Technical information
Malicious functions:
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) metar11####.fireba####.com:443
DNS requests:
- firebas####.google####.com
- metar11####.fireba####.com
File system changes:
Creates the following files:
- /data/app/####/base.apk
- /data/data/####/AppPrefs.xml
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo3NTM3NzQ0NDYzO...pb.tmp
- /data/data/####/PersistedInstallation4162334681954848151tmp
- /data/data/####/PersistedInstallation6940314532277379548tmp
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/app_cache_prefs.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.firebase.messaging.xml
- /data/data/####/generatefid.lock
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/misc/####/primary.prof
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Loads the following dynamic libraries:
- libmedia_codec_pggwsfi
Displays its own windows over windows of other apps.
Attempts to detect sandbox environment.