Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.1550.origin
Network activity:
Connects to:
- UDP(???) www.go####.com:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.kuaij####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.hg####.net:443
- TCP(TLS/1.0) hsk.o####.com:443
- TCP(TLS/1.0) che####.amazo####.com:443
- TCP(TLS/1.0) www.ray####.live:443
- TCP(TLS/1.0) soft####.air####.cn:443
- TCP(TLS/1.0) clients####.google####.com:443
DNS requests:
- che####.amazo####.com
- clie####.go####.com
- clients####.google####.com
- hsk.o####.com
- soft####.air####.cn
- ssl.gst####.com
- sunl####.o####.com
- up####.google####.com
- www.go####.com
- www.hg####.net
- www.kuaij####.com
- www.ray####.live
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /data/data/####/.org.chromium.Chromium.N5lpfp
- /data/data/####/.org.chromium.Chromium.jtogFd
- /data/data/####/000001.dbtmp
- /data/data/####/02322ee638ee99c2_0
- /data/data/####/04ead765c1e9963a_0
- /data/data/####/11ddcebb275a9b2b_0
- /data/data/####/49c92b058546f67a_0
- /data/data/####/5735c9298c065133_0
- /data/data/####/86a460935b651b46_0
- /data/data/####/871adbdc318cd385_0
- /data/data/####/BarHeight.xml
- /data/data/####/Barheight.xml
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/Media.db-journal
- /data/data/####/ServerLog.db-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/badda3ec21df7604_0
- /data/data/####/boomBarheight.xml
- /data/data/####/cachevalue.xml
- /data/data/####/classes.dex
- /data/data/####/classes10.dex
- /data/data/####/classes11.dex
- /data/data/####/classes12.dex
- /data/data/####/classes13.dex
- /data/data/####/classes14.dex
- /data/data/####/classes15.dex
- /data/data/####/classes16.dex
- /data/data/####/classes17.dex
- /data/data/####/classes2.dex
- /data/data/####/classes3.dex
- /data/data/####/classes4.dex
- /data/data/####/classes5.dex
- /data/data/####/classes6.dex
- /data/data/####/classes7.dex
- /data/data/####/classes8.dex
- /data/data/####/classes9.dex
- /data/data/####/fb36f781c2558b9d_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/installtime.xml
- /data/data/####/isInstall.xml
- /data/data/####/number.xml
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/data/####/wifi_sleep_policy.xml
- /data/misc/####/primary.prof
- /databases/Media.db
- /databases/ServerLog.db
- /storage/emulated/####/1784007887405116.jpeg (deleted)
- /storage/emulated/####/1784007887548643.jpeg (deleted)
- /storage/emulated/####/1784007887791542.jpeg (deleted)
- /storage/emulated/####/1784007887992212.jpeg (deleted)
- /storage/emulated/####/1784007888238667.jpeg (deleted)
- /storage/emulated/####/1784007888434266.jpeg (deleted)
- /storage/emulated/####/1784007888645363.jpeg (deleted)
- /storage/emulated/####/1784007888805123.jpeg (deleted)
- /storage/emulated/####/1784007888964233.jpeg (deleted)
- /storage/emulated/####/178400788903362.jpeg (deleted)
- /storage/emulated/####/1784007889128769.jpeg (deleted)
- /storage/emulated/####/1784007889343818.jpeg (deleted)
- /storage/emulated/####/1784007889742165.jpeg (deleted)
- /storage/emulated/####/1784007890040368.jpeg (deleted)
- /storage/emulated/####/1784007890493985.jpeg (deleted)
- /storage/emulated/####/1784007890817768.jpeg (deleted)
- /storage/emulated/####/1784007891115189.jpeg (deleted)
- /storage/emulated/####/1784007891274479.jpeg (deleted)
- /storage/emulated/####/1784007891343267.jpeg (deleted)
- /storage/emulated/####/1784007891458913.jpeg (deleted)
- /storage/emulated/####/1784007891514179.jpeg (deleted)
- /storage/emulated/####/1784007891854484.jpeg (deleted)
- /storage/emulated/####/1784007891978711.jpeg (deleted)
- /storage/emulated/####/1784007892058587.jpeg (deleted)
- /storage/emulated/####/1784007892174250.jpeg (deleted)
- /storage/emulated/####/salami-2645403_640.jpg (deleted)
Miscellaneous:
Executes the following shell scripts:
- logcat *:e *:w | grep (3032)
Loads the following dynamic libraries:
- libxc_loader
Intercepts notifications.
Requests the system alert window permission.
Modifies files on a device.
Contains hidden alternative main activities.
