Technical information
Malicious functions:
Downloads the following detected threats from the Internet:
- Android.Siggen.Susp.45521
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) justc####.xyz:443
DNS requests:
- justc####.xyz
HTTP GET requests:
- justc####.xyz:443/Dropper/SachinNew/api/download.php?id=####
- justc####.xyz:443/Dropper/SachinNew/api/list.php
File system changes:
Creates the following files:
- /data/data/####/prdownloader.db-journal
- /data/data/####/update_1762053418038.apk
- /data/data/####/update_1762053418038.apk.temp
- /databases/prdownloader.db
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
Loads the following dynamic libraries:
- libgmvp
Uses elevated priveleges.
Gets information about installed apps.
Displays its own windows over windows of other apps.
