shopper | jaffacakes118_HEUR[.]Trojan-Dropper[.]AndroidOS[.]Agent[.]on[.]d5f35bea2c1181508b2f13ccdb228e68

General

Target
jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68
Size 212KB
Sample261012-dbwrfsvt2p
SHA256 aeadfd9b226d57f374b241c4fe07670f5298af75aa05a4c79193955edb807ca5
MD5 d5f35bea2c1181508b2f13ccdb228e68
SHA1 e765385d53d0d9f1225fc32fe614fd6203a7a95c
SHA512 096269c8d47508782bed0fd1aa267a6638aba83f44e497efea73188df978f7939057dce2f063e27d54c4432772dcc738b38685194b3caa5227dfed77de4b8f9f
SSDEEP 6144:RxyU9Lju2rFyvvrjFnnpA+51MzuSzvMt5nY/6shC:bvhjxrSXFnnpAq1Mz5zkJH
TLSH
T10A24225B9569CE69F60F63B98E079324A16481000DB9436F091AB90B31F6FFEDB46CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan shopper

Malware Config

Signatures

Family: Shopper
Shopper is an Android trojan first seen in 2020.
trojan shopper

Android Shopper payload 1 IoCs

resource	yara_rule
sample	family_shopper

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

File Explorer

jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

.apk 212KB

jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

SHA256 aeadfd9b226d57f374b241c4fe07670f5298af75aa05a4c79193955edb807ca5
MD5 d5f35bea2c1181508b2f13ccdb228e68
SHA1 e765385d53d0d9f1225fc32fe614fd6203a7a95c
SHA512 096269c8d47508782bed0fd1aa267a6638aba83f44e497efea73188df978f7939057dce2f063e27d54c4432772dcc738b38685194b3caa5227dfed77de4b8f9f
SSDEEP 6144:RxyU9Lju2rFyvvrjFnnpA+51MzuSzvMt5nY/6shC:bvhjxrSXFnnpAq1Mz5zkJH
TLSH
T10A24225B9569CE69F60F63B98E079324A16481000DB9436F091AB90B31F6FFEDB46CF4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android Shopper payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

0ee0cb19c6724cf8282f02b7ef5d65664c675703

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=com.pop.xykedg

Chains

Jan 1, 0001

com.pop.xykedg

Android Permissions

jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

Permissions

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.GET_ACCOUNTS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.RECEIVE_BOOT_COMPLETED

jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

File Signature issue

com.h5game.MainActivity

com.h5game.GamePlayActivity

com.h5game.TransActivity

com.h5game.AdTransActivity

com.h5game.service.Localservice

com.h5game.service.RemoteService

com.h5game.service.MJobService

com.h5game.receiver.MReceiver

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68

File Signature issue

com.h5game.MainActivity

com.h5game.GamePlayActivity

com.h5game.TransActivity

com.h5game.AdTransActivity

com.h5game.service.Localservice

com.h5game.service.RemoteService

com.h5game.service.MJobService

com.h5game.receiver.MReceiver

Android Permissions

jaffacakes118_HEUR.Trojan-Dropper.AndroidOS.Agent.on.d5f35bea2c1181508b2f13ccdb228e68