Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.477.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) o####.azh####.com:9190
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) gv1.x####.com:443
- TCP(TLS/1.0) 1####.217.20.106:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) 47.2####.16.40:9061
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) usv.azh####.com:9061
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) 35.2####.176.194:443
- TCP(TLS/1.0) 35.2####.137.38:443
- TCP(TLS/1.2) instant####.google####.com:443
- TCP(TLS/1.2) 1####.217.168.206:443
- TCP(TLS/1.2) 1####.217.20.106:443
- TCP(TLS/1.2) 1####.217.19.202:443
DNS requests:
- 2.and####.p####.####.org
- av1.x####.com
- c####.x####.com
- g####.face####.com
- gv1.x####.com
- instant####.google####.com
- o####.azh####.com
- usv.azh####.com
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/1565003124382_3480
- /data/data/####/1565003124441_3480
- /data/data/####/1565003126211_3480
- /data/data/####/1565003126299_3480
- /data/data/####/1565003126429_3480
- /data/data/####/1565003126482_3480
- /data/data/####/1565003126506_3480
- /data/data/####/1565003126584_3480
- /data/data/####/1565003126605_3480
- /data/data/####/1565003126668_3480
- /data/data/####/1565003127115_3480
- /data/data/####/1565003127264_3480
- /data/data/####/1565003129407_3480
- /data/data/####/1565003130292_3480
- /data/data/####/1565003175634_3823
- /data/data/####/1565003175636_3823
- /data/data/####/1565003175689_3823
- /data/data/####/1565003175694_3823
- /data/data/####/1565003175740_3823
- /data/data/####/1565003175766_3823
- /data/data/####/1565003175814_3823
- /data/data/####/1565003175873_3823
- /data/data/####/1565003176533_3823
- /data/data/####/1565003176777_3823
- /data/data/####/1565003176877_3823
- /data/data/####/1565003177264_3823
- /data/data/####/3120672.dex
- /data/data/####/3120672.dex.flock (deleted)
- /data/data/####/3120672.jar
- /data/data/####/3120805.dex
- /data/data/####/3120805.dex.flock (deleted)
- /data/data/####/3120805.jar
- /data/data/####/3121148.dex
- /data/data/####/3121148.dex.flock (deleted)
- /data/data/####/3121148.jar
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/Archimedes_p1
- /data/data/####/Archimedes_p2
- /data/data/####/Archimedes_p3
- /data/data/####/Archimedes_p4
- /data/data/####/Archimedes_p5
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_cloudcontrol1.xml
- /data/data/####/TDpref_cloudcontrol3.xml
- /data/data/####/TDpref_game.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/TDpref_longtime0.xml.bak
- /data/data/####/TDpref_longtime3.xml
- /data/data/####/TDpref_longtime3.xml.bak
- /data/data/####/TDpref_shorttime.xml
- /data/data/####/TDpref_shorttime0.xml
- /data/data/####/TDpref_shorttime3.xml
- /data/data/####/c0b69a77a5a18837fb3e985f6c61625a.xml
- /data/data/####/c0b69a77a5a18837fb3e985f6c61625a.xml.bak
- /data/data/####/cfd620ac374e96ab6df4f5678aa8ea8d;account_file.xml
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.joygame.strike_preferences.xml
- /data/data/####/com.joygame.strike_sdk_opt.xml
- /data/data/####/iv
- /data/data/####/proc_auxv
- /data/data/####/salt
- /data/data/####/tdid.xml
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/531439560/3121148.jar --oat-fd=35 --oat-location=/data/user/0/<Package>/files/531439560/3121148.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/531462751/3120805.jar --oat-fd=36 --oat-location=/data/user/0/<Package>/files/531462751/3120805.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/531464459/3120672.jar --oat-fd=35 --oat-location=/data/user/0/<Package>/files/531464459/3120672.dex --compiler-filter=speed
- getprop
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- Des-ECB-NoPadding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- Des-ECB-NoPadding
Accesses the ITelephony private interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.