jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]AndroidOS[.]Dowgin[.]i[.]2e3508df54347eaf1c8d5

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5
Size 3.2MB
Sample261015-dba5raev9t
SHA256 2bada6ba786f32af4f310c52c836782949efea6f29fe8931f0615b7c4ff64edd
MD5 fe27959bcd82e3508df54347eaf1c8d5
SHA1 1f8e537cfb59b6e371733bef5e52fdb2496ebe97
SHA512 f299ae5311473a6ae3b0f56dd186f1b149621f3994cde086cc6e0a9989797b047f2bd79a9a89557f96dd42a6f530be9c5edf7fb3987677e566664f5a50270490
SSDEEP 98304:3ijBkkvkuJSHix6eBMcaTnG+Vgxcn4sEC/7g6sBSqZ/:SlV8uQCxbSG+AATg5XZ/
TLSH
T117E51286F366B816C4F7C23A92B56372711DCC558787FB9F0688B7782AFB4D84904AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

.apk 3.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

SHA256 2bada6ba786f32af4f310c52c836782949efea6f29fe8931f0615b7c4ff64edd
MD5 fe27959bcd82e3508df54347eaf1c8d5
SHA1 1f8e537cfb59b6e371733bef5e52fdb2496ebe97
SHA512 f299ae5311473a6ae3b0f56dd186f1b149621f3994cde086cc6e0a9989797b047f2bd79a9a89557f96dd42a6f530be9c5edf7fb3987677e566664f5a50270490
SSDEEP 98304:3ijBkkvkuJSHix6eBMcaTnG+Vgxcn4sEC/7g6sBSqZ/:SlV8uQCxbSG+AATg5XZ/
TLSH
T117E51286F366B816C4F7C23A92B56372711DCC558787FB9F0688B7782AFB4D84904AC4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

79454048cb0c980d41c128610b5f1895a772efea

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Chains

Jan 1, 0001

com.cameraapp.secreteye

com.tnavitech.homescreen.CameraSettings

com.coderplus.filepicker.FilePickerActivity

com.tnavitech.homescreen.HomeScreen

com.tnavitech.homescreen.GalleryFragment

com.tnavitech.homescreen.AppInfoTabHost

com.tnavitech.homescreen.SecretEyeHomeScreen

com.tnavitech.homescreen.FronFaceStartServiceActivity

android.intent.action.CREATE_SHORTCUT

com.tnavitech.homescreen.BackFaceStartServiceActivity

android.intent.action.CREATE_SHORTCUT

com.tnavitech.homescreen.AppPicker

com.gc.phonetutorial.activities.TutorialActivity

com.tnavitech.homescreen.FirstStartupApp

android.intent.action.MAIN

com.tnavitech.utils.FilePickerActivity

com.tnavitech.homescreen.AppInfo

com.tnavitech.lockpattern.PatternSetter

com.tnavitech.lockpattern.PatternLocker

com.tnavitech.lockpattern.PatternBackupActivity

com.tnavitech.lockpattern.ExtendPatternActivity

com.tnavitech.lockpattern.MainPatternLocker

com.tnavitect.startup.StartupActivity

com.tnavitech.lockpattern.PatternRecoveryActivity

com.tnavitech.lockpattern.PatternRecoveryChangeLockPattern

com.tnavitech.lockpattern.RecoverySetPattern

com.tnavitech.homescreen.MapActivity

com.tnavitech.upload.ConnectToGoolgeDrive

rwy.qkwo.xulsk.a

Android Permissions

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

Permissions

android.permission.GET_ACCOUNTS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.PROCESS_OUTGOING_CALLS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.DISABLE_KEYGUARD

android.permission.READ_PHONE_STATE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.GET_TASKS

android.permission.RESTART_PACKAGES

android.permission.KILL_BACKGROUND_PROCESSES

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

File Signature issue

com.tnavitech.homescreen.CameraSettings

com.coderplus.filepicker.FilePickerActivity

com.tnavitech.homescreen.HomeScreen

com.tnavitech.homescreen.GalleryFragment

com.tnavitech.homescreen.AppInfoTabHost

com.tnavitech.homescreen.SecretEyeHomeScreen

com.tnavitech.homescreen.FronFaceStartServiceActivity

com.tnavitech.homescreen.BackFaceStartServiceActivity

com.tnavitech.homescreen.AppPicker

com.gc.phonetutorial.activities.TutorialActivity

com.tnavitech.homescreen.FirstStartupApp

com.tnavitech.utils.FilePickerActivity

com.tnavitech.homescreen.AppInfo

com.tnavitech.lockpattern.PatternSetter

com.tnavitech.lockpattern.PatternLocker

com.tnavitech.lockpattern.PatternBackupActivity

com.tnavitech.lockpattern.ExtendPatternActivity

com.tnavitech.lockpattern.MainPatternLocker

com.tnavitect.startup.StartupActivity

com.tnavitech.lockpattern.PatternRecoveryActivity

com.tnavitech.lockpattern.PatternRecoveryChangeLockPattern

com.tnavitech.lockpattern.RecoverySetPattern

com.tnavitech.homescreen.MapActivity

com.tnavitech.upload.ConnectToGoolgeDrive

rwy.qkwo.xulsk.a

com.tnavitech.homescreen.DrawOverCameraService

com.tnavitech.homescreen.FrontFaceDrawOverCameraService

com.tnavitech.homescreen.BackFaceDrawOverCameraService

com.tnavitech.homescreen.PowerButtonService

rwy.qkwo.xulsk.s

com.tnavitech.utils.KeyPadListener

rwy.qkwo.xulsk.b

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5

File Signature issue

com.tnavitech.homescreen.CameraSettings

com.coderplus.filepicker.FilePickerActivity

com.tnavitech.homescreen.HomeScreen

com.tnavitech.homescreen.GalleryFragment

com.tnavitech.homescreen.AppInfoTabHost

com.tnavitech.homescreen.SecretEyeHomeScreen

com.tnavitech.homescreen.FronFaceStartServiceActivity

com.tnavitech.homescreen.BackFaceStartServiceActivity

com.tnavitech.homescreen.AppPicker

com.gc.phonetutorial.activities.TutorialActivity

com.tnavitech.homescreen.FirstStartupApp

com.tnavitech.utils.FilePickerActivity

com.tnavitech.homescreen.AppInfo

com.tnavitech.lockpattern.PatternSetter

com.tnavitech.lockpattern.PatternLocker

com.tnavitech.lockpattern.PatternBackupActivity

com.tnavitech.lockpattern.ExtendPatternActivity

com.tnavitech.lockpattern.MainPatternLocker

com.tnavitect.startup.StartupActivity

com.tnavitech.lockpattern.PatternRecoveryActivity

com.tnavitech.lockpattern.PatternRecoveryChangeLockPattern

com.tnavitech.lockpattern.RecoverySetPattern

com.tnavitech.homescreen.MapActivity

com.tnavitech.upload.ConnectToGoolgeDrive

rwy.qkwo.xulsk.a

com.tnavitech.homescreen.DrawOverCameraService

com.tnavitech.homescreen.FrontFaceDrawOverCameraService

com.tnavitech.homescreen.BackFaceDrawOverCameraService

com.tnavitech.homescreen.PowerButtonService

rwy.qkwo.xulsk.s

com.tnavitech.utils.KeyPadListener

rwy.qkwo.xulsk.b

Android Permissions

jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Dowgin.i.2e3508df54347eaf1c8d5