Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.349.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.56.123.43:80
- TCP(HTTP/1.1) 1####.92.163.136:8088
- TCP(HTTP/1.1) bsl####.ottb####.cn.####.com:80
- TCP(HTTP/1.1) ksyun####.ottb####.cn.####.com:80
- TCP(HTTP/1.1) ads####.k####.com:80
- TCP(HTTP/1.1) 4####.93.6.122:80
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) rr12---####.g####.com:443
- TCP(TLS/1.0) rr7---s####.g####.com:443
- TCP(TLS/1.0) 2####.85.233.101:443
- TCP(TLS/1.0) 1####.177.14.94:443
- TCP(TLS/1.2) 1####.177.14.104:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 64.2####.164.138:443
- TCP(TLS/1.2) 2####.85.233.101:443
- UDP 1####.194.163.20:443
- UDP and####.google####.com:443
DNS requests:
- ads####.k####.com
- and####.google####.com
- bsl####.ottb####.cn
- gmscomp####.google####.com
- ksyun####.ottb####.cn
- rr12---####.g####.com
- rr7---s####.g####.com
- rr9---s####.g####.com
HTTP GET requests:
- ads####.k####.com/VideoAdSysApi/Booslink/v1/currentAd?appid=####&brand=#...
- ads####.k####.com/VideoAdSysApi/Booslink/v1/pasterAd?ad_amount=####&appi...
- bsl####.ottb####.cn.####.com/files/dex/yt3-202405300942.apk
- ksyun####.ottb####.cn.####.com/files/dex/ad-main-202403151038.dex
- ksyun####.ottb####.cn.####.com/files/dex/ka-v2-202403011812.apk
- ksyun####.ottb####.cn.####.com/files/dex/yt3-202405300942.apk
File system changes:
Creates the following files:
- /data/data/####/adc.xml
- /data/data/####/gs_main.dex
- /data/data/####/gs_main.dex.flock (deleted)
- /data/data/####/ka2.apk
- /data/data/####/ka2.dex
- /data/data/####/ka2.dex.flock (deleted)
- /data/data/####/yt3.apk
- /data/data/####/yt3.apk.tmp (deleted)
- /data/data/####/yt3.dex
- /data/data/####/yt3.dex.flock (deleted)
Miscellaneous:
Executes the following shell scripts:
- sync
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
