jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]Skymobi[.]b[.]94cff4c667f14b1b9e2937ae1d9e7ae9

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9
Size 4.6MB
Sample261012-3rperahs6s
SHA256 332145b99c451e38656653be8a17f806dabfb46d9f010a4ef6fc524aa5e05474
MD5 94cff4c667f14b1b9e2937ae1d9e7ae9
SHA1 fa64f5856468450ab62643b04f81ad5138a6aad2
SHA512 99643d67f21295d7e88d48de691714c9c7a377484d62f36c5e8f4542a0b091aa4f74568e2737a7c6f89a4c5ffd1f2ae31fc0a41f6d632b933a82f0458f075c98
SSDEEP 98304:OjrPhUF5j12zsZzr4qv3bgCVKwavtgfrVO23KgSr5jmgVt8NVD5bcV895N/:OjrJQ12z4rDbgCVKwaUVOSij6fP95N/
TLSH
T1D12633C9AA70A49AF4776173C379C2375E62BF529A60E8EF325F72490F736000B55B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Insecure Codesign Algorithm 3 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9
unpack001/com.skymobi.appui.sole_v1001.apk
unpack001/com.skymobi.pay.opplugin_V2017.apk

Untrusted Codesign Signers 3 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9
unpack001/com.skymobi.appui.sole_v1001.apk
unpack001/com.skymobi.pay.opplugin_V2017.apk

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9

.apk 4.6MB
com.skymobi.appui.sole_v1001.apk

.apk 341KB
com.skymobi.pay.opplugin_V2017.apk

.apk 189KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9

SHA256 332145b99c451e38656653be8a17f806dabfb46d9f010a4ef6fc524aa5e05474
MD5 94cff4c667f14b1b9e2937ae1d9e7ae9
SHA1 fa64f5856468450ab62643b04f81ad5138a6aad2
SHA512 99643d67f21295d7e88d48de691714c9c7a377484d62f36c5e8f4542a0b091aa4f74568e2737a7c6f89a4c5ffd1f2ae31fc0a41f6d632b933a82f0458f075c98
SSDEEP 98304:OjrPhUF5j12zsZzr4qv3bgCVKwavtgfrVO23KgSr5jmgVt8NVD5bcV895N/:OjrJQ12z4rDbgCVKwaUVOSij6fP95N/
TLSH
T1D12633C9AA70A49AF4776173C379C2375E62BF529A60E8EF325F72490F736000B55B60
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

72169e8ae1f8a6d0587c928c617057ed9ca6ec7e

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

O=International Games System,L=Taipei,ST=Taiwan

Chains

Jan 1, 0001

com.igs.Optimus.fishingb

android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.WRITE_EXTERNAL_STORAGE android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.INTERNET android.permission.ACCESS_NETWORK_STATE android.permission.CHANGE_CONFIGURATION android.permission.READ_SMS android.permission.WRITE_SMS android.permission.SEND_SMS android.permission.RECEIVE_SMS android.permission.RECEIVE_BOOT_COMPLETED android.permission.ACCESS_NETWORK_STATE android.permission.READ_PHONE_STATE android.permission.ACCESS_COARSE_LOCATION android.permission.CHANGE_NETWORK_STATE android.permission.CHANGE_WIFI_STATE android.permission.ACCESS_WIFI_STATE android.permission.UPDATE_DEVICE_STATS android.permission.WRITE_APN_SETTINGS android.permission.VIBRATE android.permission.RUN_INSTRUMENTATION android.permission.MODIFY_PHONE_STATE android.permission.WRITE_SETTINGS android.permission.WRITE_SECURE_SETTINGS android.permission.GET_TASKS android.permission.ACCESS_NETWORK_STATE android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.VIBRATE android.permission.INTERNET android.permission.ACCESS_WIFI_STATE android.permission.ACCESS_NETWORK_STATE android.permission.GET_TASKS android.permission.WAKE_LOCK android.permission.READ_PHONE_STATE android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.WRITE_EXTERNAL_STORAGE android.permission.RESTART_PACKAGES com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT com.android.launcher.permission.READ_SETTINGS

