jaffacakes118_not-a-virus[.]HEUR[.]RiskTool[.]AndroidOS[.]SmsPay[.]il[.]609facd197639ab6b9d0d740e1b1e281

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281
Size 1.9MB
Sample261012-3sraqstsbx
SHA256 9cde5c6ea53d33b106e750225f49a9a7d4c989eefed67af392f8d51be66d3451
MD5 609facd197639ab6b9d0d740e1b1e281
SHA1 ea95783a8d8a5f9a839cdd4669313a3be59f7311
SHA512 21acd2d75736810eb4e57396ed534f31052e3f44e2373d3e15df5424c0869222263b4915f5f7934ffffb119682d42d149dda447c63b4e5a7f5db425d41853893
SSDEEP 49152:2D54vdljC3im1kqUh1b+nnqQv7tcKZQoF6q:2iC3imrUPsnR75uoIq
TLSH
T1849533426E89A218D37611309F99F259BB2DAC0E4A9FF63B4635706C4EBBDC08F45F44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS

Insecure Codesign Algorithm 2 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281
unpack001/tongyu-pay-lib.apk

Unsigned APK 2 IoCs

Checks for missing APK codesign signature.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281
unpack001/BDTX140

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281
unpack001/tongyu-pay-lib.apk

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281

.apk 1.9MB
BDTX140

.apk 97KB
tongyu-pay-lib.apk

.apk 83KB

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281

SHA256 9cde5c6ea53d33b106e750225f49a9a7d4c989eefed67af392f8d51be66d3451
MD5 609facd197639ab6b9d0d740e1b1e281
SHA1 ea95783a8d8a5f9a839cdd4669313a3be59f7311
SHA512 21acd2d75736810eb4e57396ed534f31052e3f44e2373d3e15df5424c0869222263b4915f5f7934ffffb119682d42d149dda447c63b4e5a7f5db425d41853893
SSDEEP 49152:2D54vdljC3im1kqUh1b+nnqQv7tcKZQoF6q:2iC3imrUPsnR75uoIq
TLSH
T1849533426E89A218D37611309F99F259BB2DAC0E4A9FF63B4635706C4EBBDC08F45F44
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

84be98000689b197427ce96823a5ce957b239e79

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=1

Chains

Jan 1, 0001

com.yelye.wewewleop.pp

com.ronghe.jmrhsdk.rever.RHRever

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

com.ep.base.receiver.EPReceiver

android.provider.Telephony.SMS_RECEIVED

com.y.f.jar.pay.InNoticeReceiver

android.provider.Telephony.SMS_RECEIVED

gaxi.hsj.au423wv.gs.JfGb

android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.SIM_STATE_CHANGED android.intent.action.NOTIFICATION_ADD android.intent.action.SERVICE_STATE android.intent.action.NOTIFICATION_REMOVE android.intent.action.NOTIFICATION_UPDATE android.bluetooth.adapter.action.STATE_CHANGED android.intent.action.ANY_DATA_STATE android.net.wifi.STATE_CHANGE android.intent.action.BOOT_COMPLETED android.intent.action.SCREEN_ON android.intent.action.USER_PRESENT

com.mgame.pay.main.SmsReciever

android.provider.Telephony.SMS_RECEIVED

com.wenchd.jzf.rever.JiRever

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

bn.sdk.szwcsss.common.az.c.receiver.SmsReceiver

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

com.android.mm.yun.BsmeySReceiver

android.provider.Telephony.SMS_RECEIVED android.intent.action_BS_MEY android.net.conn.CONNECTIVITY_CHANGE android.intent.action.TIME_SET android.intent.action.TIME_TICK

com.cn.lvchuang.pay.service.LlcReceiverOne

android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.net.wifi.supplicant.CONNECTION_CHANGE android.provider.Telephony.SMS_RECEIVED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

BDTX140

SHA256 d5d1be3b6c8c03db2c1b21d1d2c8baa9bcb935e76bf52aef74943fd61e4c00ba
MD5 417458e694c152659fbc53595a68c7e7
SHA1 6c03360971aa291eca4ee32e7ab92c31bdfa850b
SHA512 f953131e4722c1d518b6aa535eb1f955e4a65912148502f3728e27d7eaf41feb92b854fee8527d3d603f06b673bbc90a3e1dac48f2f2ef188acb4b990439e1fd
SSDEEP 1536:JTcXO2SqdvlWJfWmRuh5XH20enZk+99iDntPjzIga8tBiJon+jFsiaxNbltULYaZ:cdgWmUh5XH2/nn2tn+jF67bkY0
TLSH
T1E6A302479BF6C608C1B7903BDAFA250FA5B1F915078E3F960C4F96B1BBD9E906144C21
MD5 SHA1 SHA512 SSDEEP TLSH

android

Unsigned APK

Checks for missing APK codesign signature.

