Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Packed.55974
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) s####.gamegua####.net:80
- TCP(HTTP/1.1) gamegua####.net:80
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) 1####.250.74.131:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- TCP(TLS/1.2) 1####.250.74.142:443
- TCP(TLS/1.2) 1####.250.74.110:443
- TCP(TLS/1.2) 1####.250.74.164:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- gamegua####.net
- gmscomp####.google####.com
- p####.google####.com
- rr9---s####.g####.com
- s####.gamegua####.net
HTTP GET requests:
- s####.gamegua####.net/GG_logs/usage.php
HTTP POST requests:
- gamegua####.net/GG_logs/usage.php
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/dalvik-cache/####/system@framework@am.jar@classes.dex
- /data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
- /data/data/####/2ZMMLDYiEb4vncojAegZl1SN0fUgMMEM.dex
- /data/data/####/2ZMMLDYiEb4vncojAegZl1SN0fUgMMEM.dex.flock (deleted)
- /data/data/####/3ltyDi9LoC38hQhOkdKkY3WbvW0JpJH8.dex
- /data/data/####/3ltyDi9LoC38hQhOkdKkY3WbvW0JpJH8.dex.flock (deleted)
- /data/data/####/6259UPHgJgmY4G62agSBLLJh5tYT9dvs.dex
- /data/data/####/6259UPHgJgmY4G62agSBLLJh5tYT9dvs.dex.flock (deleted)
- /data/data/####/BVvGcvJhcqppD7Al92K07JAtPthFVrcY.dex
- /data/data/####/BVvGcvJhcqppD7Al92K07JAtPthFVrcY.dex.flock (deleted)
- /data/data/####/CgX54MmZpZBWWa33aVg3MaLAFVYJWnLl.dex
- /data/data/####/CgX54MmZpZBWWa33aVg3MaLAFVYJWnLl.dex.flock (deleted)
- /data/data/####/EVNIbsBS9BeOcJkydvTH3bTMUsPVuMWX.dex
- /data/data/####/EVNIbsBS9BeOcJkydvTH3bTMUsPVuMWX.dex.flock (deleted)
- /data/data/####/EWb4zj6ajL0A6UP64lAV0kaCCJqePxs6.dex
- /data/data/####/EWb4zj6ajL0A6UP64lAV0kaCCJqePxs6.dex.flock (deleted)
- /data/data/####/Ed4g1r2EgWYfrY4M6SYaBrudNu4dE1Nr.dex
- /data/data/####/Ed4g1r2EgWYfrY4M6SYaBrudNu4dE1Nr.dex.flock (deleted)
- /data/data/####/Hv1rkv5KmkN5g1CxW2aisAZ9G7AHtpBI.dex
- /data/data/####/Hv1rkv5KmkN5g1CxW2aisAZ9G7AHtpBI.dex.flock (deleted)
- /data/data/####/NYeXoeYhDWRjKmQS1GMCqa4mJ1O34ju7.dex
- /data/data/####/NYeXoeYhDWRjKmQS1GMCqa4mJ1O34ju7.dex.flock (deleted)
- /data/data/####/SyLpIkEYViHfz0TnpXGmoylUvk5PfQOG.dex
- /data/data/####/Tqt7hkNcVlO82SgXSQsyqa4Ua71OCzJB.dex
- /data/data/####/Tqt7hkNcVlO82SgXSQsyqa4Ua71OCzJB.dex.flock (deleted)
- /data/data/####/TrMQA5OuTxqg37ZFcIJvgWjIzdB78Mgt.dex
- /data/data/####/TrMQA5OuTxqg37ZFcIJvgWjIzdB78Mgt.dex.flock (deleted)
- /data/data/####/Uu3eGWQHjZ6swYCPvew9JrmNk8qZXDg2.dex
- /data/data/####/Uu3eGWQHjZ6swYCPvew9JrmNk8qZXDg2.dex.flock (deleted)
- /data/data/####/Vf5bmFk967XoRyYMdPONg068C74BdjkM.dex
- /data/data/####/Vf5bmFk967XoRyYMdPONg068C74BdjkM.dex.flock (deleted)
- /data/data/####/com.pgtz.gg.id_preferences.xml
- /data/data/####/e64weBMaObf89fhif3HDCHAOFQXNrLco.dex
