jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]SMSreg[.]lb[.]87d1e8371017a2bf1c9003f0bc29ba1a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a
Size 9.0MB
Sample261012-2z3rnsssbs
SHA256 f9ad56582ff937e19e89d1aef98970d5c06a986529690b7d38a340ff851dc820
MD5 87d1e8371017a2bf1c9003f0bc29ba1a
SHA1 71092b0745ee8b944a2886720f44af6ecca42159
SHA512 faba7b1fe904eb99b037fe7ea80eeff82ed130d8bcd8d36afab9c156b75ddf321176384368f1eedb9bd3a32b210f21148adfb6c0194ba05f2ec5dd761e3b057b
SSDEEP 196608:9o7Go9tgEVelq19UJLvUVNJOuWVYCY7JFadiNY07cCNCZWs+j3j+h:Ctd0lq1yJLCNQuWV8kd8F8sxrG
TLSH
T11B9623C27F90C854F0186B7452EF4125DB772EC08A2099DB394DB2395FF3EA85B5C1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 28 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Insecure Codesign Algorithm 4 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a
unpack001/lyhtgh.mn.ltplugin_v1017.pl
unpack001/lyhtgh.mn.ltplugin_v1020.pl
unpack001/sr_alipay_5.1.0.apk

Untrusted Codesign Signers 4 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a
unpack001/lyhtgh.mn.ltplugin_v1017.pl
unpack001/lyhtgh.mn.ltplugin_v1020.pl
unpack001/sr_alipay_5.1.0.apk

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a

.apk 9.0MB
lyhtgh.mn.ltplugin_v1017.pl

.apk 145KB
lyhtgh.mn.ltplugin_v1020.pl

.apk 121KB
sr_alipay_5.1.0.apk

.apk 748KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a

SHA256 f9ad56582ff937e19e89d1aef98970d5c06a986529690b7d38a340ff851dc820
MD5 87d1e8371017a2bf1c9003f0bc29ba1a
SHA1 71092b0745ee8b944a2886720f44af6ecca42159
SHA512 faba7b1fe904eb99b037fe7ea80eeff82ed130d8bcd8d36afab9c156b75ddf321176384368f1eedb9bd3a32b210f21148adfb6c0194ba05f2ec5dd761e3b057b
SSDEEP 196608:9o7Go9tgEVelq19UJLvUVNJOuWVYCY7JFadiNY07cCNCZWs+j3j+h:Ctd0lq1yJLCNQuWV8kd8F8sxrG
TLSH
T11B9623C27F90C854F0186B7452EF4125DB772EC08A2099DB394DB2395FF3EA85B5C1AA
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

d9e4eb2be2e5c1e209d2b817152ea0086e9e5ad9

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=kanshuwang,OU=kanshuwang,O=kanshuwang,L=beijing,ST=beijing,C=86

Chains

Jan 1, 0001

com.taidanengtong.xiaoxl

android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_PHONE_STATE android.permission.ACCESS_WIFI_STATE android.permission.SYSTEM_ALERT_WINDOW android.permission.GET_TASKS android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.READ_PHONE_STATE android.permission.SEND_SMS android.permission.INTERNET android.permission.ACCESS_WIFI_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.ACCESS_NETWORK_STATE android.permission.SYSTEM_ALERT_WINDOW android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_WIFI_STATE android.permission.GET_TASKS android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.SEND_SMS android.permission.WRITE_SETTINGS android.permission.WRITE_EXTERNAL_STORAGE android.permission.RECEIVE_SMS android.permission.RECEIVE_MMS android.permission.RECEIVE_WAP_PUSH android.permission.RECEIVE_BOOT_COMPLETED android.permission.RECEIVE_USER_PRESENT android.permission.READ_SMS android.permission.WRITE_SMS android.permission.INTERNET android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_PHONE_STATE android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.WRITE_SMS android.permission.ACCESS_WIFI_STATE android.permission.ACCESS_NETWORK_STATE android.permission.READ_SMS android.permission.WRITE_SMS android.permission.READ_SMS android.permission.RECEIVE_SMS android.permission.SEND_SMS android.permission.READ_PHONE_STATE android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.INTERNET android.permission.WRITE_EXTERNAL_STORAGE android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_COARSE_LOCATION android.permission.GET_TASKS

lyhtgh.mn.ltplugin_v1017.pl

SHA256 4981873b2137cb7761e11044e5b2477d2c077143c32eb72db2118012fb13246f
MD5 4613058b3a523b5fc940226cb7751532
SHA1 d15d1c99db0efc19a2511339cbef90aebbb7dcaa
SHA512 7f3b28207a57a1b43ac266b58ad2965aaaf5102bec0503d0533dba33af3f5722a278a036e9e5b33f4c55165db4e26ef88f815785277530051381c11e0552f3f6
SSDEEP 3072:XKxp6tNTdMXTy5AZOW4V6qSXh67nYTXg8icbRJL4:X0q1d4TyIOv7ag8pRJL4
TLSH
T1D7E32345A3CC6732F0B245BCD7367C5B0D68F998F7A666DD013021881C1DB19ABA8FB9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

6f2b34e1278219c148bc765408030e18234b96bd

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=letu,OU=letu,O=letu,L=letu,ST=letu,C=letu

Chains

Jan 1, 0001

com.lyhtgh.pay.ltplugin

lyhtgh.mn.ltplugin_v1020.pl

SHA256 68c0f09eda956d686a66d1e272ac1925ea1526fbd584b3d8e9e5ebd10c01ab3e
MD5 955e7f36ad2b5732fd1561f82e353b2d
SHA1 a9375d0ac955dcd7569636734172f00ed27a4d9e
SHA512 b7a83da45dc6cefc4f9a64d05039c2503553bf9714d09d95230d9d86a262cf58456818f968dfc2acb4eeb8ddf9f647b2b43213866338d597804109dbeae5b2c6
SSDEEP 3072:96v2lB+dJlxnm9i4ViGeuDrmKYU7RbGm1SblVp:I2X+dJlsk4ViGzsU7ZV1S
TLSH
T105C3120EE6D0B25EF0DB5E3E6C6A25DAD88E3B704045D79D2D0600DE6DCDDD4EA34A90
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

2d6658fae6fbf31753ac59b152d98e6848381031

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=letu,OU=letu,O=letu,L=letu,ST=letu,C=letu

Chains

Jan 1, 0001

com.lyhtgh.pay.ltplugin

sr_alipay_5.1.0.apk

SHA256 76a24f83ad15586ff9a2081e420a707be9ddb0b5047e5b6de5974c41624ff2c1
MD5 d06ea38e4210a87d6b96f8b0491df677
SHA1 3ba573396398757088e559a9d372049a377eb05a
SHA512 3d43e5bfad2b703a804a53048b6a88228a11fb80ac641d6594f774cc07f6c7367e0ee80b29966d02c9206542f467f55b0f1ddbbfef0ec372256314a7d1071f30
SSDEEP 12288:IjRAsoln+WMB1EgrGERh4xWgtSM7vXrRCn4I5p2Cnfv:IjRApZ+WM7yER61P7jw4IGSfv
TLSH
T1F2F41213971896A1F02BE971835A766224248C406350EBE323C5F63A5FFFDC56B35BCA
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

cf01f4aedb74e97693a9f6b4159692f450210e86

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=shiqun.shi,OU=alipay,O=alipay,L=beijing,ST=beijing,C=cn

Chains

Jan 1, 0001

com.alipay.android.app

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.GET_TASKS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.SEND_SMS

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_NETWORK_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.GET_TASKS

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.SEND_SMS

android.permission.WRITE_SETTINGS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.permission.RECEIVE_WAP_PUSH

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_USER_PRESENT

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.lb.87d1e8371017a2bf1c9003f0bc29ba1a

File Signature issue

org.cocos2dx.cpp.AppActivity

com.srapp.abm.alipay.BillingAlipayActivity

com.jl.core.AppActivity

com.lyhtgh.pay.activity.SdkPayActivity

com.ksl.vdf.Gac

com.srapp.core.SrCoreApp

com.jl.www.module.smspay.service.SmsService

com.lyhtgh.pay.services.SmsStatusService

com.lyhtgh.pay.services.SmsDataService

com.ksl.vdf.Gse

com.srapp.core.UserPresentReceiver

com.jl.www.module.smspay.service.SmsReceiver

com.lyhtgh.pay.receiver.BootReceiver

com.lyhtgh.pay.receiver.NetworkReceiver

com.lyhtgh.pay.receiver.InSmsReceiver

com.ksl.vdf.Gre

lyhtgh.mn.ltplugin_v1017.pl

File Signature issue

lyhtgh.mn.ltplugin_v1020.pl

File Signature issue

sr_alipay_5.1.0.apk

File Signature issue

com.alipay.android.app.pay.MainActivity

com.alipay.android.app.pay.TransContainer

com.alipay.android.app.pay.HyperlinkActivity

com.alipay.android.app.pay.PageForBrowser

com.alipay.android.app.MspService

com.alipay.android.app.AlarmReciver

com.alipay.android.app.helper.UserIdShareProvider