com.door.pay.sdk

tongyu-pay-lib.apk

SHA256 f4e87e5f8f8ebfec57cb785bc25bc4e26a9f57d55eaf3e05dfee63abf9fd425a
MD5 c3bcf234de5f88ae32bd5568a028a0cb
SHA1 b6c9306e84f3c34bbf39465326ed2724719c8573
SHA512 c9bdbf9e3798bd5907880ee7645366157aec2bbdcb963e51d5bb8c06beb503d560f7894152a37e20762b7d0eaae8f9b430a5ed7fe31b5b900f53dabd10d507ce
SSDEEP 1536:MVEdES8vHHVohb1ZmZkKsyv8wkONr7z0lCsSQ3THCx6UxbgLKxe7wuet6XRyLaFu:kqES8vHHVEtw317z0lCsSYucKxRMXRyZ
TLSH
T11C8312AFCF6F7017DDD9923C6ED1923999118C2ECA76A8EF510309B646C78403AF2B50
MD5 SHA1 SHA512 SSDEEP TLSH

android

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ecf41026be57bdc3f4f78caa61e7102c75037726

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Lv

Chains

Jan 1, 0001

com.mgame.pay.lib

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.READ_PHONE_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.INTERNET

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_SMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.GET_TASKS

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.ACCESS_CACHE_FILESYSTEM

android.permission.BROADCAST_STICKY

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.READ_SETTINGS

android.permission.BROADCAST_SMS

android.permission.READ_INTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.UPDATE_APP_OPS_STATS

android.permission.WRITE_INTERNAL_STORAGE

android.permission.RESTART_PACKAGES

android.permission.GET_ACCOUNTS

android.permission.READ_LOGS

android.permission.RECEIVE_MMS

android.permission.DISABLE_KEYGUARD

android.permission.CHANGE_CONFIGURATION

android.permission.WRITE_APN_SETTINGS

android.permission.VIBRATE

android.permission.WRITE_SECURE_SETTINGS

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281

File Signature issue

com.sgirl.activity.WelcomeActivity

com.sgirl.activity.BaseActivity

com.sgirl.activity.DialogActivity

com.sgirl.activity.MainTabActivity

com.sgirl.activity.VideoDetailActivity

com.sgirl.activity.PlayActivity

com.sgirl.activity.ImageShowActivity

com.sgirl.activity.PayMemberActivity

com.sgirl.activity.WebviewActivity

com.yuanlang.pay.TheDialogActivity

com.yuanlang.pay.TheActivity

com.kIXwj.x42at.LXw1T.E0Kf1

com.ronghe.jmrhsdk.srv.InitSvice

com.y.f.jar.pay.UpdateServices

com.yf.y.f.init.service.InitService

com.wyzfpay.service.CoreService

cn.cuter.main.MyService

com.yuanlang.pay.TheService

com.yuanlang.pay.JobScheduleService

gaxi.hsj.au423wv.gs.DdFw

com.wenchd.jzf.srv.InitSvice

bn.sdk.szwcsss.common.az.c.service.WcSer

com.android.mm.yun.BsmeyService

com.cn.lvchuang.pay.service.LlcServoceOne

com.ronghe.jmrhsdk.rever.RHRever

com.ep.base.receiver.EPReceiver

com.y.f.jar.pay.InNoticeReceiver

gaxi.hsj.au423wv.gs.JfGb

com.mgame.pay.main.SmsReciever

com.wenchd.jzf.rever.JiRever

bn.sdk.szwcsss.common.az.c.receiver.SmsReceiver

com.android.mm.yun.BsmeySReceiver

com.cn.lvchuang.pay.service.LlcReceiverOne

BDTX140

com.door.pay.sdk.impl.MainActivity

com.door.pay.sdk.impl.testActivity

com.door.pay.sdk.sms.impl.testService

tongyu-pay-lib.apk

File Signature issue

com.mgame.pay.lib.Demo

Android Permissions

jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SmsPay.il.609facd197639ab6b9d0d740e1b1e281