Android.HiddenAds.3858

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.2189

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 64.2####.162.94:80
TCP(HTTP/1.1) buy.cng####.xyz:80
TCP(HTTP/1.1) mydev####.com:80
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.0) r####.appl####.com:443
TCP(TLS/1.0) img.appl####.com:443
TCP(TLS/1.0) g####.face####.com:443
TCP(TLS/1.0) 74.1####.205.113:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) rr9---s####.g####.com:443
TCP(TLS/1.0) d####.fl####.com:443
TCP(TLS/1.0) ms.appl####.com:443
TCP(TLS/1.0) d.appl####.com:443
TCP(TLS/1.0) as####.appl####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) rr18---####.g####.com:443
TCP(TLS/1.0) 64.2####.162.94:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) rt.appl####.com:443
TCP(TLS/1.2) and####.google####.com:443
TCP(TLS/1.2) 64.2####.162.94:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 64.2####.162.104:443
UDP www.google####.com:443

DNS requests:

a4.appl####.com
and####.a####.go####.com
and####.google####.com
as####.appl####.com
buy.cng####.xyz
d####.fl####.com
d.appl####.com
g####.face####.com
img.appl####.com
m####.go####.com
ms.appl####.com
mydev####.com
p####.google####.com
prod-a-####.appl####.com
r####.appl####.com
rr18---####.g####.com
rr2---s####.g####.com
rr9---s####.g####.com
rt.appl####.com
www.face####.com
www.go####.com
www.google####.com

HTTP GET requests:

as####.appl####.com:443/sound_off.png
as####.appl####.com:443/sound_on.png
buy.cng####.xyz/app-admin-service/ad/vopmi?packageName=####&adId=####&vI...
buy.cng####.xyz/app-admin-service/app/headervalue/interf/getCountry
buy.cng####.xyz/app-admin-service/hd/voccc?packageName=####&vId=YzU####
img.appl####.com:443/1381250003_28x28.png
img.appl####.com:443/1702280538423_300x300.png
mydev####.com/Z15//api/api.php?action=####
mydev####.com/Z15//api/api.php?action=####&offset=####
mydev####.com/Z15//thumb.php?src=####&size=####
mydev####.com/Z15//upload/category/2700-2019-11-01.png
mydev####.com/Z15//upload/category/7618-2019-11-01.png
mydev####.com/Z15//upload/category/8742-2019-11-01.png
mydev####.com/Z15//upload/category/8913-2019-11-01.png
r####.appl####.com:443/o759b509/1b4cfc6ed8cf2ff0ad6eb3442c4730714cab8d87...
r####.appl####.com:443/o759b509/2014e3105742f4e9497b9d491a30ebf98d090b29...
rt.appl####.com:443/4.0/ad?p=####
rt.appl####.com:443/vid?clcode=####&event=####&et_s=####&pv=####&vid_ts=...

HTTP POST requests:

d####.fl####.com:443/v1/flr.do
d.appl####.com:443/2.0/device?p=####
ms.appl####.com:443/5.0/i?p=####
rt.appl####.com:443/4.0/pix?p=####

File system changes:

Creates the following files:

