Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Click.363.origin
Downloads the following detected threats from the Internet:
- Android.Click.363.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) bbq.aa####.cn:80
- TCP(HTTP/1.1) insho####.com:80
- TCP(SSL/3.0) sett####.crashly####.com:443
- TCP(SSL/3.0) ad.myinsta####.com:8080
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) ad.myinsta####.com:8080
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) us####.al####.com.####.net:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP bbq.aa####.cn:6666
DNS requests:
- a####.al####.com
- ad.myinsta####.com
- adser####.go####.com
- bbq.aa####.cn
- firebas####.google####.com
- insho####.com
- sett####.crashly####.com
HTTP GET requests:
- insho####.com/photoeditor/bg/android_bg_packs44.json
- insho####.com/photoeditor/brush/android_brush_packs39.json
- insho####.com/photoeditor/filter/android_filter_packs39.json
- insho####.com/photoeditor/font/android_font_packs44.json
- insho####.com/photoeditor/lightfx/android_lightfx_packs39.json
- insho####.com/photoeditor/stickers/android_sticker_packs44.json
- insho####.com/photoeditor/update_config.json
HTTP POST requests:
- bbq.aa####.cn/classes.dex
File system changes:
Creates the following files:
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DBeginSession.cls_temp
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DBeginSession.json
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DSessionApp.cls_temp
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DSessionApp.json
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DSessionDevice.cls_temp
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DSessionDevice.json
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DSessionOS.cls_temp
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000DSessionOS.json
- /data/data/####/5F5C85EF02EF-0001-0898-29C38FB2000Duser.meta
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/FirstRun
- /data/data/####/MultiDex.lock
- /data/data/####/ServerConfig.xml
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/bg.json.tmp
- /data/data/####/brush.json.tmp
- /data/data/####/classes.dex
- /data/data/####/collagemaker.xml
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.remoteconfig_legacy_settings.xml
- /data/data/####/conf.xml
- /data/data/####/crash_marker
- /data/data/####/crashlytics-userlog-5F5C85EF02EF-0001-0898-29C3...mp.tmp
- /data/data/####/e349ecaf2db73726f1baf8f76c8c94a5
- /data/data/####/f03752c4f76862c88319f711fcb3451f
- /data/data/####/filter.json.tmp
- /data/data/####/font.json.tmp
- /data/data/####/frc_1;757324348735;android;caaddb32e54f9271_fir...e.json
- /data/data/####/frc_1;757324348735;android;caaddb32e54f9271_fir...gs.xml
- /data/data/####/frc_1;757324348735;android;caaddb32e54f9271_fir...h.json
- /data/data/####/iab.xml
- /data/data/####/libjiagu867967166.so
- /data/data/####/light_fx.json.tmp
- /data/data/####/mobileads_consent.xml
- /data/data/####/multidex.version.xml
- /data/data/####/sa_2b8a9713-68dd-4a3a-9ae3-11a57459e082_1599899178514.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/sticker.json.tmp
- /data/data/####/update_config.json.tmp
- /data/media/####/.icon.png
- /data/media/####/.zip
- /data/media/####/1.png
- /data/media/####/10.png
- /data/media/####/11.png
- /data/media/####/12.png
- /data/media/####/13.png
- /data/media/####/14.png
- /data/media/####/15.png
- /data/media/####/16.png
- /data/media/####/17.png
- /data/media/####/18.png
- /data/media/####/2.png
- /data/media/####/3.png
- /data/media/####/4.png
- /data/media/####/5.png
- /data/media/####/6.png
- /data/media/####/7.png
- /data/media/####/8.png
- /data/media/####/9.png
- /data/media/####/info.json
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu867967166
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
