=android,OU=android

Chains

Jan 1, 0001

com.binary.sms.receiver

Pegasus/d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320

SHA256 d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320
MD5 4aa966ff0455560a2918b746ada2ed52
SHA1 4984af24225d3356689585399ef5e49553e6436c
SHA512 e67061519218f5edc241c9458addf51b05a1bd0de604c973756c02018dddb4a893fbebf9ab9a0194b9fc737c7d479c5949b7d3cf7fa444a8bca88853c2d5ebae
SSDEEP 6144:1krLrE0XFUxWeau+qEqoh5pFtdiEnVXZrAhk3X2I9FZIqovhFa5Y5jQ5m3wQ54:1L0XFuNau+qsDkwX7xIqwhXML
TLSH
T10284224DCD63F54ED1CEAA32D1A6D17B96210070AB73FCDC110E8C9ABAA2C550B9CED1
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9542666aa76799df5583956dfbefabd11c58998e

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

0.9.2342.19200300.100.1.1=#0c126c756f6d616f3230303040746f6d2e636f6d

Chains

Jan 1, 0001

com.xxGameAssistant.pao