Adware.Was.12544

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Was.1.origin

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) 64.2####.165.94:443
TCP(TLS/1.0) pang####.sn####.com.####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.2) firebas####.google####.com:443
TCP(TLS/1.2) 64.2####.165.94:443
TCP(TLS/1.2) 1####.194.221.95:443
TCP firebas####.crashly####.com:443

DNS requests:

app-mea####.com
firebas####.crashly####.com
firebas####.google####.com
firebas####.google####.com
p####.google####.com
pang####.sn####.com
pla####.google####.com
rr9---s####.g####.com

HTTP POST requests:

firebas####.google####.com:443/v1/projects/186856161174/namespaces/firep...
firebas####.google####.com:443/v1/projects/puzzlerama-36085974/installat...
pang####.sn####.com.####.com:443/api/ad/union/sdk/stats/batch/

File system changes:

Creates the following files:

/data/data/####/.dex2oatlock
/data/data/####/.updateIV.dat
/data/data/####/.updateIV.dat_0
/data/data/####/.updateIV.dat_1
/data/data/####/.updateIV.dat_2
/data/data/####/.updateIV.dat_3
/data/data/####/.updateIV.dat_4
/data/data/####/.updateIV.dat_5
/data/data/####/.updateIV.dat_6
/data/data/####/.updateIV.dat_7
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/0000000lllll_2.dex
/data/data/####/0000000lllll_3.dex
/data/data/####/0000000lllll_4.dex
/data/data/####/0000000lllll_5.dex
/data/data/####/0000000lllll_6.dex
/data/data/####/0000000lllll_7.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/000O00ll111l_2.dex
/data/data/####/000O00ll111l_3.dex
/data/data/####/000O00ll111l_4.dex
/data/data/####/000O00ll111l_5.dex
/data/data/####/000O00ll111l_6.dex
/data/data/####/000O00ll111l_7.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/00O000ll111l_2.dex
/data/data/####/00O000ll111l_2.dex.flock
/data/data/####/00O000ll111l_2.dex.flock (deleted)
/data/data/####/00O000ll111l_3.dex
/data/data/####/00O000ll111l_3.dex.flock
/data/data/####/00O000ll111l_3.dex.flock (deleted)
/data/data/####/00O000ll111l_4.dex
/data/data/####/00O000ll111l_4.dex.flock
/data/data/####/00O000ll111l_4.dex.flock (deleted)
/data/data/####/00O000ll111l_5.dex
/data/data/####/00O000ll111l_5.dex.flock
/data/data/####/00O000ll111l_5.dex.flock (deleted)
/data/data/####/00O000ll111l_6.dex
/data/data/####/00O000ll111l_6.dex.flock
/data/data/####/00O000ll111l_6.dex.flock (deleted)
/data/data/####/00O000ll111l_7.dex
/data/data/####/00O000ll111l_7.dex.flock
/data/data/####/00O000ll111l_7.dex.flock (deleted)
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/1d7842c4752cfad2ae1855d9ce1d687a-4011-4011.apk
/data/data/####/64BE01750322-0001-0DF3-0034159BF8FFBeginSession.cls
/data/data/####/64BE01750322-0001-0DF3-0034159BF8FFSessionApp.cls
/data/data/####/64BE01750322-0001-0DF3-0034159BF8FFSessionDevice.cls_temp
/data/data/####/64BE01750322-0001-0DF3-0034159BF8FFSessionOS.cls
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/FirebaseAppHeartBeat.xml.bak
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToxODY4NTYx...2.json
/data/data/####/PersistedInstallation1724860003tmp
/data/data/####/PersistedInstallation907579458tmp
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/audience_network.dex
/data/data/####/audience_network.dex (deleted)
/data/data/####/audience_network.dex.flock (deleted)
/data/data/####/base-1.apk
/data/data/####/base-1.dex
/data/data/####/base-1.dex.flock (deleted)
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/crashlytics-userlog-64BE01750322-0001-0DF3-0034...F.temp
/data/data/####/frc_1;186856161174;android;991573ca5e6bcd26_fir...e.json
/data/data/####/frc_1;186856161174;android;991573ca5e6bcd26_fir...gs.xml
/data/data/####/frc_1;186856161174;android;991573ca5e6bcd26_fir...h.json
/data/data/####/frc_1;186856161174;android;991573ca5e6bcd26_fir...ml.bak
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/initialization_marker
/data/data/####/libPglmetasec_ml.so
/data/data/####/libavmdl_lite.so
/data/data/####/libtobEmbedEncrypt.so
/data/data/####/libttmplayer_lite.so
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/pangle_meta_data_sp.xml
/data/data/####/pangle_meta_data_sp.xml.bak
/data/data/####/proc_auxv
/data/data/####/report
/data/data/####/secret.xml
/data/data/####/tosversion
/data/misc/####/primary.prof

Miscellaneous:

Loads the following dynamic libraries:

libYSDK
libc++_shared
libivorysdk_admob
libivorysdk_core
libivorysdk_mopub
libshell-super.2019

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Displays its own windows over windows of other apps.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial