Technical information
Malicious functions:
Sends SMS:
- <Contact Phone>: MY DEVICE HAS BEEN HACKED!
- <Contact Phone>: https://t.me/thenoobmaster97
- <SMS Address>: MY DEVICE HAS BEEN HACKED!
- <SMS Address>: https://t.me/thenoobmaster97
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(???) rr7---s####.g####.com:443
- UDP(???) rr3---s####.g####.com:443
- UDP(???) and####.cli####.go####.com:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) rr7---s####.g####.com:443
- TCP(TLS/1.0) devicei####.google####.com:443
- TCP(TLS/1.0) rr3---s####.g####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) prod-lt####.google####.com:443
- TCP(TLS/1.2) 74.1####.131.147:443
- TCP(TLS/1.2) 64.2####.161.95:443
- TCP(TLS/1.2) 1####.194.73.113:443
- TCP(TLS/1.2) 64.2####.164.94:443
- TCP(TLS/1.2) 1####.251.1.95:443
DNS requests:
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- connect####.gst####.com
- devicei####.google####.com
- firebas####.google####.com
- i.y####.com
- p####.google####.com
- pla####.google####.com
- pla####.googleu####.com
- playsto####.google####.com
- prod-lt####.google####.com
- rr3---s####.g####.com
- rr7---s####.g####.com
- www.google####.com
File system changes:
Creates the following files:
- /data/app/####/.x86_64
- /data/app/####/com.android.vending.apk
- /data/app/####/config.en
- /data/app/####/config.x86_64
- /data/app/####/libandroidx.graphics.path.so
- /data/app/####/libapkanalysis.so
- /data/app/####/libbrotli.so
- /data/app/####/libcronet.146.0.7680.144.so
- /data/app/####/libmappedcountercacheversionjni.so
- /data/app/####/libtensorflowlite_jni.so
- /data/app/####/libzucchini.so
- /data/app/####/libzwrapper.so
- /data/misc/####/primary.prof
Miscellaneous:
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Requests the system alert window permission.
Attempts to detect sandbox environment.
