Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSpy.12123
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.2) 64.2####.161.138:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- TCP(TLS/1.2) connect####.gst####.com:443
- TCP(TLS/1.2) 64.2####.164.139:443
- TCP(TLS/1.2) 1####.250.150.101:443
- TCP(TLS/1.2) 64.2####.164.138:443
DNS requests:
- and####.a####.go####.com
- connect####.gst####.com
- gmscomp####.google####.com
- p####.google####.com
- rr2---s####.g####.com
File system changes:
Creates the following files:
- /data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAA (deleted)
- /data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
- /data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (deleted)
- /data/data/####/C1PiiWz2jfmOz2vLIpr21Ych9tjiLbSs.dex
- /data/data/####/MZvJAXuiCoKII6s8kK8d6BpeFmacH2H6.dex
- /data/data/####/MZvJAXuiCoKII6s8kK8d6BpeFmacH2H6.dex.flock (deleted)
- /data/data/####/RIFFSHWRXR1D8xTQSCmXKLA9UZs8GJAj.dex
- /data/data/####/RIFFSHWRXR1D8xTQSCmXKLA9UZs8GJAj.dex.flock (deleted)
- /data/data/####/Sh38N9wOogfhLDcqiFYMQhG1lFhP70Dt.dex
- /data/data/####/Sh38N9wOogfhLDcqiFYMQhG1lFhP70Dt.dex.flock (deleted)
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/WlKUVLep7JluF3olANdJpY4rnShNLvD5.dex
- /data/data/####/WlKUVLep7JluF3olANdJpY4rnShNLvD5.dex.flock (deleted)
- /data/data/####/cloneSettings_29537464.json
- /data/data/####/dFEII9KWZ7NitEJeuP2cQllb1qocEvBT.dex
- /data/data/####/dFEII9KWZ7NitEJeuP2cQllb1qocEvBT.dex.flock (deleted)
- /data/data/####/fmBu8LaYIX7CSAFLrl6hJ3POvgDlygHC.dex
- /data/data/####/fmBu8LaYIX7CSAFLrl6hJ3POvgDlygHC.dex.flock (deleted)
- /data/data/####/hBL1orJt8iu68nv0b0pLUHN4H7C5ruGA.dex
- /data/data/####/hBL1orJt8iu68nv0b0pLUHN4H7C5ruGA.dex.flock (deleted)
- /data/data/####/index
- /data/data/####/ixA2JEJ09SmrEbXoq7wKkJqSVTgGCL5d.dex
- /data/data/####/ixA2JEJ09SmrEbXoq7wKkJqSVTgGCL5d.dex.flock (deleted)
- /data/data/####/mPoiPkEmJsxkgcZLe4uFHBzTIW2Ezp5N.dex
- /data/data/####/mPoiPkEmJsxkgcZLe4uFHBzTIW2Ezp5N.dex.flock (deleted)
- /data/data/####/metrics_guid
- /data/data/####/natives_sec_blob1108353431.dex
- /data/data/####/natives_sec_blob1108353431.dex.flock (deleted)
- /data/data/####/natives_sec_blob1248386824.dex
- /data/data/####/natives_sec_blob1248386824.dex.flock (deleted)
- /data/data/####/natives_sec_blob1654666221.dex
- /data/data/####/natives_sec_blob1654666221.dex.flock (deleted)
- /data/data/####/natives_sec_blob1671087947.dex
- /data/data/####/natives_sec_blob1671087947.dex.flock (deleted)
- /data/data/####/natives_sec_blob854650664.dex
- /data/data/####/natives_sec_blob854650664.dex.flock (deleted)
- /data/data/####/o0Nm0wMEEeMWleZW3A5kA3s5xA9WDMNA.dex
- /data/data/####/o0Nm0wMEEeMWleZW3A5kA3s5xA9WDMNA.dex.flock (deleted)
- /data/data/####/qx2QtagieS2w1ExjAJ7EDgaeEqAeiQL3.dex
- /data/data/####/qx2QtagieS2w1ExjAJ7EDgaeEqAeiQL3.dex.flock (deleted)
- /data/data/####/the-real-index
Miscellaneous:
Executes the following shell scripts:
- rm -r/data/user/0/<Package>/app_ded/C1PiiWz2jfmOz2vLIpr21Ych9tjiLbSs.dex
- rm -r/data/user/0/<Package>/app_ded/MZvJAXuiCoKII6s8kK8d6BpeFmacH2H6.dex
- rm -r/data/user/0/<Package>/app_ded/RIFFSHWRXR1D8xTQSCmXKLA9UZs8GJAj.dex
- rm -r/data/user/0/<Package>/app_ded/Sh38N9wOogfhLDcqiFYMQhG1lFhP70Dt.dex
- rm -r/data/user/0/<Package>/app_ded/WlKUVLep7JluF3olANdJpY4rnShNLvD5.dex
- rm -r/data/user/0/<Package>/app_ded/dFEII9KWZ7NitEJeuP2cQllb1qocEvBT.dex
- rm -r/data/user/0/<Package>/app_ded/fmBu8LaYIX7CSAFLrl6hJ3POvgDlygHC.dex
- rm -r/data/user/0/<Package>/app_ded/hBL1orJt8iu68nv0b0pLUHN4H7C5ruGA.dex
- rm -r/data/user/0/<Package>/app_ded/ixA2JEJ09SmrEbXoq7wKkJqSVTgGCL5d.dex
- rm -r/data/user/0/<Package>/app_ded/mPoiPkEmJsxkgcZLe4uFHBzTIW2Ezp5N.dex
- rm -r/data/user/0/<Package>/app_ded/o0Nm0wMEEeMWleZW3A5kA3s5xA9WDMNA.dex
- rm -r/data/user/0/<Package>/app_ded/qx2QtagieS2w1ExjAJ7EDgaeEqAeiQL3.dex
Uses the following algorithms to decrypt data:
- AES
- AES-ECB-PKCS5Padding
Gets information about network.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
