Android.Clipper.Shibai.78

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Clipper.Shibai.6

Network activity:

Connects to:

UDP(DNS) 1####.29.29.29:53
UDP(DNS) 1####.76.76.76:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) zz####.cn:80
TCP(HTTP/1.1) 1####.0.0.1:32925
TCP(TLS/1.0) 5tuz####.com:443
TCP(TLS/1.0) m660####.com:443
UDP 3.0.7####.112:8586
UDP 6506d86####.cloudte####.com:8005
UDP 6506d86####.ali####.com:8003

DNS requests:

5tuz####.com
6506d86####.ali####.com
6506d86####.cloudte####.com
m660####.com
zz####.cn

HTTP GET requests:

5tuz####.com:443/skfmmxs/hsyouu.txt
zz####.cn/images/256/20240828/16/35/e0bcfd15aef9191e6802503cf158458b.jpg
zz####.cn/images/256/img2/2e94a2fc0a44f66c7e3d4beec64ace3d.png
zz####.cn/images/256/img2/2f603c7d462340862da4e40ef331a46d.png
zz####.cn/images/256/img2/312810eff246fffd311c14e3a88a07c6.png
zz####.cn/images/256/img2/80572de9e24ec32e8417cb7f3668a5fd.png
zz####.cn/images/256/img2/85de2d8cab1eab4e300cd88fe6db6e1c.png
zz####.cn/images/256/img2/9fd517986b3ff597703d6bce830b3423.png
zz####.cn/images/256/img2/b0934c43126cb836ea82ebe78d56a75d.png
zz####.cn/images/256/img2/c2999217f16c5a886e6f4df3d98ce5ca.png
zz####.cn/images/256/img2/d0f1a8a9beb1aaec00c5ecce8345282c.png
zz####.cn/images/256/u/1012/5463/11/head/530c978a1fe2603312b6c56986563b8...
zz####.cn/images/256/u/1320/0808/87/head/08bab389c582a279c9ea1c84aa2ca63...
zz####.cn/images/256/u/1434/6289/63/head/e27247bee401401d09ce4fb4fb95b5b...
zz####.cn/images/256/u/1662/4302/2/head/0b51317a054d65a2152450d46c3eaeb8...
zz####.cn/images/256/u/1960/1615/5/head/c2dfedf54391e380f0376740195ed89a...
zz####.cn/images/256/u/4925/0696/3/head/52d8bf3085c67d98e87de4fbeb8dae66...

HTTP POST requests:

m660####.com:443/api/D9P7tDV2/HHd0ME1I
m660####.com:443/api/index/install
m660####.com:443/api/index/record

File system changes:

Creates the following files:

