Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Phantom.3
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) dl####.click:9865
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) spo####.app.link:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) o####.spo####.com:443
- TCP(TLS/1.0) spotify####.test####.link:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) spo####.test####.link:443
- TCP(TLS/1.0) spotify####.app.link:443
- TCP(TLS/1.0) spcl####.wg.spo####.com:443
- TCP(TLS/1.0) spo####.link:443
DNS requests:
- app-mea####.com
- dl####.click
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- o####.spo####.com
- spcl####.wg.spo####.com
- spo####.app.link
- spo####.link
- spo####.test####.link
- spotify####.app.link
- spotify####.test####.link
HTTP POST requests:
- dl####.click:9865/mod/api/config
File system changes:
Creates the following files:
- /.oabugaij/.fsgkea
- /cache/view-cache/journal
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/69A2D299039F-0001-0C17-3BD73A53918EBeginSession.cls_temp
- /data/data/####/69A2D299039F-0001-0C17-3BD73A53918ESessionApp.cls_temp
- /data/data/####/69A2D299039F-0001-0C17-3BD73A53918ESessionDevice.cls_temp
- /data/data/####/69A2D299039F-0001-0C17-3BD73A53918ESessionEvent...s_temp
- /data/data/####/69A2D299039F-0001-0C17-3BD73A53918ESessionOS.cls_temp
- /data/data/####/69A2D299039F-0001-0C17-3BD73A53918Ekeys.meta
- /data/data/####/BNC_Server_Request_Queue.xml
- /data/data/####/ESDrop
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo0NDE4ODYxNTE0M...DI.xml
- /data/data/####/PersistedInstallation2729068404458522241tmp
- /data/data/####/PersistedInstallation8309232392098614813tmp
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/app.json
- /data/data/####/aqs.ab46fc1825374a608c15430cbbfb9f22
- /data/data/####/atom_1772278433491
- /data/data/####/atom_1772278438506
- /data/data/####/atom_1772278443507
- /data/data/####/atom_1772278448514
- /data/data/####/atom_1772278453515
- /data/data/####/atom_1772278458516
- /data/data/####/atom_1772278463517
- /data/data/####/atom_1772278468519
- /data/data/####/atom_1772278473520
- /data/data/####/bd1bb2df815c54fae85dafe4f2110d70.0.tmp
- /data/data/####/bd1bb2df815c54fae85dafe4f2110d70.1.tmp
- /data/data/####/branch_referral_shared_pref.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/com.spotify.eventsender.shared.prefs.xml
- /data/data/####/com.spotify.eventsender.shared.prefs.xml.bak
- /data/data/####/comimuwsdk.xml
- /data/data/####/device.json
- /data/data/####/e7be95a4e6b46a2588b59c410ad0d2c6.0.tmp
- /data/data/####/e7be95a4e6b46a2588b59c410ad0d2c6.1.tmp
- /data/data/####/event-sender.db-journal
- /data/data/####/event-sender.db-wal
- /data/data/####/event-sender.db.lck
- /data/data/####/event0000000000
- /data/data/####/event0000000001
- /data/data/####/firebase_session_Y29tLnNwb3RpZnkubGl0ZQ==_data....pb.tmp
- /data/data/####/firebase_session_Y29tLnNwb3RpZnkubGl0ZQ==_setti...pb.tmp
- /data/data/####/firebase_session_Y29tLnNwb3RpZnkubGl0ZTpyZW1vdG...pb.tmp
- /data/data/####/frc_1;44188615143;android;8ec7f652be908a4e817d4...e.json
- /data/data/####/frc_1;44188615143;android;8ec7f652be908a4e817d4...gs.xml
- /data/data/####/frc_1;44188615143;android;8ec7f652be908a4e817d4...h.json
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/journal.bkp (deleted)
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/libjiagu_64.so
- /data/data/####/os.json
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/report
- /data/data/####/session.json
- /data/data/####/spotify_preferences.xml
- /data/data/####/start-time
- /data/data/####/userlog.tmp
- /data/misc/####/primary.prof
- /databases/com.google.android.datatransport.events
- /databases/event-sender.db
- /databases/event-sender.db-shm
- /databases/event-sender.db-wal
- /databases/google_app_measurement.db
- /files/.crashlytics.v3/####/userlog
- /files/comimuwsdk.event
- /files/google_app_measurement.db
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
- /storage/emulated/####/18c860bc-9409-480e-b389-bec3727a5376 (deleted)
- /storage/emulated/####/4992d6a2-faa4-4b4b-be15-36cbfa2747f7 (deleted)
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu_64
Uses special library to hide executable bytecode.
