Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.18064
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) m####.gst####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) 2####.85.233.138:443
- TCP(TLS/1.0) 1####.177.14.94:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) 2####.85.233.102:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) m####.go####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- TCP(TLS/1.2) p####.google####.com:443
- TCP(TLS/1.2) 1####.177.14.94:443
- TCP(TLS/1.2) www.go####.com:443
- UDP gmscomp####.google####.com:443
- UDP rr2---s####.g####.com:443
- UDP p####.google####.com:443
DNS requests:
- and####.a####.go####.com
- and####.cli####.go####.com
- and####.google####.com
- clie####.go####.com
- digital####.google####.com
- f####.gst####.com
- gmscomp####.google####.com
- m####.go####.com
- m####.gst####.com
- p####.google####.com
- pla####.googleu####.com
- rr2---s####.g####.com
- rr9---s####.g####.com
- ssl.gst####.com
- www.go####.com
- www.google####.com
File system changes:
Creates the following files:
- /data/data/####/0055e57f1e510ea5_0
- /data/data/####/00bff0c661292c35_0
- /data/data/####/00bff0c661292c35_1
- /data/data/####/01944240887bbc8c_0
- /data/data/####/01944240887bbc8c_1
- /data/data/####/0438dc8034130bf8_0
- /data/data/####/158197ce1cc9a8a1_0
- /data/data/####/158197ce1cc9a8a1_1
- /data/data/####/1973a381f44f73cd_0
- /data/data/####/1ed99305dfabffd6_0
- /data/data/####/251721d7b63a8a47_0
- /data/data/####/26a23ad60592269b_0
- /data/data/####/270d4fa0a0080b35_0
- /data/data/####/2c4992bc2d0c32b7_0
- /data/data/####/2ceac46d957bf34c_0
- /data/data/####/33bc45921ca40763_0
- /data/data/####/3711aab81f2be3f8_0 (deleted)
- /data/data/####/3784ec2d336e5e5f_0
- /data/data/####/3d561aa632b2eb93_0
- /data/data/####/3d9a0208a038ba6d_0 (deleted)
- /data/data/####/46bb9f58c4c4e64a_0
- /data/data/####/50602f03eec65311_0
- /data/data/####/5218d36b1b4ccfa8_0
- /data/data/####/5ca50924ce3c5c59_0
- /data/data/####/5ca50924ce3c5c59_0 (deleted)
- /data/data/####/7022f3dcf3c2b3c3_0
- /data/data/####/71c5751c2c7ad136_0
- /data/data/####/71c5751c2c7ad136_1
- /data/data/####/728de75dc3cc000a_0
- /data/data/####/779a90c3587d0e39_0
- /data/data/####/779a90c3587d0e39_1
- /data/data/####/78288c5c025e5d6b_0
- /data/data/####/78d408b4ae4f844d_0
- /data/data/####/7f66b3580abfc2ea_0
- /data/data/####/8224c0c17ea561cf_0
- /data/data/####/8237e9898a750adc_0
- /data/data/####/827c9b72e270ac82_0
- /data/data/####/844aecc043c5bcfe_0
- /data/data/####/86b42d3b7f479117_0
- /data/data/####/8a8a5d49f4e0ffc9_0
- /data/data/####/8e0635b8e379af6c_0
- /data/data/####/90ec8d113e68d251_0 (deleted)
- /data/data/####/91eb0d1283b124a4_0
- /data/data/####/91eb0d1283b124a4_1
- /data/data/####/93754b2cd16b0cec_0
- /data/data/####/9494fb2ca7bee1d4_0
- /data/data/####/9eb4c43f79616a56_0
- /data/data/####/9eb4c43f79616a56_1
- /data/data/####/AjFQvadNRQtZqf.dex
- /data/data/####/AjFQvadNRQtZqf.dex.flock (deleted)
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/Databases.db-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/Nsiin.dex
- /data/data/####/Nsiin.dex.flock (deleted)
- /data/data/####/QuotaManager-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a17e0c0da92106b0_0
- /data/data/####/a1e6044d6a453bc5_0
- /data/data/####/a1e6044d6a453bc5_1
- /data/data/####/a6d47f1734da336f_0 (deleted)
- /data/data/####/a8d17d65e7985a37_0
- /data/data/####/ac952f81ac50ea31_0
- /data/data/####/ad40f92cb71a5cb4_0
- /data/data/####/ad40f92cb71a5cb4_1
- /data/data/####/addeb473051573f4_0
- /data/data/####/b88a19c1283ae3fc_0
- /data/data/####/c1c0391254b4190c_0
- /data/data/####/c441e724cd23d5e8_0
- /data/data/####/cdb653716792ec96_0 (deleted)
- /data/data/####/cebafba195107f36_0 (deleted)
- /data/data/####/com.hoqtu_preferences.xml
- /data/data/####/d6f7e8ce8d0fcc09_0
- /data/data/####/dccf708022213bcd_0
- /data/data/####/dfb04b550f94b669_0
- /data/data/####/e0bc81ce27af815c_0
- /data/data/####/ee2d6abdc24fd587_0
- /data/data/####/f731865de72ad9ea_0
- /data/data/####/f731865de72ad9ea_1
- /data/data/####/f78ab4828ba30102_0
- /data/data/####/fb373ff277c4dca9_0
- /data/data/####/fb373ff277c4dca9_1
- /data/data/####/hTOHAjGFFXR.dex
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/qdpjSoMAzPuW.dex
- /data/data/####/qdpjSoMAzPuW.dex.flock (deleted)
- /data/data/####/the-real-index
- /data/misc/####/primary.prof
Miscellaneous:
Gets information about network.
Displays its own windows over windows of other apps.