Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Joker.32.origin
Contains typical banking trojan/virus code.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) a####.heye####.com:80
- TCP(TLS/1.0) 64.2####.162.95:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) cloudco####.google####.com:443
- TCP(TLS/1.0) c####.oss-ap-####.aliy####.com:443
- TCP(TLS/1.0) e####.fresh####.com:443
- TCP(TLS/1.0) 1####.250.150.95:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.2) 64.2####.162.95:443
- TCP(TLS/1.2) 64.2####.165.94:443
- TCP(TLS/1.2) 64.2####.161.113:443
- UDP 64.2####.164.95:443
DNS requests:
- a####.heye####.com
- app-mea####.com
- c####.oss-ap-####.aliy####.com
- cloudco####.google####.com
- e####.fresh####.com
- g####.face####.com
- m####.go####.com
- sett####.crashly####.com
- sett####.crashly####.com.####.8
- ssl.google-####.com
HTTP GET requests:
- a####.heye####.com/api/zero/updatetime?appid=####&device_id=####&device_...
File system changes:
Creates the following files:
- /data/data/####/-1467345288
- /data/data/####/1736555510-2124038507
- /data/data/####/60ED49560155-0001-0E22-C7E82D99B724BeginSession.cls_temp
- /data/data/####/60ED49560155-0001-0E22-C7E82D99B724SessionApp.cls_temp
- /data/data/####/60ED49560155-0001-0E22-C7E82D99B724SessionOS.cls_temp
- /data/data/####/60ED495900F1-0001-0E98-C7E82D99B724BeginSession.cls_temp
- /data/data/####/60ED495900F1-0001-0E98-C7E82D99B724SessionApp.cls_temp
- /data/data/####/60ED495900F1-0001-0E98-C7E82D99B724SessionDevice.cls_temp
- /data/data/####/60ED495900F1-0001-0E98-C7E82D99B724SessionOS.cls_temp
- /data/data/####/60ED49AB0337-0001-1482-C7E82D99B724BeginSession.cls_temp
- /data/data/####/60ED49AB0337-0001-1482-C7E82D99B724SessionApp.cls_temp
- /data/data/####/60ED49AB0337-0001-1482-C7E82D99B724SessionDevice.cls_temp
- /data/data/####/60ED49AB0337-0001-1482-C7E82D99B724SessionOS.cls_temp
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/MobiHelp.db-journal
- /data/data/####/MobihelpPreferences.xml
- /data/data/####/MobihelpPreferences.xml.bak
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/_jobqueue-TextSecureJobs-journal
- /data/data/####/bugle.xml
- /data/data/####/bugle.xml.bak
- /data/data/####/bugle_db.db-journal
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.editormsg.chatby_preferences.xml
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/custom_theme_config.xml
- /data/data/####/d0e1xfio1l4e
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/google_app_measurement.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/la2unc5he6dofi7le
- /data/data/####/la2unc5he6dofi7le.dex
- /data/data/####/la2unc5he6dofi7le.dex.flock (deleted)
- /data/data/####/persisted_config
- /data/data/####/sa_08b1cd03-a76f-4d73-aa44-7d0f1a82028c_1626163585180.tap
- /data/data/####/sa_09ea64c2-c9f1-4f2a-bf49-563aa4aaebd5_1626163583111.tap
- /data/data/####/sa_0a81fdba-ddcf-489d-a8bc-b30ed5d8b6d7_1626163588107.tap
- /data/data/####/sa_1a04d1c0-2f40-485e-bd79-a55284ef9ac9_1626163600472.tap
- /data/data/####/sa_2135dc12-3f94-43e4-8a81-de15c9f47336_1626163573885.tap
- /data/data/####/sa_29f96d83-d10d-4112-8731-5571795560c4_1626163580627.tap
- /data/data/####/sa_398ac76c-91f5-4d4f-a3a3-902ca88ce056_1626163548811.tap
- /data/data/####/sa_3ac51b00-d0ad-48ac-b785-5c8f803179fd_1626163554499.tap
- /data/data/####/sa_48930d86-7897-4049-8043-bcd69a1e9597_1626163590468.tap
- /data/data/####/sa_48b0f0dd-8dc3-4231-a0df-99d70f087fc8_1626163593186.tap
- /data/data/####/sa_4fd476ae-32af-45c1-a829-211ce52e5726_1626163565136.tap
- /data/data/####/sa_55da3a75-4440-49e1-aabd-bc9a83de483a_1626163567304.tap
- /data/data/####/sa_5e7b1b6e-e840-469d-8461-90bdf531ecd5_1626163595474.tap
- /data/data/####/sa_872e851b-b2ef-4da9-be9a-c60075cfe516_1626163603159.tap
- /data/data/####/sa_c61c0660-ca35-4c60-b970-f56dacd9106f_1626163598263.tap
- /data/data/####/sa_c702c3ed-3ba4-4915-9b03-74159f3d0c9a_1626163576201.tap
- /data/data/####/sa_d77ed561-40b0-4b6a-8e81-54d803f659b3_1626163562419.tap
- /data/data/####/sa_d7a294f4-336f-4954-ad61-be9834541fb4_1626163578554.tap
- /data/data/####/sa_e664a165-04c6-45c8-bad0-def635818932_1626163556949.tap
- /data/data/####/sa_ea5c2458-046f-437b-8f60-105655990c64_1626163559784.tap
- /data/data/####/sa_f041a84d-2f27-4c21-9618-a2e6bcc8aad7_1626163569470.tap
- /data/data/####/sa_f24255f5-bad0-49b3-ba42-e62dcaa14d8d_1626163571559.tap
- /data/data/####/sa_f2998f70-9323-4c65-8ae4-3238a7c3d726_1626163551201.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap (deleted)
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/theme_config.xml
- /data/data/####/zero_update_time.xml
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Contains Play Store Frosting.
