Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.18064
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) 74.1####.131.101:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) poli####.go####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) clie####.go####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) 64.2####.165.94:443
- TCP(TLS/1.0) p####.l.go####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 74.1####.131.101:443
- TCP(TLS/1.2) clie####.go####.com:443
- TCP(TLS/1.2) 1####.177.14.105:443
- TCP(TLS/1.2) 64.2####.165.94:443
- UDP rr2---s####.g####.com:443
- UDP and####.google####.com:443
DNS requests:
- a####.go####.com
- and####.google####.com
- clie####.go####.com
- f####.gst####.com
- gmscomp####.google####.com
- p####.go####.com
- poli####.go####.com
- rr16---####.g####.com
- rr2---s####.g####.com
- ssl.gst####.com
- www.go####.com
- www.google-####.com
- www.googlet####.com
- www.gst####.com
File system changes:
Creates the following files:
- /data/data/####/02bd4343164e3790_0
- /data/data/####/0438dc8034130bf8_0
- /data/data/####/06230862a1973b8b_0
- /data/data/####/0a51f9128f44eb21_0
- /data/data/####/0cb255b0776af324_0
- /data/data/####/1551f6ce48ddf59d_0
- /data/data/####/1601551bb2ff3043_0
- /data/data/####/1601551bb2ff3043_1
- /data/data/####/199040f7b05077e2_0
- /data/data/####/1a223d24dc4d1626_0 (deleted)
- /data/data/####/1aac33fd5e7456ea_0
- /data/data/####/21758ee95b6e05ee_0
- /data/data/####/240036f9ce98dc62_0
- /data/data/####/240036f9ce98dc62_1
- /data/data/####/251721d7b63a8a47_0
- /data/data/####/25fb00d8b024508f_0
- /data/data/####/261b1f0057dbd074_0
- /data/data/####/278efebd2884a2ab_0
- /data/data/####/3d2dcfd453438bd3_0
- /data/data/####/3f4f2e3b8274261a_0
- /data/data/####/45653a3eb7499f48_0
- /data/data/####/4656a7cd51f3fd38_0
- /data/data/####/4de4ea5b5ef9a2da_0
- /data/data/####/569dd8eac15df6ae_0
- /data/data/####/5c0750770ec46056_0
- /data/data/####/5ca50924ce3c5c59_0
- /data/data/####/5ca50924ce3c5c59_0 (deleted)
- /data/data/####/5e098c32803984fd_0
- /data/data/####/5ff3322bc0576a33_0
- /data/data/####/73d8cd42377a2cc9_0
- /data/data/####/73d8cd42377a2cc9_1
- /data/data/####/89d001276eda302a_0
- /data/data/####/8fdb679a31466eff_0
- /data/data/####/8fdb679a31466eff_1
- /data/data/####/93754b2cd16b0cec_0
- /data/data/####/99f6e6c7fa0274fd_0
- /data/data/####/9b6428ea95750750_0
- /data/data/####/9b6428ea95750750_1
- /data/data/####/9bb673caaa057bc8_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/XzhHznw.dex
- /data/data/####/XzhHznw.dex.flock (deleted)
- /data/data/####/a1487b669f9ed134_0
- /data/data/####/a1487b669f9ed134_1
- /data/data/####/a4685011084915b5_0
- /data/data/####/a4942a0a6de74efe_0
- /data/data/####/a4942a0a6de74efe_1
- /data/data/####/a5a191500298a2b7_0
- /data/data/####/a5a191500298a2b7_1
- /data/data/####/a860e8610df27291_0
- /data/data/####/aa0ff4f81e643730_0
- /data/data/####/ab9888238a22f724_0
- /data/data/####/ac952f81ac50ea31_0
- /data/data/####/b54ef3012f6720a9_0
- /data/data/####/b54ef3012f6720a9_1
- /data/data/####/c0ab3fe3c70525d1_0
- /data/data/####/c0b4d93251d06538_0
- /data/data/####/c0b4d93251d06538_1
- /data/data/####/com.lrogcbraj_preferences.xml
- /data/data/####/dfb04b550f94b669_0
- /data/data/####/e4fe337f4caf8305_0
- /data/data/####/e4fe337f4caf8305_1
- /data/data/####/e6a3c78b50808f04_0
- /data/data/####/eddadac7c0dc2b6c_0
- /data/data/####/ef4583423486b9e4_0
- /data/data/####/f03627828e960b6a_0 (deleted)
- /data/data/####/f5ed83c782025131_0
- /data/data/####/f5ed83c782025131_1
- /data/data/####/ihSOMz.dex
- /data/data/####/ihSOMz.dex.flock (deleted)
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/zvUnjKJg.dex
- /data/data/####/zvUnjKJg.dex.flock (deleted)
- /data/misc/####/primary.prof
Miscellaneous:
Gets information about network.
Displays its own windows over windows of other apps.