Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Joker.263.origin
File system changes:
Creates the following files:
- /data/data/####/13d27984bfeb652e3b880ba60d8d04893b3aedfd3e330c1....0.tmp
- /data/data/####/199181936fd5bc48f4a1ffd4d249d5b4313d1a607562040...ee27.0
- /data/data/####/33646dead8d0d533bbc84878a08dfdb6fbfa6266554e153....0.tmp
- /data/data/####/398dfadf726a0e2db1056bc04fb2c4ecdf90c53dcfeb3e2....0.tmp
- /data/data/####/532d5b4017082ee980e1ab796bfc7356346aed555660b4c....0.tmp
- /data/data/####/81245f3a928976e584e061f7946183cca941595177d47c1....0.tmp
- /data/data/####/839d89d0c3a579141b75446b48ff9e25d9b34fbfabdcc7e...7353.0
- /data/data/####/905bbfdd36471e9f713adb37a265b8e52f371cc222946e7....0.tmp
- /data/data/####/9d44d2df8849edba039a7e64ecf053cc7d63325176f14c2....0.tmp
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/FirebaseAppHeartBeat.xml.bak
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToyNjU1MDM3...3.json
- /data/data/####/PersistedInstallation1380962621tmp
- /data/data/####/PersistedInstallation61461005tmp
- /data/data/####/ad6928b33c26a6ef39c671a6af33340b57e54d5f31c9b8b...48e1.0
- /data/data/####/app_d
- /data/data/####/app_d.dex
- /data/data/####/app_d.dex.flock (deleted)
- /data/data/####/b87c2b95794376307f36e21275428b16b844c2515215d8c...1eb8.0
- /data/data/####/cnf.sp.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/d62263dbfce524b070d9363cccb0f0a8b87cbc76f84e685....0.tmp
- /data/data/####/dffbaa3c325e5bb9cc8c3721b5cd9e99d5c1b07a073bafd...bbe6.0
- /data/data/####/e612841bd5ecb473e897d1fd587806722ddcc56206d1b10....0.tmp
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/journal
- /data/data/####/report
- /data/data/####/start-time
- /data/data/####/userlog
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Displays its own windows over windows of other apps.
Intercepts notifications.
