Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.108.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) dc.g####.com:80
- TCP(HTTP/1.1) pp.showg####.com.####.com:80
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) lp.xl####.com:443
- TCP(TLS/1.0) app-api####.adenjo####.com:443
- TCP(TLS/1.0) rr13---####.g####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.2) p####.google####.com:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- app-api####.adenjo####.com
- connect####.gst####.com
- dc.g####.com
- dct.g####.com
- gmscomp####.google####.com
- lp.xl####.com
- m####.go####.com
- p####.google####.com
- pla####.google####.com
- pp.showg####.com
- rr13---####.g####.com
HTTP GET requests:
- dc.g####.com/d/bcc/v2/o/630746a59b8c3ca8af384c650c01d2fb
- dc.g####.com/d/bcc/v2/s/26d8fdf325918fc58da889a131b9ffde
- dc.g####.com/d/t/290/r/640feb095bfe6.t
- dc.g####.com/loadable/r/6294893ab7797.l
- pp.showg####.com.####.com/mm
HTTP POST requests:
- app-api####.adenjo####.com:443/v1/os/get
- app-api####.adenjo####.com:443/v1/ts/get
- lp.xl####.com:443/v1/ls/get
File system changes:
Creates the following files:
- /data/data/####/002bdfab0e8debb0c1a1740cc4dca167
- /data/data/####/02260edcc5f2392033f793d048f4f7ad76c4.dex
- /data/data/####/02260edcc5f2392033f793d048f4f7ad76c4.dex.flock (deleted)
- /data/data/####/02260edcc5f2392033f793d048f4f7ad76c4.jar
- /data/data/####/0b32636f21ace6e1ded46bb6fdd5961c
- /data/data/####/0fc4e9efde1f7266b5296cfa83393258
- /data/data/####/180de10f89c71677ddbfd6ee0801fc7e
- /data/data/####/2b7f421ca26b9430ed8b970acb07af9718f184414dd0245...57fd7e
- /data/data/####/417763fda617744a324747f1cd1d94cf.d
- /data/data/####/45586aa387299b6a39e8ea1e21518a14
- /data/data/####/671e051169632b5e28afc6d4e2411e49
- /data/data/####/72dad664d404a82514148aa4a3fe0954
- /data/data/####/74cbd0aa070921fe25f84f85653b9281
- /data/data/####/7b99fda8daa445da951b5b0502a53a9a.dex
- /data/data/####/7b99fda8daa445da951b5b0502a53a9a.dex.flock (deleted)
- /data/data/####/7b99fda8daa445da951b5b0502a53a9a.jar
- /data/data/####/7ed4bbfa0d0e4e6f371df85570217a63
- /data/data/####/9032f6b606412ab9267eec28c20fc561
- /data/data/####/925cbadc567cead7ed600ca7df194bf1.d
- /data/data/####/9edc12c92461295d5695d94019d870e0.d
- /data/data/####/9fdaaf736402200e12378880a8cb9838
- /data/data/####/af43976639eac6ef98d9dc08f7667e9a
- /data/data/####/b327534d49856d93cf529c508e43b8a3
- /data/data/####/b773cb538abb36dde9499cd8cc41a2da
- /data/data/####/d49fda0f0b3278314984140e1371a968
- /data/data/####/e4106c73f385ec35c0326c1acbdf0718
- /data/data/####/e840df10b1b04da4a89a7eca55143d52.dex
- /data/data/####/e840df10b1b04da4a89a7eca55143d52.dex (deleted)
- /data/data/####/e840df10b1b04da4a89a7eca55143d52.dex.flock (deleted)
- /data/data/####/e840df10b1b04da4a89a7eca55143d52.jar
- /data/data/####/e8a39f879b4c40c2ae4276a4229b4659
- /data/data/####/ebe5d9b4245248fb959854fb4e90be30
- /data/data/####/ed16ba23ccf3a36e64df6436d5a568ef
- /data/data/####/ul8g14y48j7zxhr3qy03
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES
- AES-CBC-NoPadding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-NoPadding
- RSA-ECB-PKCS1Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).