Android.Harly.106

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Harly.22.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(TLS/1.0) up####.google####.com:443
TCP(TLS/1.0) clients####.google####.com:443
TCP(TLS/1.0) datacol####.dt.hic####.com:443
TCP(TLS/1.0) connect####.dbankc####.cn:443

DNS requests:

clients####.google####.com
connect####.dbankc####.cn
datacol####.dt.hic####.com
ed####.me.g####.com
up####.google####.com

File system changes:

Creates the following files:

/app_webview/Default/####/000003.log
/app_webview/Default/####/LOCK
/app_webview/Default/####/LOG
/app_webview/Default/####/MANIFEST-000001
/app_webview/Default/Web Data
/app_webview/Default/Web Data-journal
/app_webview/webview_data.lock
/data/data/####/000001.dbtmp
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3BeginSession.cls_temp
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3BeginSession.json
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3SessionApp.cls_temp
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3SessionApp.json
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3SessionDevice.cls_temp
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3SessionDevice.json
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3SessionOS.cls
/data/data/####/698DF92A0222-0001-0B17-9EAEA50CC7A3SessionOS.json
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3BeginSession.cls_temp
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3BeginSession.json
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3SessionApp.cls_temp
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3SessionApp.json
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3SessionDevice.cls_temp
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3SessionDevice.json
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3SessionOS.cls_temp
/data/data/####/698DF92F004C-0001-0BB7-9EAEA50CC7A3SessionOS.json
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3BeginSession.cls_temp
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3BeginSession.json
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3SessionApp.cls_temp
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3SessionApp.json
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3SessionDevice.cls
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3SessionDevice.json
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3SessionOS.cls_temp
/data/data/####/698DF9390374-0001-0CDC-9EAEA50CC7A3SessionOS.json
/data/data/####/Anonymous-DexFile@1313689098.vdex
/data/data/####/MANIFEST-000001
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/agc_site.xml
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.huawei.agconnect.internal.xml
/data/data/####/com.huawei.agconnect.xml
/data/data/####/com.huawei.appgallery.datastore.xml
/data/data/####/font_unique_name_table.pb
/data/data/####/ha_limit.db-journal
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/openness_Privacy_MY_com.longokuneva.lynnoliam.xml
/data/data/####/openness_global_v2_com.longokuneva.lynnoliam.xml
/data/data/####/openness_latest_upload_time_com.longokuneva.lynnoliam.xml
/data/data/####/sa_c94438a4-a3e1-4e2f-9d52-6659645ee9d1_1770912042617.tap
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/settings.dat
/data/data/####/the-real-index
/data/data/####/userEvent.db-journal
/data/data/####/user_info.sp.xml
/data/data/####/variations_seed_new
/data/data/####/variations_stamp
/data/user_de/####/aaid.xml
/data/user_de/####/aegis.xml
/data/user_de/####/d
/data/user_de/####/m
/data/user_de/####/move_to_de_records.xml
/data/user_de/####/p
/data/user_de/####/s
/data/user_de/####/t
/databases/ha_limit.db
/databases/userEvent.db
/files/.Fabric/####/session_analytics.tap

Miscellaneous:

Executes the following shell scripts:

getprop debug.needle

Loads the following dynamic libraries:

libidoxk

Gets information about phone status (number, IMEI, etc.).

Intercepts notifications.

Attempts to detect sandbox environment.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial