Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSpy.12123
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 1####.177.14.94:443
- TCP(TLS/1.2) 1####.177.14.99:443
- UDP pla####.google####.com:443
DNS requests:
- p####.google####.com
- pla####.google####.com
- rr2---s####.g####.com
- www.google####.com
File system changes:
Creates the following files:
- /data/data/####/3XmYT8CGlV4gx568YsKJ3ZmCKLhtaSca.dex
- /data/data/####/5LOlZG5CgjKjUXSQ9BB8bW5DAYNuraKs.dex
- /data/data/####/5LOlZG5CgjKjUXSQ9BB8bW5DAYNuraKs.dex.flock (deleted)
- /data/data/####/82rdpPYKVq9GZKhxKcZhXw8wfkKzsrFd.dex
- /data/data/####/82rdpPYKVq9GZKhxKcZhXw8wfkKzsrFd.dex.flock (deleted)
- /data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAA (deleted)
- /data/data/####/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (deleted)
- /data/data/####/Dh5dUXF9eI3SGzwj03Vg7Xr8s3Cd2qGc.dex
- /data/data/####/Dh5dUXF9eI3SGzwj03Vg7Xr8s3Cd2qGc.dex.flock (deleted)
- /data/data/####/SxIwQuBNHNwlIQLvrxfVi8uFmsGHEPC1.dex
- /data/data/####/SxIwQuBNHNwlIQLvrxfVi8uFmsGHEPC1.dex.flock (deleted)
- /data/data/####/Ti3riS1ch0emgfrVSzvLIzgdSOicT2xd.dex
- /data/data/####/Ti3riS1ch0emgfrVSzvLIzgdSOicT2xd.dex.flock (deleted)
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/cloneSettings_29537464.json
- /data/data/####/hkCo7MShhupoo4UxkmIVQ2nKpkXwNO6w.dex
- /data/data/####/hkCo7MShhupoo4UxkmIVQ2nKpkXwNO6w.dex.flock (deleted)
- /data/data/####/index
- /data/data/####/jxfDriNiZPhMkaVUaqUHrCjA78ssrD5v.dex
- /data/data/####/jxfDriNiZPhMkaVUaqUHrCjA78ssrD5v.dex.flock (deleted)
- /data/data/####/lnl8ZFhTPyEkAEdfPZiUuPiioVU1YvtO.dex
- /data/data/####/metrics_guid
- /data/data/####/natives_sec_blob1166192681.dex
- /data/data/####/natives_sec_blob1166192681.dex.flock (deleted)
- /data/data/####/natives_sec_blob2085441517.dex
- /data/data/####/natives_sec_blob2085441517.dex.flock (deleted)
- /data/data/####/natives_sec_blob666781727.dex
- /data/data/####/natives_sec_blob666781727.dex.flock (deleted)
- /data/data/####/natives_sec_blob93611785.dex
- /data/data/####/natives_sec_blob93611785.dex.flock (deleted)
- /data/data/####/tPpS7Vll46u4CJM0q1Aw79CI5pSLEj1o.dex
- /data/data/####/tPpS7Vll46u4CJM0q1Aw79CI5pSLEj1o.dex.flock (deleted)
- /data/data/####/the-real-index
Miscellaneous:
Executes the following shell scripts:
- rm -r/data/user/0/<Package>/app_ded/3XmYT8CGlV4gx568YsKJ3ZmCKLhtaSca.dex
- rm -r/data/user/0/<Package>/app_ded/5LOlZG5CgjKjUXSQ9BB8bW5DAYNuraKs.dex
- rm -r/data/user/0/<Package>/app_ded/82rdpPYKVq9GZKhxKcZhXw8wfkKzsrFd.dex
- rm -r/data/user/0/<Package>/app_ded/Dh5dUXF9eI3SGzwj03Vg7Xr8s3Cd2qGc.dex
- rm -r/data/user/0/<Package>/app_ded/SxIwQuBNHNwlIQLvrxfVi8uFmsGHEPC1.dex
- rm -r/data/user/0/<Package>/app_ded/Ti3riS1ch0emgfrVSzvLIzgdSOicT2xd.dex
- rm -r/data/user/0/<Package>/app_ded/hkCo7MShhupoo4UxkmIVQ2nKpkXwNO6w.dex
- rm -r/data/user/0/<Package>/app_ded/jxfDriNiZPhMkaVUaqUHrCjA78ssrD5v.dex
- rm -r/data/user/0/<Package>/app_ded/lnl8ZFhTPyEkAEdfPZiUuPiioVU1YvtO.dex
- rm -r/data/user/0/<Package>/app_ded/tPpS7Vll46u4CJM0q1Aw79CI5pSLEj1o.dex
Uses the following algorithms to decrypt data:
- AES
- AES-ECB-PKCS5Padding
Gets information about network.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
