jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]Skymobi[.]a[.]6e0fcb9737e46d737169cedb61f257af

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af
Size 7.1MB
Sample261012-3q8f8stsat
SHA256 48e5f383ae311718ae22ea0b365930e5df04f56a6b452c11e359c8daa43375cc
MD5 6e0fcb9737e46d737169cedb61f257af
SHA1 c60a60f747ff230ced5fe6e78c5f18b150fc4cc1
SHA512 e75d30ef6e8dd7c67af21d43f4e3604ea8df7989442784358a44ebaf756a67cc60872f72655208eb233ee4998b605a703a0da7ec01b256351fdc6a7b05780fb9
SSDEEP 196608:Ds9wKrvazH4+Fr6suK6y+310hWZ3ESdiQiqirZIuxLrPc7PFo2:Y9wKrO4EGs56y+310hPCiQoKuxSto2
TLSH
T19E762327D710E942D667407E722F1443B9F04E14229FFA6A7D29BD246FB7F500A086BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af

Insecure Codesign Algorithm 6 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af
unpack001/com.skymobi.pay.plugin.main_v10014.pl
unpack001/com.skymobi.pay.plugin.recordupload_v10009.pl
unpack001/com.skymobi.pay.plugin.smspay_v10028.pl
unpack002/skymobi_pay_wxplugin.apk
unpack001/tongyu-pay-lib.apk

Untrusted Codesign Signers 6 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af
unpack001/com.skymobi.pay.plugin.main_v10014.pl
unpack001/com.skymobi.pay.plugin.recordupload_v10009.pl
unpack001/com.skymobi.pay.plugin.smspay_v10028.pl
unpack002/skymobi_pay_wxplugin.apk
unpack001/tongyu-pay-lib.apk

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af

.apk 7.1MB
com.skymobi.pay.plugin.main_v10014.pl

.apk 58KB
com.skymobi.pay.plugin.recordupload_v10009.pl

.apk 38KB
com.skymobi.pay.plugin.smspay_v10028.pl

.apk 230KB
skymobi_pay_wxplugin.apk

.apk 33KB
tongyu-pay-lib.apk

.apk 68KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af

SHA256 48e5f383ae311718ae22ea0b365930e5df04f56a6b452c11e359c8daa43375cc
MD5 6e0fcb9737e46d737169cedb61f257af
SHA1 c60a60f747ff230ced5fe6e78c5f18b150fc4cc1
SHA512 e75d30ef6e8dd7c67af21d43f4e3604ea8df7989442784358a44ebaf756a67cc60872f72655208eb233ee4998b605a703a0da7ec01b256351fdc6a7b05780fb9
SSDEEP 196608:Ds9wKrvazH4+Fr6suK6y+310hWZ3ESdiQiqirZIuxLrPc7PFo2:Y9wKrO4EGs56y+310hPCiQoKuxSto2
TLSH
T19E762327D710E942D667407E722F1443B9F04E14229FFA6A7D29BD246FB7F500A086BE
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

7643c792ae6b0327288780665e374dceb801d774

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=TongYu

Chains

Jan 1, 0001

com.xcwef.wafeaf

com.skymobi.pay.plugin.main_v10014.pl

SHA256 e44f6d6dc173a53f4d7e4bbcbc92bf991ffea14af1612ee29b81f56c33b6d5ef
MD5 b0a39aaa44ac82ec0fd321914f6aa668
SHA1 10a20428675480d68cbc64a5a4be12bde81aaca2
SHA512 fde8a61b36e3a27acd98ce24b594b71690456c40f76785dac0a4809f66570d4196b60e1e47616cf9855faac18822fe6d953b59534a39506daa15c7a285d70999
SSDEEP 1536:3a3tkLIW2T8X1S2TN6DH3twagFsydRWd69RJwC27nLt:qmkW1lSiNsaapSRWd61wd7Lt
TLSH
T1234302B33FF6AE50DF5BE9BC72D9A8CE151191C0CC30C197145095E61AE2E9122B1F6A
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

1ac67221107298dda2d0393055352814fe21660c

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=sky,OU=cn,O=skymobi,L=hz,ST=zj,C=430000

Chains

Jan 1, 0001

com.skymobi.pay.plugin.main

com.skymobi.pay.plugin.recordupload_v10009.pl

SHA256 8199c84eb1412ac9f13edc3bff4cd66e788847143bd0c8497ce7f699a0d68e77
MD5 55c24dc00f667f62ee0cc0dfca41fc28
SHA1 1811dd0ba5f5bdfeef743332b7ef1b8e4097a23c
SHA512 b5a5269065f4bcf05c560315255c49dc7eafc015458eca425f6b44eec0ee74c3e1d481e06df70deca25056a8fd070efb5adcf364061a8e5c1e26fb8e102caf69
SSDEEP 768:Tf5Ui0Wh/Ndv7j7LF12NADhHl2ASeCYuD:+WNNdDJ0NahHMAS3D
TLSH
T18003F104DDED7C41F202A6F81171883BB110E9A6E2F997BB4825ACB4DFDAC089746DD3
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b401f65b112e7eab71f6df4a517b2a54b20322c1

