Technical information
Malicious functions:
Downloads the following detected threats from the Internet:
- Android.Packed.58362
Network activity:
Connects to:
- UDP(???) and####.google####.com:443
- TCP(???) rebrand####.com:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) i.pos####.cc:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) api.onesi####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) rebrand####.com:443
- TCP(TLS/1.2) 1####.250.74.36:443
- TCP(TLS/1.2) firebas####.google####.com:443
- TCP(TLS/1.2) 1####.250.74.35:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- api.onesi####.com
- app-mea####.com
- f####.gst####.com
- firebas####.google####.com
- i.pos####.cc
- p####.google####.com
- rebrand####.com
HTTP GET requests:
- api.onesi####.com:443/apps/25cddd83-5564-4e3d-86ae-5f49783f18af/android_...
- i.pos####.cc:443/FRVGnppS/ic-launcher.png
- rebrand####.com:443/apps/AntSpray_Super_Tivi.apk
- rebrand####.com:443/apps/AntSpray_TV.apk
HTTP POST requests:
- api.onesi####.com:443/players
- firebas####.google####.com:443/v1/projects/onesignal-shared-public/insta...
- firebas####.google####.com:443/v1/projects/royalstore-60bcb/installations
File system changes:
Creates the following files:
- /data/data/####/.font3960-3960-0
- /data/data/####/.font4263-4263-0
- /data/data/####/140563bbdde5ef9b1b1f1e2c3036bd08ded7bb1442bf8e5....0.tmp
- /data/data/####/140563bbdde5ef9b1b1f1e2c3036bd08ded7bb1442bf8e5...c7f8.0
- /data/data/####/FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX0...Yz.xml
- /data/data/####/FirebaseHeartBeatT05FU0lHTkFMX1NES19GQ01fQVBQX0...ml.bak
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzYyOTU1MjM0O...Mx.xml
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo2MzYyOTU1MjM0O...ml.bak
- /data/data/####/GTPlayerPurchases.xml
- /data/data/####/OneSignal.db-journal
- /data/data/####/OneSignalTriggers.xml
- /data/data/####/PersistedInstallation.T05FU0lHTkFMX1NES19GQ01fQ...z.json
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo2MzYyOTU1...x.json
- /data/data/####/PersistedInstallation1226879093tmp
- /data/data/####/PersistedInstallation1784631893tmp
- /data/data/####/PersistedInstallation1985285747tmp
- /data/data/####/PersistedInstallation461116265tmp
- /data/data/####/PersistedInstallation529189358tmp
- /data/data/####/PersistedInstallation732764313tmp
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/journal
- /data/data/####/prdownloader.db-journal
- /data/data/####/y2.xml
- /data/media/####/AntSpray_Super_Tivi.apk
- /data/media/####/AntSpray_Super_Tivi.apk.temp
- /data/media/####/AntSpray_TV.apk
- /data/media/####/AntSpray_TV.apk.temp
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5PADDING
Gets information about network.
Displays its own windows over windows of other apps.
Attempts to detect sandbox environment.
