Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Harly.37
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) jndw####.in:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) i.i####.com:443
- TCP(TLS/1.0) t####.te####.com:443
- TCP(TLS/1.2) 2####.85.233.94:443
- TCP(TLS/1.2) 1####.251.1.113:443
- TCP(TLS/1.2) 1####.194.177.94:443
- TCP jndw####.in:443
DNS requests:
- digital####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- i.i####.com
- jndw####.in
- m####.go####.com
- p####.google####.com
- t####.te####.com
- uhh.top####.com
- www.google####.com
HTTP GET requests:
- i.i####.com:443/4WfyaULh.jpg
- i.i####.com:443/6SnqG23h.png
- i.i####.com:443/7IBxg11h.png
- i.i####.com:443/9OO5pq7h.png
- i.i####.com:443/9XZXTdkh.jpg
- i.i####.com:443/Gas6uaTh.jpg
- i.i####.com:443/WQb540Rh.png
- i.i####.com:443/oWn7eEih.jpg
- i.i####.com:443/tKE4Sg1h.jpg
- i.i####.com:443/td2UWlZh.jpg
- jndw####.in:443/jnd/stocK822/api/v1/api.php?get_cat####
- jndw####.in:443/jnd/stocK822/api/v1/api.php?get_sl####
- jndw####.in:443/jnd/stocK822/api/v1/api.php?get_wal####&order=####&count...
- jndw####.in:443/jnd/stocK822/api/v1/api.php?get_wal####&order=A####&coun...
- jndw####.in:443/jnd/stocK822/upload/category/0969-2021-07-28.png
- jndw####.in:443/jnd/stocK822/upload/category/2203-2021-07-28.png
- jndw####.in:443/jnd/stocK822/upload/category/2577-2021-07-28.png
- jndw####.in:443/jnd/stocK822/upload/category/4578-2021-07-28.png
- jndw####.in:443/jnd/stocK822/upload/category/6544-2021-07-28.png
- jndw####.in:443/jnd/stocK822/upload/category/8872-2021-07-28.png
- jndw####.in:443/jnd/stocK822/upload/category/9171-2021-07-28.jpg
- jndw####.in:443/jnd/stocK822/upload/category/9259-2021-07-30.png
- jndw####.in:443/jnd/stocK822/upload/category/9341-2021-07-28.png
HTTP POST requests:
- jndw####.in:443/calthough
- t####.te####.com:443/v0/event
File system changes:
Creates the following files:
- /data/data/####/-1009462355-494815806
- /data/data/####/-175895847-1259618266
- /data/data/####/-4032846211747851341
- /data/data/####/.font3641-3641-0
- /data/data/####/.font3641-3641-0 (deleted)
- /data/data/####/0fe9b559df3e15818830fedfff3d98f0c36d900a0f4dbab....0.tmp
- /data/data/####/0fe9b559df3e15818830fedfff3d98f0c36d900a0f4dbab...1afd.0
- /data/data/####/1004693806-1633839785
- /data/data/####/138bf09535a48e05c051db1512881edfb27039ed8dfa0ec...7f35.0
- /data/data/####/1620375536-1739947327
- /data/data/####/3e9497216091d2108348ed7574d0f0f234b03fde1457fa8....0.tmp
- /data/data/####/3e9497216091d2108348ed7574d0f0f234b03fde1457fa8...ac1f.0
- /data/data/####/5c19e5badeabd64c63595e8022acfa0fe1414d8a6ec2643....0.tmp
- /data/data/####/961370c146af0966_0
- /data/data/####/Cookies-journal
- /data/data/####/LuckyLiveWallpaper.db
- /data/data/####/LuckyLiveWallpaper.db-journal
- /data/data/####/Web Data
- /data/data/####/Web Data-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a7228791147772dd90b3ee24994418f546de74f981e4e09...3d6e.0
- /data/data/####/androidx.work.workdb
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb-shm
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/com.jeremysurrey.luckywallpaper_preferences.xml
- /data/data/####/d07ddc3fdd1a85ee0f13b46bb1807a4cf66729e514d601e....0.tmp
- /data/data/####/d07ddc3fdd1a85ee0f13b46bb1807a4cf66729e514d601e...bc2f.0
- /data/data/####/de989c6daa92aa17acba77be31472b22defe32e4369dc26....0.tmp
- /data/data/####/de989c6daa92aa17acba77be31472b22defe32e4369dc26...5ad9.0
- /data/data/####/dfe6b2497a7513ba_0
- /data/data/####/e72627d709fc601dc8369b031f0f388a9e4b969e26a3058....0.tmp
- /data/data/####/e72627d709fc601dc8369b031f0f388a9e4b969e26a3058...8a09.0
- /data/data/####/f038e94cb33282ab_0
- /data/data/####/f8140da69720a98c54065797ced35158fcdf3a8d4b18e12....0.tmp
- /data/data/####/fc20d2458d388c9b6bd3c76de7a89dc3edbb59e220526d4....0.tmp
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/journal
- /data/data/####/kernel737.dex
- /data/data/####/kernel737.dex.flock (deleted)
- /data/data/####/loader737.dex
- /data/data/####/metrics_guid
- /data/data/####/stock_wallpaper.xml
- /data/data/####/stock_wallpaper.xml.bak
- /data/data/####/tenjinInstallPreferences.xml
- /data/data/####/tenjinInstallPreferences.xml.bak
- /data/data/####/the-real-index
- /data/data/####/user_info.sp.xml
- /data/data/####/user_info.sp.xml.bak
- /data/data/####/webview_data.lock
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5PADDING
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5PADDING
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.