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=sky,OU=cn,O=skymobi,L=hz,ST=zj,C=430000

Chains

Jan 1, 0001

com.skymobi.pay.plugin.recordupload

com.skymobi.pay.plugin.smspay_v10028.pl

SHA256 d705772a36c81fa49accfc9fa55b638ad4502016de00e5790872cb0d26bf8714
MD5 296a1134a4225941e7e3867f9c03caff
SHA1 4c798eca899af98670aef8937c0a5160a3e235b1
SHA512 db9c5bd51748d107df49c3693129069cd0e3183141a74624d199bc78dea7830f7c8a737c18e35804e454b13e4c31b97e845466956893ba013415c255a3812524
SSDEEP 6144:l95dFl8F+z1d7PXl/vsx+hAhoTx5+310h1:pTHvf2++oV5+310h1
TLSH
T128341244DFEC535CDAC6B13308B4F886534E3EF54386AF269B43A16F14E88768158F6A
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

6331ce948fc55551d59eb0abfe11126d4c64df8b

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=sky,OU=cn,O=skymobi,L=hz,ST=zj,C=430000

Chains

Jan 1, 0001

com.skymobi.pay.plugin.smspay

skymobi_pay_wxplugin.apk

SHA256 6d6f22a6688689b35a723620794bc03e958a69e1770073bd921d3c6129733f26
MD5 73d8a99bf9de4eb876f1739627197190
SHA1 135f99fe90f129274c74f5c9b032294bfae3d05a
SHA512 d5d9068f5fbf3c85bafb8edf084c40e4411814f02542cde120815951c6a2cfae78a0b08f930ef7143f10145ce0abcbd942c44f54afbb0d963ba47c653a162049
SSDEEP 768:iwFX6Lei59coj/94ML6plol/S54bLhWQeJ:iwF0t5jj1/LMcaivhWQC
TLSH
T16DF2E1D4CBDCB68EECF5D8BD565B5567A679BC2D5162CBE30401B04C4CBDC88A90228D
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

90c96f8f37af07500776182f9e6cc7359d8af677

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=sky,OU=cn,O=skymobi,L=hz,ST=zj,C=430000

Chains

Jan 1, 0001

com.skymobi.pay.wxplugin

tongyu-pay-lib.apk

SHA256 b696af25b3382db45dfb37e3cbddbdc084114e08b9a24322572e582e077b230b
MD5 d889a2dc05a8d31bec541b19e55a15e1
SHA1 9af90881a26a3512c2993406aebc1e691d826bfe
SHA512 8ce2d857f54abd849a560cf596d90a2ac3ef63273478752c3dc3a619be747da58aebb92332d1aac08a7bdd3baffb20f71c3a3022a6358a82d75c410eff97e067
SSDEEP 1536:WSbgLKxe7wu7t6XQyLaFRBb8HaSyVkdNwaDomQFwZ:WbKx0MXQysbcpNw6obiZ
TLSH
T1AF63027FA7CDE985F1E69DB4EBEE10578C56C05CC133EAAF1A1E487856840085AF2F12
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9a51ad722c394de6c3eee0cadb3bacc2e2fa3e84

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Lv

Chains

Jan 1, 0001

com.mgame.pay.lib

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_SMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_CONFIGURATION

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_SMS

android.permission.READ_PHONE_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_APN_SETTINGS

android.permission.VIBRATE

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.GET_TASKS

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.a.6e0fcb9737e46d737169cedb61f257af

File Signature issue

com.wg.dreampet.GameActivity

com.skymobi.pay.sdk.normal.zimon.EpsActivity

com.skymobi.pay.sdk.normal.zimon.EpsService

com.skymobi.pay.sdk.normal.zimon.sms.PayCtrlService

com.skymobi.pay.sdk.normal.zimon.sms.SkyPayRemoteService

com.mgame.pay.main.SmsReciever

com.skymobi.pay.sdk.normal.zimon.EpsReceiver

com.skymobi.pay.plugin.main_v10014.pl

File Signature issue

com.skymobi.pay.plugin.recordupload_v10009.pl

File Signature issue

com.skymobi.pay.plugin.smspay_v10028.pl

File Signature issue

skymobi_pay_wxplugin.apk

File Signature issue

com.skymobi.pay.wxplugin.wxapi.WXPayEntryActivity

tongyu-pay-lib.apk

File Signature issue

com.mgame.pay.lib.Demo

com.mgame.pay.lib.sms.SmsReciever