- /data/data/####/e64weBMaObf89fhif3HDCHAOFQXNrLco.dex.flock (deleted)
- /data/data/####/oRVhS4sK2aunlS59ui1Yw3EX9vfpdrhq.dex
- /data/data/####/oRVhS4sK2aunlS59ui1Yw3EX9vfpdrhq.dex.flock (deleted)
- /data/data/####/pXRHSpl2OyZxTUOxvnn61yevTBHHeIFG.dex
- /data/data/####/pXRHSpl2OyZxTUOxvnn61yevTBHHeIFG.dex.flock (deleted)
- /data/data/####/pqJsMWYNBJlmremojgo3gvOAkXc8u9dH.dex
- /data/data/####/pqJsMWYNBJlmremojgo3gvOAkXc8u9dH.dex.flock (deleted)
- /data/data/####/tl8cqp7zFIjEhSLoiI2UzcaFQAUAwEsU.dex
- /data/data/####/tl8cqp7zFIjEhSLoiI2UzcaFQAUAwEsU.dex.flock (deleted)
- /data/data/####/wtQRjIsFQCaiqv0R2cHHO7eSqcyvlB0a.dex
- /data/data/####/wtQRjIsFQCaiqv0R2cHHO7eSqcyvlB0a.dex.flock (deleted)
- /data/data/####/yHqwnY0pIH9wz6S4o7Zgcq9Q2XYYu0gG.dex
- /data/data/####/yHqwnY0pIH9wz6S4o7Zgcq9Q2XYYu0gG.dex.flock (deleted)
- /data/data/####/ysBfjPKkzAVfVMlYqqx1xHlv2CPipml4.dex
- /data/data/####/ysBfjPKkzAVfVMlYqqx1xHlv2CPipml4.dex.flock (deleted)
- /data/media/####/GG_logcat_r101.1_16142_7.1.2_25.log
- /data/media/####/crash-2025-06-04-06-42-40-1749019360090.log
- /data/media/####/crash-2025-06-04-06-42-47-1749019367821.log
- /data/media/####/crash-2025-06-04-06-43-03-1749019383980.log
- /data/media/####/crash-2025-06-04-06-43-11-1749019391919.log
- /data/media/####/crash-2025-06-04-06-43-29-1749019409595.log
- /data/media/####/crash-2025-06-04-06-43-37-1749019417188.log
- /data/media/####/crash.txt
- /data/media/####/logcat.txt
Miscellaneous:
Executes the following shell scripts:
- chmod 0644 /storage/emulated/legacy/GG_logcat_r101.1_16142_7.1.2_25.log 2>&1 ; chmod 0644 /storage/emulated/0/GG_logcat_r101.1_16142_7.1.2_25.log 2>&1 ; logcat -v threadtime -b main -b system *:V 2>&1 ; exit
- logcat -f /storage/emulated/0/logcat.txt -d -v threadtime -b main -b system *:V
- rm -r/data/user/0/<Package>/app_ded/CgX54MmZpZBWWa33aVg3MaLAFVYJWnLl.dex
- rm -r/data/user/0/<Package>/app_ded/EVNIbsBS9BeOcJkydvTH3bTMUsPVuMWX.dex
- rm -r/data/user/0/<Package>/app_ded/EWb4zj6ajL0A6UP64lAV0kaCCJqePxs6.dex
- rm -r/data/user/0/<Package>/app_ded/TrMQA5OuTxqg37ZFcIJvgWjIzdB78Mgt.dex
- rm -r/data/user/0/<Package>/app_ded/Uu3eGWQHjZ6swYCPvew9JrmNk8qZXDg2.dex
- rm -r/data/user/0/<Package>/app_ded/Vf5bmFk967XoRyYMdPONg068C74BdjkM.dex
- rm -r/data/user/0/<Package>/app_ded/e64weBMaObf89fhif3HDCHAOFQXNrLco.dex
- rm -r/data/user/0/<Package>/app_ded/oRVhS4sK2aunlS59ui1Yw3EX9vfpdrhq.dex
- rm -r/data/user/0/<Package>/app_ded/pXRHSpl2OyZxTUOxvnn61yevTBHHeIFG.dex
- rm -r/data/user/0/<Package>/app_ded/pqJsMWYNBJlmremojgo3gvOAkXc8u9dH.dex
- rm -r/data/user/0/<Package>/app_ded/tl8cqp7zFIjEhSLoiI2UzcaFQAUAwEsU.dex
- sh
- su
Uses the following algorithms to decrypt data:
- AES
- AES-ECB-PKCS5Padding
Uses elevated priveleges.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