com.skymobi.appui.sole_v1001.apk

SHA256 62745948072ebb0a50242979001aedd1fd1f9f0ef3457be4474a182961c10c68
MD5 1c55c51bab71aaff7b1ef11b17026e52
SHA1 4cdba839a1a6cf564f7aaee0cdeaaba20ae26190
SHA512 38023ede34083b8c20d0be0982d0cab30745732e9d2218c7911895b16c329deeef249b7c103eba1ac2afed13b009cecd48437751b88731dd09675b7b46bbd6b1
SSDEEP 6144:kBJ2P0ZYtHOWbPz0burga1fvyTFj9pn0Lsi8UYEO4mBa378hcytb3et:kBMPFV5LIoIp9pnSROdBa37ct0
TLSH
T114742243B3A5A07AF4FF8A338B734503C9E5EF60C620A96B030375D12B7B75641D96A9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

66a18f32b57c7561f3d394e677dee22dafff3d76

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=sky,OU=cn,O=skymobi,L=hz,ST=zj,C=430000

Chains

Jan 1, 0001

com.skymobi.appui.sole

com.skymobi.pay.opplugin_V2017.apk

SHA256 dc55c0952f54064f229d4105fe09178ab2061dba5ac33a78ac76bd711bfaeb0d
MD5 7ca433f40d2e4d750cd5d19e0998e005
SHA1 dbb1f221cb279c9c067be19ae2756a1c9b5b67c8
SHA512 a561bf5401050c65c5f227b3457d76bd48c4182ecfba5213b02800fc7072b209ee3baf25d024a145314503f946773dde8fc0e17907ee618286fa42c8ab323404
SSDEEP 3072:MLWTvQatpn8vCt1WgMsNFlRkSlj4Z1j4ipaEGdWGGWXEnJ:/TvZ8vCbRbvjEZ4hEcGqAJ
TLSH
T1DF14125CB2D80A36F83B77346AD7D4DF9331BB90FA0AC92F2563910B5461A39C3114B9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b2fd59d3c40a1f440e44189d12ddeca2c4bffc01

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=sky,OU=cn,O=skymobi,L=hz,ST=zj,C=430000

Chains

Jan 1, 0001

com.skymobi.pay.opplugin

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_CONFIGURATION

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.UPDATE_DEVICE_STATS

android.permission.WRITE_APN_SETTINGS

android.permission.VIBRATE

android.permission.RUN_INSTRUMENTATION

android.permission.MODIFY_PHONE_STATE

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.GET_TASKS

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.VIBRATE

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.GET_TASKS

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RESTART_PACKAGES

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.Skymobi.b.94cff4c667f14b1b9e2937ae1d9e7ae9

File Signature issue

org.cocos2dx.cpp.AppActivity

com.skymobi.pay.sdk.SkyPayActivity

com.skymobi.pay.third.activity.impl.EnterChargeCenter

com.skymobi.pay.third.activity.impl.QueryChargeResultActivity

com.skymobi.pay.third.activity.impl.HelpActivity

com.myapp.sdkproxy.context.ProxyActivity

com.skymobi.pay.sms.service.SmsService

com.skymobi.pay.sms.service.SynService

com.skymobi.pay.common.service.PayCtrlService

com.skymobi.pay.services.SkyPayRemoteService

com.skymobi.pay.third.service.CheckResultBackgroundService

com.myapp.sdkproxy.context.ProxyService

com.skymobi.pay.sms.receiver.BootReceiver

com.skymobi.pay.sms.receiver.SmsReceiver

com.skymobi.pay.sms.receiver.NetworkReceiver

com.myapp.sdkproxy.context.ProxyReceiver

com.skymobi.appui.sole_v1001.apk

File Signature issue

com.skymobi.pay.opplugin_V2017.apk

File Signature issue

com.skymobi.pay.sdk.SkyPayActivity

com.skymobi.pay.third.activity.impl.EnterChargeCenter

com.skymobi.pay.third.activity.impl.QueryChargeResultActivity

com.skymobi.pay.third.activity.impl.HelpActivity

com.skymobi.pay.sms.service.SmsService

com.skymobi.pay.sms.service.SynService

com.skymobi.pay.common.service.PayCtrlService

com.skymobi.pay.services.SkyPayRemoteService

com.skymobi.pay.third.service.CheckResultBackgroundService

com.skymobi.pay.sms.receiver.BootReceiver

com.skymobi.pay.sms.receiver.SmsReceiver

com.skymobi.pay.sms.receiver.NetworkReceiver