Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) bifrost####.hot####.com-dsc####.####.net:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) rr8---s####.g####.com:443
- TCP(TLS/1.0) rr18---####.g####.com:443
- TCP(TLS/1.0) 1####.217.18.99:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.2) 1####.217.18.99:443
- TCP(TLS/1.2) p####.google####.com:443
- TCP g####.hot####.com.####.net:443
- TCP secure-####.hot####.com.####.net:443
- UDP p####.google####.com:443
- TCP persona####.hot####.com.####.net:443
- TCP firebas####.crashly####.com:443
- TCP api.hot####.com####.####.net:443
- TCP arm.modby####.com:10012
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- api.hot####.com
- app-mea####.com
- arm.modby####.com
- bifrost####.hot####.com
- crashly####.google####.com
- firebas####.crashly####.com
- firebas####.google####.com
- g####.hot####.com
- p####.google####.com
- per####.hot####.com
- pla####.google####.com
- rr1---s####.g####.com
- rr18---####.g####.com
- rr8---s####.g####.com
- secure-####.hot####.com
HTTP POST requests:
- bifrost####.hot####.com-dsc####.####.net:443/v1/import
- firebas####.crashly####.com:443/v1/firelog/legacy/batchlog
- firebas####.google####.com:443/v1/projects/462722802088/namespaces/fireb...
File system changes:
Creates the following files:
- /data/data/####/.bundledAppData
- /data/data/####/.font3560-3560-0
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/11c15a3246ab4d9a6e7c41621e098982.0.tmp
- /data/data/####/11c15a3246ab4d9a6e7c41621e098982.1
- /data/data/####/11c15a3246ab4d9a6e7c41621e098982.1.tmp
- /data/data/####/63E918F60216-0001-098B-6414D604484F.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484FBeginSession.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484FSessionApp.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484FSessionDevice.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484FSessionEvent...00.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484FSessionOS.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484FSessionUser.cls
- /data/data/####/63E918F60216-0001-098B-6414D604484Fkeys.meta
- /data/data/####/63E918F60216-0001-098B-6414D604484Fuser.meta
- /data/data/####/63E918F602160001098B6414D604484F
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5BeginSession.cls
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5BeginSession.cls_temp
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5SessionApp.cls
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5SessionDevice.cls
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5SessionOS.cls
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5keys.meta
- /data/data/####/63EC50FF01F0-0001-0DE8-6A9A094B80D5user.meta
- /data/data/####/7ed3d040657058cf8d0a693a4241f260.0.tmp
- /data/data/####/7ed3d040657058cf8d0a693a4241f260.1
- /data/data/####/7ed3d040657058cf8d0a693a4241f260.1.tmp
- /data/data/####/Dollarbird.xml
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/HOTSTAR_INFRA
- /data/data/####/JzFAXnEBJTHG (deleted)
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo0NjI3MjI4...k.json
- /data/data/####/VCmockVQGxzn (deleted)
- /data/data/####/_guest_prefsprod.xml
- /data/data/####/_network_prefsprod.xml
- /data/data/####/ab_experiment_preferencesprod.xml
- /data/data/####/analytics-android-HOTSTAR_INFRA.xml
- /data/data/####/androidx.work.workdb
- /data/data/####/androidx.work.workdb-shm
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/app-pref.xml
- /data/data/####/app-pref.xml.bak
- /data/data/####/appstart-db
- /data/data/####/appstart-db-shm
- /data/data/####/appstart-db-wal
- /data/data/####/cached_locals.xml
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/classes.dex;classes5.dex
- /data/data/####/cloneSettings.json
- /data/data/####/com.applisto.appcloner.classes.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/com.google.firebase.crashlytics.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/com.google.firebase.remoteconfig_legacy_settings.xml
- /data/data/####/consent_preferences.xml
- /data/data/####/content-db
- /data/data/####/content-db-shm
- /data/data/####/content-db-wal
- /data/data/####/crashlytics-userlog-63EC50FF01F0-0001-0DE8-6A9A...5.temp
- /data/data/####/d4f73d4ac933815c7ec90786fa83c169.0.tmp
- /data/data/####/d4f73d4ac933815c7ec90786fa83c169.1
- /data/data/####/event0000000000
- /data/data/####/evernote_jobs.db
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/frc_1;462722802088;android;d68d42425af8d3ab07fd...e.json
- /data/data/####/frc_1;462722802088;android;d68d42425af8d3ab07fd...gs.xml
- /data/data/####/frc_1;462722802088;android;d68d42425af8d3ab07fd...h.json
- /data/data/####/frc_1;462722802088;android;d68d42425af8d3ab07fd...s.json
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/gravity-pref.xml
- /data/data/####/in.startv.hotstar.dplus.tv.v2_preferences.xml
- /data/data/####/initialization_marker
- /data/data/####/journal.tmp
- /data/data/####/language-db
- /data/data/####/language-db-shm
- /data/data/####/language-db-wal
- /data/data/####/language_preferences.xml
- /data/data/####/libjiagu.so
- /data/data/####/locale_eng.xml
- /data/data/####/proc_auxv
- /data/data/####/report
- /data/data/####/string_store_preference.xml
- /data/data/####/subs-pref.xml
- /data/data/####/user
- /data/data/####/user-pref.xml
- /data/data/####/user_info_preferenceprod.xml
- /data/data/####/user_segment_preferences.xml
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- app_process /system/bin com.android.commands.pm.Pm path <Package>
- pm path <Package>
Loads the following dynamic libraries:
- libjiagu
- libnative-lib
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about network.
Displays its own windows over windows of other apps.