/data/data/####/01277368e9072aea9faaacd323edf8b0.jpg
/data/data/####/01277368e9072aea9faaacd323edf8b0.jpg_tmp
/data/data/####/068aea865e46fe854922fcfa716436988cb2edd0
/data/data/####/1687638233c901cee02eef734706b5d3.jpg
/data/data/####/1687638233c901cee02eef734706b5d3.jpg_tmp
/data/data/####/1810a6a844cd133938469123fc71949c.png
/data/data/####/1810a6a844cd133938469123fc71949c.png_tmp
/data/data/####/1cfb37dea9721d25143e00ff585af6169a91fd58
/data/data/####/335d278417743125ac05dc26032e6cf4a19c0ace
/data/data/####/373a83ab33315421c445554a31b05a9e9122af19
/data/data/####/518afbb487509437449a35ffa0f9a2d02ed15392
/data/data/####/5a551daf3d51192724478ed516c3602fe7474765
/data/data/####/5dbd236bebc1e2479b9dd915ff0e8b7a.png
/data/data/####/5dbd236bebc1e2479b9dd915ff0e8b7a.png_tmp
/data/data/####/5f5dd003eaa24005e7ab14db902f3efb7ca955ae
/data/data/####/5ffc79cf5681441fe86a3f18e8990894967d717c
/data/data/####/602461d9048c0d2a64afb2f7ee650a8f.png
/data/data/####/602461d9048c0d2a64afb2f7ee650a8f.png_tmp
/data/data/####/63f4f4517d6202a86b8eaacd916538c9.png
/data/data/####/63f4f4517d6202a86b8eaacd916538c9.png_tmp
/data/data/####/67c61e038ddd1ae2d3d4bc1942252b12.jpg
/data/data/####/67c61e038ddd1ae2d3d4bc1942252b12.jpg_tmp
/data/data/####/6b6195ba1a69b3d10673e750c52f17f20834284e
/data/data/####/6e2a0233c5f42c4fd047087a83944944ba8ff3df
/data/data/####/70d338766ae20514eca6f5d387445bc8d553f73f
/data/data/####/82b75fab324a170732d4ce48b94b8546.png
/data/data/####/82b75fab324a170732d4ce48b94b8546.png_tmp
/data/data/####/938d633a8bb3cd3daadba4b418225c07.jpg
/data/data/####/938d633a8bb3cd3daadba4b418225c07.jpg_tmp
/data/data/####/9bbb21644c6736ad1826a3b5a453bc43.png
/data/data/####/9bbb21644c6736ad1826a3b5a453bc43.png_tmp
/data/data/####/Anonymous-DexFile@1212438159.vdex
/data/data/####/Anonymous-DexFile@3212794804.vdex
/data/data/####/FM_config.xml
/data/data/####/FlutterSharedPreferences.xml
/data/data/####/a4b1a80f9aba931ce6fb5ffce42af954.jpg
/data/data/####/a4b1a80f9aba931ce6fb5ffce42af954.jpg_tmp
/data/data/####/a81a9c28c8949b140bcbf32f93769423.png
/data/data/####/a81a9c28c8949b140bcbf32f93769423.png_tmp
/data/data/####/app_DgcBob5A1
/data/data/####/b0b40e701f6de6035572bdb70d6462ed9bbc7f13
/data/data/####/b30e96091eae9c63cd040035b6c85a8fce45d8da
/data/data/####/b4b37c5c78dc68a5c062d0ab94bba814.png
/data/data/####/b4b37c5c78dc68a5c062d0ab94bba814.png_tmp
/data/data/####/b80ff176bd0569eba3c435a1d27d7a442089eb0b
/data/data/####/classes.dex
/data/data/####/classes.dex.cur.prof
/data/data/####/classes.vdex
/data/data/####/classes2.dex
/data/data/####/classes2.dex.cur.prof
/data/data/####/classes2.vdex
/data/data/####/classes3.dex
/data/data/####/classes3.dex.cur.prof
/data/data/####/classes3.vdex
/data/data/####/dbf0b59707243688b50dd4379eb13b4e17ec7cec
/data/data/####/dev_id.xml.xml
/data/data/####/device.xml.xml
/data/data/####/e290c573e0efc9a3f8857382e6e4388caa53027a
/data/data/####/e557f3dc01c7b683f89646c623718a96.jpg
/data/data/####/e557f3dc01c7b683f89646c623718a96.jpg_tmp
/data/data/####/e7fbca1c3ca3f4a30b2fa2b6efb43847.png
/data/data/####/e7fbca1c3ca3f4a30b2fa2b6efb43847.png_tmp
/data/data/####/eb83c3d9e59b3a011b0253a01eed781a4ccb10df
/data/data/####/f17ec4e6286c3fb2ab7c368367a730d9712a1a4d
/data/data/####/f59686a0f242f2bf17c8b883fb87d1103a58fa06
/data/data/####/fac58f82d4d533e1a8216891d2572215.jpg
/data/data/####/fac58f82d4d533e1a8216891d2572215.jpg_tmp
/data/data/####/kwb
/data/data/####/kwcloud_v4_fae60e487fec5ee35f42e07d9ad7cee5
/data/data/####/libagora-ffmpeg.so
/data/data/####/libagora-rtc-sdk.so
/data/data/####/libagora-soundtouch.so
/data/data/####/libapp.so
/data/data/####/libdownloadproxy.so
/data/data/####/libflutter.so
/data/data/####/libgifimage.so
/data/data/####/libimage_processing_util_jni.so
/data/data/####/libimagepipeline.so
/data/data/####/libkiwi.so
/data/data/####/libliteavsdk.so
/data/data/####/libnetmobsec-4.4.7.so
/data/data/####/libsentry-android.so
/data/data/####/libsentry.so
/data/data/####/libtpcore-master.so
/data/data/####/libtpthirdparties-master.so
/data/data/####/libtxffmpeg.so
/data/data/####/libtxsoundtouch.so
/data/data/####/libwebp.so
/data/data/####/libwebpimage.so
/data/data/####/liteImageCache.txt
/data/data/####/profileInstalled

Miscellaneous:

Executes the following shell scripts:

/system/bin/su

Loads the following dynamic libraries:

libToYHiimpsqaivax
libapp
libkiwi

Uses elevated priveleges.

Accesses the ITelephony private interface.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial