Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Internet:
- Android.Xiny.20
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) img.cool####.cn:80
- TCP(HTTP/1.1) go.1mi####.cn:80
- TCP(HTTP/1.1) r.eli####.cn:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) 1####.217.168.238:443
- TCP(TLS/1.0) www.gst####.com:443
DNS requests:
- go.1mi####.cn
- img.cool####.cn
- r.eli####.cn
- sett####.crashly####.com
- ssl.gst####.com
- www.go####.com
- www.gst####.com
HTTP GET requests:
- img.cool####.cn/2011/gou.jar
HTTP POST requests:
- go.1mi####.cn/m2?protocol=####&version=####&cid=####
- r.eli####.cn/k1?requestId=####&g=####&ua=####
File system changes:
Creates the following files:
- /data/data/####/5C6F47500245-0001-08F7-F4CBF0BC22EABeginSession.cls_temp
- /data/data/####/5C6F47500245-0001-08F7-F4CBF0BC22EASessionApp.cls_temp
- /data/data/####/5C6F47500245-0001-08F7-F4CBF0BC22EASessionDevice.cls_temp
- /data/data/####/5C6F47500245-0001-08F7-F4CBF0BC22EASessionOS.cls_temp
- /data/data/####/W_Key.xml
- /data/data/####/a.xml
- /data/data/####/apprater.xml
- /data/data/####/com.a.a.a.c.xml
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.goseet.VidTrimPro_preferences.xml
- /data/data/####/com.goseet.VidTrimPro_preferences.xml.bak
- /data/data/####/crashlytics-userlog-d1d8844c-5b7e-489b-b83c-6eb...b.temp
- /data/data/####/crashlytics-userlog-d1d8844c-5b7e-489b-b83c-6eb...mp.tmp
- /data/data/####/crashlytics-userlog-f429c397-e71f-486a-9fee-e84...mp.tmp
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/initialization_marker
- /data/data/####/sa_b65297a8-f17c-4cec-86ea-a08ff7eb24de_1550796625196.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/st.xml
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/.thumbdata3--1967290299
- /data/media/####/1550796646823.jpg
- /data/media/####/1550796646930.jpg
- /data/media/####/1550796647604.jpg
- /data/media/####/1550796647721.jpg
- /data/media/####/1550796647806.jpg
- /data/media/####/1550796647913.jpg
- /data/media/####/1550796647974.jpg
- /data/media/####/1550796648050.jpg
- /data/media/####/1550796648096.jpg
- /data/media/####/1550796648202.jpg
- /data/media/####/1550796648248.jpg
- /data/media/####/1550796648705.jpg
- /data/media/####/1550796648810.jpg
- /data/media/####/1550796648880.jpg
- /data/media/####/1550796649009.jpg
- /data/media/####/1550796649112.jpg
- /data/media/####/1550796649214.jpg
- /data/media/####/1550796649324.jpg
- /data/media/####/1550796649447.jpg
- /data/media/####/1550796649569.jpg
- /data/media/####/1550796649691.jpg
- /data/media/####/1550796649766.jpg
- /data/media/####/1550796649858.jpg
- /data/media/####/1550796649982.jpg
- /data/media/####/1550796650529.jpg
- /data/media/####/1550796650711.jpg
- /data/media/####/4.8_gou.jar.tmp
- /data/media/####/restime.dat
Miscellaneous:
Loads the following dynamic libraries:
- videokit
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS7Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
