Technical information
Malicious functions:
Prompts to install third-party apps.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) coinlis####.s3.ap-sou####.####.com:443
- TCP(TLS/1.0) voice####.vip:443
- TCP(TLS/1.0) yanglin####.gi####.io:443
DNS requests:
- coinlis####.s3.ap-sou####.####.com
- voice####.vip
- yanglin####.gi####.io
File system changes:
Creates the following files:
- /data/app/####/libjingle_peerconnection_so.so
- /data/app/####/payload.apk
- /data/app/####/tmp.oPpNQC
- /data/app/####/tmp.phUnLV
- /data/app/####/tmp.rvTjRR
- /data/app/####/tmp.utD3gM
- /data/data/####/Anonymous-DexFile@2979838511.vdex
- /data/data/####/data_bridge.apk
- /data/data/####/installer_domain_resolver.xml
- /data/data/####/installer_launcher_visibility.xml
- /data/data/####/installer_prefs.xml
- /data/data/####/installer_report_prefs.xml
- /data/data/####/libandroidx.graphics.path.so
- /data/data/####/libdatastore_shared_counter.so
- /data/data/####/libhopvubi.so
- /data/data/####/libjingle_peerconnection_so.so
- /data/data/####/libv2shell.so
- /data/data/####/p0.dex
- /data/data/####/p0.dex.cur.prof
- /data/data/####/payload.apk
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libhwui_nvejm
Appears corrupted in a way typical for malicious files.
