Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Joker.207.origin
- Android.Joker.835
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) my####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) tomorro####.oss-ap-####.aliy####.com:443
- TCP(TLS/1.0) www.ut####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) 2####.58.204.106:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) ds-####.oss-acc####.aliy####.####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- TCP(TLS/1.2) 2####.58.204.106:443
- TCP(TLS/1.2) connect####.gst####.com:443
- TCP firebas####.crashly####.com:443
DNS requests:
- and####.cli####.go####.com
- and####.google####.com
- android####.go####.com
- app-mea####.com
- connect####.gst####.com
- crashly####.google####.com
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- g####.face####.com
- my####.com
- pla####.googleu####.com
- tomorro####.oss-ap-####.aliy####.com
- www.ut####.com
- x####.oss-acc####.aliy####.com
HTTP GET requests:
- api.face####.com:443/v8.0/1183190622087974/mobile_sdk_gk?fields=####&for...
- api.face####.com:443/v8.0/1183190622087974/model_asset?fields=####&forma...
- api.face####.com:443/v8.0/1183190622087974?fields=####&format=####&sdk=#...
- ds-####.oss-acc####.aliy####.####.com:443/fbhx1
- ds-####.oss-acc####.aliy####.####.com:443/xn3o
- my####.com:443/W4L8J
- tomorro####.oss-ap-####.aliy####.com:443/melt
HTTP POST requests:
- api.face####.com:443/v8.0/1183190622087974/activities
- connect####.gst####.com:443/v1/firelog/legacy/batchlog
- firebas####.google####.com:443/v1/projects/379897622131/namespaces/fireb...
- firebas####.google####.com:443/v1/projects/massege-b1c57/installations
- www.ut####.com:443/xn3o/in
- www.ut####.com:443/xn3o/ti
File system changes:
Creates the following files:
- /data/data/####/.ae1644985839279
- /data/data/####/.ae1644985849874
- /data/data/####/.font3428-3428-0
- /data/data/####/.font3546-3546-0
- /data/data/####/.font3734-3734-0
- /data/data/####/1608138930680.jar
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1F.cls
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1FBeginSession.cls_temp
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1FSessionApp.cls
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1FSessionCrash.cls_temp
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1FSessionDevice.cls
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1FSessionOS.cls
- /data/data/####/620C7DED0231-0001-0D64-B110B587CE1FSessionUser.cls
- /data/data/####/620C7DED023100010D64B110B587CE1F
- /data/data/####/620C7DF201AB-0002-0D64-B110B587CE1FBeginSession.cls_temp
- /data/data/####/620C7DF201AB-0002-0D64-B110B587CE1FSessionApp.cls
- /data/data/####/620C7DF201AB-0002-0D64-B110B587CE1FSessionDevice.cls
- /data/data/####/620C7DF201AB-0002-0D64-B110B587CE1FSessionOS.cls
- /data/data/####/620C7DF201AB-0002-0D64-B110B587CE1FSessionUser.cls
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1F.cls
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1FBeginSession.cls
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1FSessionApp.cls
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1FSessionCrash.cls
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1FSessionDevice.cls_temp
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1FSessionOS.cls
- /data/data/####/620C7DF702EB-0001-0DDA-B110B587CE1FSessionUser.cls_temp
- /data/data/####/620C7DF702EB00010DDAB110B587CE1F
- /data/data/####/620C7DFE02CE-0002-0DDA-B110B587CE1FBeginSession.cls_temp
- /data/data/####/620C7DFE02CE-0002-0DDA-B110B587CE1FSessionApp.cls
- /data/data/####/620C7DFE02CE-0002-0DDA-B110B587CE1FSessionDevice.cls
- /data/data/####/620C7DFE02CE-0002-0DDA-B110B587CE1FSessionOS.cls
- /data/data/####/620C7DFE02CE-0002-0DDA-B110B587CE1FSessionUser.cls_temp
- /data/data/####/620C7E0002BA-0001-0E96-B110B587CE1FBeginSession.cls
- /data/data/####/620C7E0002BA-0001-0E96-B110B587CE1FSessionApp.cls_temp
- /data/data/####/620C7E0002BA-0001-0E96-B110B587CE1FSessionDevice.cls_temp
- /data/data/####/620C7E0002BA-0001-0E96-B110B587CE1FSessionOS.cls
- /data/data/####/Cookies-journal
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/FirebaseAppHeartBeat.xml.bak
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTozNzk4OTc2...2.json
- /data/data/####/PersistedInstallation1239090981tmp
- /data/data/####/PersistedInstallation513554513tmp
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/Yang
- /data/data/####/Yang.dex
- /data/data/####/Yang.dex.flock (deleted)
- /data/data/####/admob.xml
- /data/data/####/androidx.work.workdb
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-shm
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/audience_network.dex
- /data/data/####/audience_network.dex.flock (deleted)
- /data/data/####/bshwai.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.internal.MODEL_STORE.xml
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.datatransport.events
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/com.google.firebase.remoteconfig_legacy_settings.xml
- /data/data/####/com.melt.femessage_preferences.xml
- /data/data/####/crash_marker
- /data/data/####/crashlytics-userlog-620C7E0002BA-0001-0E96-B110...F.temp
- /data/data/####/event0000000000_
- /data/data/####/frc_1;379897622131;android;2f7293d6a4aae19029c4...e.json
- /data/data/####/frc_1;379897622131;android;2f7293d6a4aae19029c4...gs.xml
- /data/data/####/frc_1;379897622131;android;2f7293d6a4aae19029c4...h.json
- /data/data/####/frc_1;379897622131;android;2f7293d6a4aae19029c4...ml.bak
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/jfao
- /data/data/####/jfao.dex
- /data/data/####/jfao.dex.flock (deleted)
- /data/data/####/message_app.db-journal
- /data/data/####/message_app.xml
- /data/data/####/metrics_guid
- /data/data/####/mipf
- /data/data/####/report
- /data/data/####/shield_log_1644985874.json
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about accounts associated with the device (Google, Facebook, etc.).
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Contains Play Store Frosting.