/data/data/####/-2526410621000319085
/data/data/####/.YFlurrySenderIndex.info.AnalyticsData_GM9X6SWY...PF_311
/data/data/####/.YFlurrySenderIndex.info.StreamingMain
/data/data/####/.dex2oatlock
/data/data/####/.updateIV.dat
/data/data/####/.updateIV.dat_0
/data/data/####/.updateIV.dat_1
/data/data/####/.yflurrydatasenderblock.9111eb1e-b9a0-472f-b2ee...e00f80
/data/data/####/.yflurrydatasenderblock.b9a35384-686a-4c62-9185...617b18
/data/data/####/.yflurrydatasenderblock.c8e6c841-0d50-4b24-bb6e...564df1
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex (deleted)
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex (deleted)
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/038398d87e6554b5e3a609792acda334.0.tmp
/data/data/####/038398d87e6554b5e3a609792acda334.1.tmp
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/20057914501609612163
/data/data/####/33bf96c006e9c3ec7ff9ec047c1590bb.0.tmp
/data/data/####/367898ae347e1ba70445291eea8433c6.0.tmp
/data/data/####/367898ae347e1ba70445291eea8433c6.1.tmp
/data/data/####/369e8ffda599cf5740f8fd723ec55dc1.0.tmp
/data/data/####/369e8ffda599cf5740f8fd723ec55dc1.1
/data/data/####/369e8ffda599cf5740f8fd723ec55dc1.1.tmp
/data/data/####/480344943-30473299
/data/data/####/4b75e1033ab4ddff593771c6c816cfea.0.tmp
/data/data/####/4b75e1033ab4ddff593771c6c816cfea.1.tmp
/data/data/####/4c02ee44ab03791806c1ed2a7b45ccac.0.tmp
/data/data/####/4c02ee44ab03791806c1ed2a7b45ccac.1
/data/data/####/4c02ee44ab03791806c1ed2a7b45ccac.1.tmp
/data/data/####/4c3a52c2ff939a9c5870fbf82a6b9274.0.tmp
/data/data/####/7244c051fceda149edce72c99d78b561.0.tmp
/data/data/####/7244c051fceda149edce72c99d78b561.1
/data/data/####/7244c051fceda149edce72c99d78b561.1.tmp
/data/data/####/95b336d843851dddd7ae4de775db3fa5.0.tmp
/data/data/####/962b673812bfd578dcff054b996b4796.0.tmp
/data/data/####/962b673812bfd578dcff054b996b4796.1
/data/data/####/962b673812bfd578dcff054b996b4796.1.tmp
/data/data/####/9f305fa1f6fdd255098295fd99022ff8.0.tmp
/data/data/####/9f305fa1f6fdd255098295fd99022ff8.1.tmp
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/FBAdPrefs.xml
/data/data/####/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/FLURRY_SHARED_PREFERENCES.xml.bak (deleted)
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/a7e90afe650ab76b3dab33644bd75f5b.0.tmp
/data/data/####/a7e90afe650ab76b3dab33644bd75f5b.1
/data/data/####/ad59d61bcbc8c67d49d51010d3ac179e.0.tmp
/data/data/####/ad59d61bcbc8c67d49d51010d3ac179e.1.tmp
/data/data/####/af9ab8a42f2ec17d8afcd043ebe9b2a6.0.tmp
/data/data/####/af9ab8a42f2ec17d8afcd043ebe9b2a6.1.tmp
/data/data/####/androidx.work.util.id.xml
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/audience_network.dex
/data/data/####/audience_network.dex.flock (deleted)
/data/data/####/b5933ba7c98b37f723bcee85806ed93d.0.tmp
/data/data/####/b5933ba7c98b37f723bcee85806ed93d.1
/data/data/####/b5933ba7c98b37f723bcee85806ed93d.1.tmp
/data/data/####/cactus.xml
/data/data/####/com.applovin.sdk.1.xml
/data/data/####/com.applovin.sdk.impl.postbackQueue.domain.xml
/data/data/####/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
/data/data/####/com.applovin.sdk.preferences.8tS88vOKdfCGh3VlA4...leted)
/data/data/####/com.applovin.sdk.preferences.8tS88vOKdfCGh3VlA4...mO.xml
/data/data/####/com.applovin.sdk.preferences.8tS88vOKdfCGh3VlA4...ml.bak
/data/data/####/com.applovin.sdk.shared.xml
/data/data/####/com.facebook.ads.idfa.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.wallpaperhd.appformobile.vae_preference.xml
/data/data/####/com.wallpaperhd.appformobile.vae_preferences.xml
/data/data/####/com.wallpaperhd.appformobile.vae_preferences.xml.bak
/data/data/####/completed-1703608663148
/data/data/####/completed-1703608669452
/data/data/####/completed-1703608682431
/data/data/####/currentFile
/data/data/####/currentFile (deleted)
/data/data/####/d4f8ab0c93534bd6863d0bc6c16e4ba6.0.tmp
/data/data/####/d4f8ab0c93534bd6863d0bc6c16e4ba6.1.tmp
/data/data/####/d6fd84c1b179922317df8bff79c9c0c1.0.tmp
/data/data/####/d76b35b553e65f3d6749d91f9170a22a.0.tmp
/data/data/####/d76b35b553e65f3d6749d91f9170a22a.1.tmp
/data/data/####/e21b1b7d846a30b4dd378a0762bd4a86.0.tmp
/data/data/####/e21b1b7d846a30b4dd378a0762bd4a86.1
/data/data/####/e21b1b7d846a30b4dd378a0762bd4a86.1.tmp
/data/data/####/e627c417c54c6d110977de9add49ee79.0
/data/data/####/e627c417c54c6d110977de9add49ee79.1
/data/data/####/f43a49f1e201103ee26338ec9a6a4918.0
/data/data/####/f43a49f1e201103ee26338ec9a6a4918.1
/data/data/####/index
/data/data/####/installationNum
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libshellx-super.2019.so
/data/data/####/material_wallpaper.db
/data/data/####/material_wallpaper.db-journal
/data/data/####/metrics_guid
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/the-real-index
/data/data/####/tosversion
/data/media/####/.nomedia
/data/media/####/1381250003_28x28.png
/data/media/####/1702280538423_300x300.png
/data/media/####/1b4cfc6ed8cf2ff0ad6eb3442c4730714cab8d87_v23_phone.mp4
/data/media/####/o759b509_2014e3105742f4e9497b9d491a30ebf98d090...oad.js
/data/media/####/sound_off.png
/data/media/####/sound_on.png
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

getprop ro.product.cpu.abi
ls /data/local

Loads the following dynamic libraries:

libshellx-super.2019

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Sample from Google Play Store.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial