Technical information
Malicious functions:
Sends data about device contacts to a remote host.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) 64.2####.162.94:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) 74.1####.205.113:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) g####.face####.com:443
- TCP(TLS/1.0) rr15---####.g####.com:443
- TCP(TLS/1.0) api.ips####.com:443
- TCP(TLS/1.0) in2-pro####.traffic####.net:443
- TCP(TLS/1.0) hu####.net:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) o130####.in####.se####.io:443
- TCP(TLS/1.2) 64.2####.162.94:443
- TCP(TLS/1.2) 1####.194.163.27:443
- TCP(TLS/1.2) digital####.google####.com:443
- TCP(TLS/1.2) app-mea####.com:443
- TCP(TLS/1.2) 74.1####.205.113:443
- TCP apim-co####.regi####.azure####.net:443
- UDP md####.google####.com:443
DNS requests:
- and####.cli####.go####.com
- api.ips####.com
- app-mea####.com
- app.ad####.com
- code####.appce####.ms
- digital####.google####.com
- f####.gst####.com
- firebas####.google####.com
- g####.face####.com
- hu####.net
- in.appce####.ms
- md####.google####.com
- o130####.in####.se####.io
- pla####.googleu####.com
- rr15---####.g####.com
HTTP GET requests:
- api.ips####.com:443/check?access_key=####
- app.ad####.com:443/attribution?device_type=####&gps_adid=####&environmen...
- hu####.net:443/api/auth/country-otp-request-methods
- hu####.net:443/api/auth/phone-number-registration-statuses?phoneNumbers=...
- hu####.net:443/api/referral-code
- hu####.net:443/api/user-actions-analytics/endpoint-info
HTTP POST requests:
- app.ad####.com:443/sdk_click
- app.ad####.com:443/session
- in2-pro####.traffic####.net:443/logs?api-version=####
- md####.google####.com:443/v1/projects/the-hub-b882c/installations
- o130####.in####.se####.io:443/api/6533774/envelope/
File system changes:
Creates the following files:
- /data/data/####/.hptc.cache_com.thehub
- /data/data/####/.hptc_kache_com.thehub
- /data/data/####/07ed740a-ddbd-4b60-a4b0-90d3282ea360.envelope
- /data/data/####/134a49d0c09fa2edb7a65099a541afce.0.tmp
- /data/data/####/134a49d0c09fa2edb7a65099a541afce.1
- /data/data/####/134a49d0c09fa2edb7a65099a541afce.1.tmp
- /data/data/####/2eff8b61-56b2-4ad7-a5ea-679aeceea010.envelope
- /data/data/####/5ad08243-ed6e-4474-a966-448a8bf1a184.envelope
- /data/data/####/799450fe065c5ccbc1ce94149f099801.0.tmp
- /data/data/####/799450fe065c5ccbc1ce94149f099801.1
- /data/data/####/799450fe065c5ccbc1ce94149f099801.1.tmp
- /data/data/####/9484350d46eb535eeb6fdf1d8d4f0161.0.tmp
- /data/data/####/9484350d46eb535eeb6fdf1d8d4f0161.1
- /data/data/####/9484350d46eb535eeb6fdf1d8d4f0161.1.tmp
- /data/data/####/AdjustIoActivityState
- /data/data/####/AdjustIoPackageQueue
- /data/data/####/AppCenter.xml
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/CodePush.xml
- /data/data/####/Cookies-journal
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo4NzIwMTQwOTYyN...mQ.xml
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo4NzIwMTQwOTYyN...ml.bak
- /data/data/####/INSTALLATION
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo4NzIwMTQw...Q.json
- /data/data/####/PersistedInstallation1513707267tmp
- /data/data/####/PersistedInstallation562179357tmp
- /data/data/####/RKStorage-journal
- /data/data/####/SMART_LOOK_SDK.xml
- /data/data/####/SMART_LOOK_SDK.xml.bak
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/ad198d802b18c7ba3622828ed9ffdd0c.0.tmp
- /data/data/####/ad198d802b18c7ba3622828ed9ffdd0c.1
- /data/data/####/ad198d802b18c7ba3622828ed9ffdd0c.1.tmp
- /data/data/####/adjust_preferences.xml
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/b91dabb5-7eea-4aea-4fa9-2eebcb877c93.run.lock
- /data/data/####/chat-1.db
- /data/data/####/chat-1.db-journal
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak (deleted)
- /data/data/####/com.microsoft.appcenter.persistence-journal
- /data/data/####/com.thehub_preferences.xml
- /data/data/####/com.thehub_preferences.xml.bak
- /data/data/####/com.thehub_preferences.xml.bak (deleted)
- /data/data/####/ea178dc63fb91c83a824740b4cd74915.0.tmp
- /data/data/####/ea178dc63fb91c83a824740b4cd74915.1
- /data/data/####/ea178dc63fb91c83a824740b4cd74915.1.tmp
- /data/data/####/ee71a339-cf45-4cff-8389-0ac0f63174ee
- /data/data/####/frc_1;87201409624;android;99412b13f8a1b1f314782...gs.xml
- /data/data/####/frc_1;87201409624;android;99412b13f8a1b1f314782...s.json
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/journal
- /data/data/####/journal.bkp (deleted)
- /data/data/####/journal.tmp
- /data/data/####/proc_auxv
- /data/data/####/react-native-device-info.xml
- /data/data/####/session.json
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libfbjni
- libhermes
- libhermes-executor-release
- libimagepipeline
- libreactnativeblob
- libreactnativejni
- libreanimated
- libsentry
- libsentry-android
- libsqlite3x
- libturbomodulejsijni
- libyoga
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Sample from Google Play Store.
