Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SpyMax.124.origin
- Android.SpyMax.72.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.245.193.211:80
- TCP(TLS/1.0) api.themov####.org:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) catalog####.net####.app:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) i####.t####.org:443
- TCP(TLS/1.0) dl.go####.com:443
- TCP(TLS/1.0) content####.google####.com:443
DNS requests:
- api.themov####.org
- catalog####.net####.app
- content####.google####.com
- dl.go####.com
- ed####.me.g####.com
- f####.google####.com
- f####.gst####.com
- i####.t####.org
- up####.google####.com
HTTP HEAD requests:
- 1####.245.193.211/yaarsa/private/yarsap_80541.php
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /data/data/####/.org.chromium.Chromium.0gkKVf
- /data/data/####/.org.chromium.Chromium.9HJxsT
- /data/data/####/000001.dbtmp
- /data/data/####/004ae280b8dda9f2_0
- /data/data/####/1666272890896c46_0
- /data/data/####/1f6e41fbb1ea9ac2_0
- /data/data/####/807106e24b59134f_0
- /data/data/####/931603515e3f8cce_0
- /data/data/####/9683a22af6692405_0
- /data/data/####/979821fec1eb873c_0
- /data/data/####/9af5340af16f0dad_0
- /data/data/####/Anonymous-DexFile@1570278046.vdex
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/CURRENT
- /data/data/####/Configs.xml
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a97a0b2adb788b11_0
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/ba418142021eb873_0
- /data/data/####/c33b8782dafb4ca7_0
- /data/data/####/c50b381c0ee2b9f0_0
- /data/data/####/d249a3c0de5ef910_0
- /data/data/####/d5e0ec63101a9bba_0
- /data/data/####/ee2c87166774803d_0
- /data/data/####/f66ceb56f59cd196_0
- /data/data/####/fd59229ece1201c1_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/k0pk.od4hwuac.v0e1k1hvy3vbtu.xml
- /data/data/####/my_skipes.xml
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/todelete_00cc2280fb6361c4_0_1 (deleted)
- /data/data/####/todelete_0aed70a1a623fb71_0_1 (deleted)
- /data/data/####/todelete_24c20d53d363a7f2_0_1 (deleted)
- /data/data/####/todelete_2af80062a545d095_0_1 (deleted)
- /data/data/####/todelete_2d04792813b315b0_0_1 (deleted)
- /data/data/####/todelete_2dae6b256b49214f_0_1 (deleted)
- /data/data/####/todelete_3054236b8604bcb8_0_1 (deleted)
- /data/data/####/todelete_516f5543df75226a_0_1 (deleted)
- /data/data/####/todelete_5794aac8a962aefc_0_1 (deleted)
- /data/data/####/todelete_5b0dff4f062968fc_0_1 (deleted)
- /data/data/####/todelete_6e8cc046063e2fe3_0_1 (deleted)
- /data/data/####/todelete_72f6cf6f4053f67c_0_1 (deleted)
- /data/data/####/todelete_75f4461c232839cc_0_1 (deleted)
- /data/data/####/todelete_7b30804d0dcdd555_0_1 (deleted)
- /data/data/####/todelete_7c861d8f68ea6137_0_1 (deleted)
- /data/data/####/todelete_866875b70e3ec052_0_1 (deleted)
- /data/data/####/todelete_8bc1b39cfe889f46_0_1 (deleted)
- /data/data/####/todelete_9a62356c234afc2a_0_1 (deleted)
- /data/data/####/todelete_9ade5f0f32fc76b0_0_1 (deleted)
- /data/data/####/todelete_b64eb519287fbb36_0_1 (deleted)
- /data/data/####/todelete_ca7383c9df3bfcb3_0_1 (deleted)
- /data/data/####/todelete_d13b7e68758b8a6c_0_1 (deleted)
- /data/data/####/todelete_ddad3b17810e93d5_0_1 (deleted)
- /data/data/####/todelete_de05e2aa0f7ffc1b_0_1 (deleted)
- /data/data/####/todelete_e8858f9145181181_0_1 (deleted)
- /data/data/####/todelete_f0f783ef37e80f6b_0_1 (deleted)
- /data/data/####/todelete_f9ce617659f79f09_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/data/####/x.2938.tmp
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Uses administrator priveleges.
Gets information about active device administrators.
Gets information about installed apps.
Displays its own windows over windows of other apps.
Requests the system alert window permission.