Android.Spy.5214

Technical information

Malicious functions:

Sends data about device contacts to a remote host.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) realtim####.carrotq####.io:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) se####.io:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) in####.appsf####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) s####.j####.online:443
TCP(TLS/1.0) firebas####.crashly####.com:443
TCP(TLS/1.0) convers####.appsf####.com:443
TCP(TLS/1.0) reg####.app-mea####.com:443
TCP(TLS/1.0) d####.appsf####.com:443
TCP(TLS/1.0) gc####.appsf####.com:443
TCP(TLS/1.0) cdn-set####.appsfly####.com:443
TCP(TLS/1.0) mo####.biggest####.com:443
TCP(TLS/1.0) laun####.appsf####.com:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) app-mea####.com:443
UDP firebas####.google####.com:443
TCP api.carrotq####.io:443
UDP s####.voipbu####.com:3478
TCP s####.j####.online:443
UDP n####.viag####.ca:3478
UDP s####.l.go####.com:19302
UDP s####.callwi####.com:3478
TCP patronm####.zen####.com:443

DNS requests:

174.179.250.####.arpa
2.and####.p####.####.org
api.carrotq####.io
app-mea####.com
cdn-set####.appsfly####.com
convers####.appsf####.com
d####.appsf####.com
firebas####.crashly####.com
firebas####.google####.com
firebas####.google####.com
firebas####.google####.com
gc####.appsf####.com
gmscomp####.google####.com
go####.com
in####.appsf####.com
juicys####.com
juicуs####.ru
juicуs####.ru.8.####.8
laun####.appsf####.com
mo####.biggest####.com
n####.viag####.ca
patronm####.zen####.com
realtim####.carrotq####.io
reg####.app-mea####.com
s####.callwi####.com
s####.j####.online
s####.juicys####.com
s####.l.go####.com
s####.voipbu####.com
se####.io
www.go####.com
www.google####.com

HTTP GET requests:

cdn-set####.appsfly####.com:443/android/v1/87c0f81a9b9f9592209dfc4cf2cfd...
firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:712342928...
gc####.appsf####.com:443/install_data/v4.0/<Package>?devkey=####&device_...
realtim####.carrotq####.io/websocket/ping/conversation_typing.42518.1334...
www.go####.com:443/

HTTP POST requests:

convers####.appsf####.com:443/api/v6.6/androidevent?app_id=####&buildnum...
d####.appsf####.com:443/v1.0/android/<Package>?af_sig=####&sdk_version=#...
firebas####.google####.com:443/v1/firelog/legacy/batchlog
firebas####.google####.com:443/v1/projects/712342928676/namespaces/firep...
firebas####.google####.com:443/v1/projects/big5-fintech/installations
in####.appsf####.com:443/api/v6.6/androidevent?app_id=####&buildnumber=#...
laun####.appsf####.com:443/api/v6.6/androidevent?app_id=####&buildnumber...
mo####.biggest####.com:443/Command/Auth/DeviceCheckIn
mo####.biggest####.com:443/Command/Profile/SaveFingerprint
mo####.biggest####.com:443/Command/Telemetry/Device
se####.io:443/api/1463162/envelope/

File system changes:

Creates the following files:

/data/data/####/.
/data/data/####/.
/data/data/####/.
/data/data/####/. .flock (deleted)
/data/data/####/.
/data/data/####/. .flock (deleted)
/data/data/####/000003.log
/data/data/####/000004.log
/data/data/####/000005.bak
/data/data/####/000005.ldb
/data/data/####/000006.log
/data/data/####/000008.log
/data/data/####/000009.bak
/data/data/####/000009.ldb
/data/data/####/000010.log
/data/data/####/000013.log
/data/data/####/000014.bak
/data/data/####/000014.ldb
/data/data/####/000017.bak
/data/data/####/000017.ldb
/data/data/####/2b95a2f7-1ece-452f-8955-a767442ff93b.envelope
/data/data/####/47e9ce1b-76d4-460c-877e-6ef9d948e26b.envelope
/data/data/####/639C823A021F00010E5129B62EE30F96keys.meta
/data/data/####/7dacd9d8-5917-433c-8780-35bc31aac370.envelope
/data/data/####/9e2f8965a60e2dba1263afc1efcd54d7.0.tmp
/data/data/####/9e2f8965a60e2dba1263afc1efcd54d7.1
/data/data/####/9e2f8965a60e2dba1263afc1efcd54d7.1.tmp
/data/data/####/CURRENT
/data/data/####/Cookies-journal
/data/data/####/Databases.db-journal
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo3MTIzNDI5Mjg2N...Ix.xml
/data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo3MTIzNDI5Mjg2N...ml.bak
/data/data/####/FirebasePerfSharedPrefs.xml
/data/data/####/INSTALLATION
/data/data/####/LOCK
/data/data/####/LOG
/data/data/####/LoggerDb-journal (deleted)
/data/data/####/MANIFEST-000001
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo3MTIzNDI5...x.json
/data/data/####/PersistedInstallation1011566618tmp
/data/data/####/PersistedInstallation624597764tmp
/data/data/####/QuotaManager-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/ae54d76eac1ee9e0_0
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/appsflyer-data.xml
/data/data/####/appsflyer-data.xml.bak
/data/data/####/carrot_sdk.db-journal (deleted)
/data/data/####/com.biggestfive.patron.xml
/data/data/####/com.biggestfive.patron_preferences.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/crashlytics-userlog-639C8235037100010DA129B62EE30F96.temp
/data/data/####/crashlytics-userlog-639C823A021F00010E5129B62EE30F96.temp
/data/data/####/frc_1;712342928676;android;0e3080be9746fdec4907...e.json
/data/data/####/frc_1;712342928676;android;0e3080be9746fdec4907...gs.xml
/data/data/####/frc_1;712342928676;android;0e3080be9746fdec4907...h.json
/data/data/####/frc_1;712342928676;android;0e3080be9746fdec4907...ml.bak
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/initialization_marker (deleted)
/data/data/####/io.carrotquest.utils.xml
/data/data/####/io.carrotquest.utils.xml.bak
/data/data/####/journal.bkp (deleted)
/data/data/####/journal.tmp
/data/data/####/juicyscore_mb.html
/data/data/####/juicyscore_mb.html.tmp
/data/data/####/metrics_guid
/data/data/####/proc_auxv
/data/data/####/report
/data/data/####/session.json
/data/data/####/start-time
/data/data/####/the-real-index
/data/data/####/zendesk.conversationkit.xml
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/netcfg
ping -c 1 google.com

Loads the following dynamic libraries:

libsentry
libsentry-android

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Gets information about sent/received SMS.

Sample from Google Play Store.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial