Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) www.googlea####.com:443
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) 2####.239.34.223:443
- TCP(TLS/1.0) prod####.sing####.net.####.net:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) sd####.moen####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) g####.face####.com:443
- TCP(TLS/1.2) 64.2####.164.113:443
- TCP(TLS/1.2) 1####.177.14.104:443
- TCP(TLS/1.2) www.gst####.com:443
- TCP(TLS/1.2) 64.2####.164.102:443
- TCP(TLS/1.2) 64.2####.164.94:443
- TCP(TLS/1.2) and####.google####.com:443
- UDP www.gst####.com:443
- TCP e####.ar####.com:10019
- UDP 64.2####.164.139:443
- TCP e####.ar####.com:10005
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- android####.go####.com
- e####.ar####.com
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- firebas####.google####.com
- g####.face####.com
- gmscomp####.google####.com
- ra####.tech
- sd####.moen####.com
- sdk-ap####.sing####.net
- www.googlea####.com
- www.gst####.com
HTTP POST requests:
- sd####.moen####.com:443/v3/campaigns/inapp/live?unique_id=####&sdk_ver=#...
File system changes:
Creates the following files:
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/46327beb973b3f43.uid
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo4NTAyMjAwMzcwO...Ri.xml
- /data/data/####/MOEInteractions-journal
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo4NTAyMjAw...i.json
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/app-quality-session-id
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/classes.dex;classes5.dex
- /data/data/####/classes.dex;classes6.dex
- /data/data/####/classes.dex;classes7.dex
- /data/data/####/classes.dex;classes8.dex
- /data/data/####/classes.dex;classes9.dex
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/com.vlv.aravall.xml
- /data/data/####/com.vlv.aravall_preferences.xml
- /data/data/####/event0000000000
- /data/data/####/event0000000001
- /data/data/####/exoplayer_internal.db-journal
- /data/data/####/firebase_session_settings.preferences_pb
- /data/data/####/firebase_session_settings.preferences_pb.tmp
- /data/data/####/frc_1;850220037081;android;2a58ca28d6a3d34b_fir...e.json
- /data/data/####/frc_1;850220037081;android;2a58ca28d6a3d34b_fir...gs.xml
- /data/data/####/frc_1;850220037081;android;2a58ca28d6a3d34b_fir...h.json
- /data/data/####/frc_1;850220037081;android;2a58ca28d6a3d34b_fir...ml.bak
- /data/data/####/frc_1;850220037081;android;2a58ca28d6a3d34b_fir...s.json
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/jgobfppppp (deleted)
- /data/data/####/keys
- /data/data/####/kukufm.db-journal (deleted)
- /data/data/####/kukufm.db.lck
- /data/data/####/kukufm.db.media3-journal (deleted)
- /data/data/####/kukufm.db.media3.lck
- /data/data/####/libjiagu.so
- /data/data/####/notice.xml
- /data/data/####/prdownloader.db-journal
- /data/data/####/pref-event-index.xml
- /data/data/####/pref-singular-id.xml
- /data/data/####/pref_moe.xml
- /data/data/####/pref_moe.xml.bak
- /data/data/####/pref_moe_common.xml
- /data/data/####/report
- /data/data/####/singular-1.db
- /data/data/####/singular-1.db-journal
- /data/data/####/singular-batch-managerx-1.db-journal
- /data/data/####/singular-first-install.xml
- /data/data/####/singular-licensing-api.xml
- /data/data/####/singular-pref-config-manager.xml
- /data/data/####/start-time
- /data/data/####/userlog.tmp
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
