Android.Hidden.12843

Technical information

Malicious functions:

Removes app icon from the screen.

Network activity:

Connects to:

UDP(???) rr5---s####.g####.com:443
UDP(???) 64.2####.162.102:443
UDP(???) 2####.244.23.238:3074
UDP(???) p####.google####.com:443
UDP(???) pla####.google####.com:443
UDP(???) rr1---s####.g####.com:443
TCP(???) 2####.126.6.26:8082
UDP(???) rr3---s####.g####.com:443
TCP(DNS) <Google DNS>
UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) android####.go####.com:443
TCP(TLS/1.0) connect####.gst####.com:443
TCP(TLS/1.0) rr5---s####.g####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) rr1---s####.g####.com:443
TCP(TLS/1.2) 1####.251.154.119:443
TCP(TLS/1.2) 74.1####.131.94:443
TCP(TLS/1.2) 1####.177.14.102:443
TCP(TLS/1.2) p####.google####.com:443

DNS requests:

and####.a####.go####.com
and####.google####.com
android####.go####.com
app-mea####.com
connect####.gst####.com
p####.google####.com
pla####.google####.com
rr1---s####.g####.com
rr3---s####.g####.com
rr5---s####.g####.com
www.google####.com

File system changes:

Creates the following files:

/data/adb/####/99comandroidproviderscloudsync
/data/app/####/.x86
/data/app/####/.x86_64
/data/app/####/com.google.android.gms.apk
/data/app/####/config.en
/data/app/####/config.mdpi
/data/app/####/libAppDataSearch.so
/data/app/####/libandroidx.graphics.path.so
/data/app/####/libashmem_utils_jni.so
/data/app/####/libbarhopper_qr_only_jni.so
/data/app/####/libbetocore.so
/data/app/####/libbluestar_jni_android.so
/data/app/####/libchreap_ar_airplane_napp.so
/data/app/####/libdatastore_shared_counter.so
/data/app/####/libframesequence.so
/data/app/####/libgeller_jni_lite_lib.so
/data/app/####/libgmscore.so
/data/app/####/libgoogle-ocrclient-v3.so
/data/app/####/libimage_processing_util_jni.so
/data/app/####/libinertial-anchor-jni.so
/data/app/####/libink.so
/data/app/####/libisolation_mgr_jni.so
/data/app/####/libjnidispatch.so
/data/app/####/libldt_np_jni.so
/data/app/####/liboak_attestation_verification_jni.so
/data/app/####/libodlh_proxy_jni.so
/data/app/####/libodlh_stub_jni.so
/data/app/####/libpqrnn_jni_gms_client.so
/data/app/####/libsemanticlocation_inference_jni.so
/data/app/####/libsslwrapper_jni.so
/data/app/####/libsurface_util_jni.so
/data/app/####/libtensorflowlite_jni_gms_client.so
/data/app/####/libwearable-selector.so
/data/app/####/libzwrapper.so
/data/app/####/tmp.2E9Pqo
/data/app/####/tmp.2Vp1GP
/data/app/####/tmp.7PdvCH
/data/app/####/tmp.8Q3Rgq
/data/app/####/tmp.CwY9nt
/data/app/####/tmp.H0GMZe
/data/app/####/tmp.JJb52v
/data/app/####/tmp.Js9mtA
/data/app/####/tmp.MqpuWY
/data/app/####/tmp.TsJbbX
/data/app/####/tmp.baMcGd
/data/app/####/tmp.gzRMzB
/data/app/####/tmp.pZz9ma
/data/app/####/tmp.rBvfoB
/data/app/####/tmp.y3bBn0
/data/dalvik-cache/####/system@framework@am.jar@classes.dex
/data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
/data/dalvik-cache/####/system@framework@pm.jar@classes.dex.flo...leted)
/data/data/####/.cloud_shell_guard
/data/data/####/.cs_probe
/data/data/####/proc_auxv
/data/data/####/sync_guard
/data/local/shi5l2fn.tmp
/data/local/shirlx5c.tmp
/data/local/shre9clt.tmp
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c /data/user/0/<Package>/files/.compat/sync_guard </dev/null >/dev/null 2>&1 &
/system/bin/sh -c /system/bin/su 0 sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/bin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/bin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c /system/bin/su root sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/bin/su root sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/bin/su root sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c /system/xbin/su 0 sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/xbin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/xbin/su 0 sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c /system/xbin/su root sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c /system/xbin/su root sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c /system/xbin/su root sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c nohup /data/app/<Package>-1/lib/arm/libwatchdog.so <Package> /data/local/tmp/.cs_-760457492.apk & </dev/null >/dev/null 2>&1
/system/bin/sh -c su 0 sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c su 0 sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c su 0 sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh -c su root sh -c 'pm grant <Package> android.permission.POST_NOTIFICATIONS'
/system/bin/sh -c su root sh -c 'pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES'
/system/bin/sh -c su root sh -c 'pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES'
/system/bin/sh /data/user/0/<Package>/files/.compat/sync_guard
/system/bin/su
/system/bin/su -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su 0 -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su 0 -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su 0 -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su 0 /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su 0 sh
/system/bin/su 0 sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su 0 sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su 0 sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su root /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su root sh
/system/bin/su root sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/bin/su root sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/bin/su root sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/bin/su sh
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm/libwatchdog.so /data/app/<Package>-1/lib/arm/libwatchdog.so <Package> /data/local/tmp/.cs_-760457492.apk
/system/xbin/su -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su 0 /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su 0 sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su 0 sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su 0 sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su root /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
/system/xbin/su root sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
/system/xbin/su root sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
/system/xbin/su root sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
app_process /system/bin com.android.commands.pm.Pm grant <Package> android.permission.POST_NOTIFICATIONS
app_process /system/bin com.android.commands.pm.Pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
app_process /system/bin com.android.commands.pm.Pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
cat << 'BOOTEOF' > '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
cat << 'BOOTEOF' > '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
cat << 'BOOTEOF' > '/data/adb/service.d/99comandroidproviderscloudsync'
chmod 755 '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
chmod 755 '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
chmod 755 '/data/adb/service.d/99comandroidproviderscloudsync'
chown root:root '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
chown root:root '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
chown root:root '/data/adb/service.d/99comandroidproviderscloudsync'
cmd activity set-standby-bucket <Package> active
cmd appops set <Package> RUN_ANY_IN_BACKGROUND allow
cmd appops set <Package> RUN_IN_BACKGROUND allow
cmd deviceidle except-idle-whitelist +<Package>
cmd deviceidle whitelist +<Package>
cp '/data/app/<Package>-1/base.apk' '/data/local/tmp/.cs_-760457492.apk' && chmod 644 '/data/local/tmp/.cs_-760457492.apk'
dumpsys batterystats --reset <Package>
dumpsys deviceidle whitelist +<Package>
echo -1000 > /proc/6053/oom_score_adj
echo -1000 > /proc/7087/oom_score_adj
echo -17 > /proc/6053/oom_adj
echo -17 > /proc/7087/oom_adj
for lock in <Package Folder>/files/.cloud_sync_guard /data/user/0/<Package>/files/.cloud_sync_guard <Package Folder>/files/.cloud_shell_guard /data/user/0/<Package>/files/.cloud_shell_guard /data/local/tmp/.csg_<Package>; do [ -f "$lock" ] && kill -9 "$(cat "$lock" 2>/dev/null)" 2>/dev/null; done; for f in /proc/[0-9]*/cmdline; do pid=${f#/proc/}; pid=${pid%/cmdline}; line=$(tr '\0' ' ' <"$f" 2>/dev/null); case "$line" in *libwatchdog.so*|*sync_guard*|*cloud_sync_guard*|*cloud_shell_guard*) kill -9 "$pid" 2>/dev/null; ;; esac; done; pkill -9 -f libwatchdog.so 2>/dev/null; pkill -9 -f libbot.so 2>/dev/null; pkill -9 -f libsynchelper.so 2>/dev/null; pkill -9 -f sync_guard 2>/dev/null; pkill -9 -f '/files/.compat/sync_guard' 2>/dev/null; pkill -9 -f '/files/.w' 2>/dev/null; true
id
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF '.core.CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF '<Package>' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF 'CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF 'SelinuxBypass' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/ksu/post-mount.d' ]; then for f in '/data/adb/ksu/post-mount.d'/*; do [ -f "$f" ] && grep -qF 'cloud.sync boot' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF '.core.CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF '<Package>' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF 'CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF 'SelinuxBypass' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/post-fs-data.d' ]; then for f in '/data/adb/post-fs-data.d'/*; do [ -f "$f" ] && grep -qF 'cloud.sync boot' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF '.core.CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF '<Package>' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF 'CoreSyncService' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF 'SelinuxBypass' "$f" 2>/dev/null && rm -f "$f"; done; fi
if [ -d '/data/adb/service.d' ]; then for f in '/data/adb/service.d'/*; do [ -f "$f" ] && grep -qF 'cloud.sync boot' "$f" 2>/dev/null && rm -f "$f"; done; fi
mkdir -p '/data/adb/ksu/post-mount.d'
mkdir -p '/data/adb/post-fs-data.d'
mkdir -p '/data/adb/service.d'
pm grant <Package> android.permission.PACKAGE_USAGE_STATS
pm grant <Package> android.permission.POST_NOTIFICATIONS
pm grant <Package> android.permission.READ_EXTERNAL_STORAGE
pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
pm grant <Package> android.permission.SCHEDULE_EXACT_ALARM
pm grant <Package> android.permission.WRITE_EXTERNAL_STORAGE
rm -f '/data/adb/ksu/post-mount.d/99comandroidproviderscloudsync'
rm -f '/data/adb/post-fs-data.d/99comandroidproviderscloudsync'
rm -f '/data/adb/service.d/99comandroidproviderscloudsync'
rm -f /data/local/tmp/.cs_[0-9]*.apk
rm -f <Package Folder>/files/.cloud_sync_guard <Package Folder>/files/.cloud_shell_guard <Package Folder>/files/.compat/sync_guard <Package Folder>/files/.nwp <Package Folder>/files/.wp <Package Folder>/files/.w /data/user/0/<Package>/files/.cloud_sync_guard /data/user/0/<Package>/files/.cloud_shell_guard /data/user/0/<Package>/files/.compat/sync_guard /data/user/0/<Package>/files/.nwp /data/user/0/<Package>/files/.wp /data/user/0/<Package>/files/.w /data/local/tmp/.csg_<Package> /data/local/tmp/.nwp_<Package>
sh
su -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su 0 /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su 0 /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su 0 id
su 0 sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su 0 sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su 0 sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su root /system/bin/sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su root /system/bin/sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
su root sh -c pm grant <Package> android.permission.POST_NOTIFICATIONS
su root sh -c pm grant <Package> android.permission.REQUEST_DELETE_PACKAGES
su root sh -c pm grant <Package> android.permission.REQUEST_INSTALL_PACKAGES
which su

Loads the following dynamic libraries:

libattack
libdns

Uses elevated priveleges.

Displays its own windows over windows of other apps.

Attempts to detect sandbox environment.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial