Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.1493.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- TCP(???) ifco####.io:443
- UDP(???) content####.google####.com:443
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) otpt####.world:8443
- TCP(HTTP/1.1) otpt####.world:8444
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) eu5.fusions####.hu####.com:443
- TCP(TLS/1.0) content####.google####.com:443
DNS requests:
- clients####.google####.com
- content####.google####.com
- ed####.me.g####.com
- eu5.fusions####.hu####.com
- ifco####.io
- otpt####.world
- up####.google####.com
HTTP GET requests:
- otpt####.world:8443/control?sessionId=####
- otpt####.world:8444/data?sessionId=####
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /data/data/####/.org.chromium.Chromium.JkcP8c
- /data/data/####/.org.chromium.Chromium.z7PdxA
- /data/data/####/0e4caf4021d2a3ca_0
- /data/data/####/1783972999d5c7d7_0
- /data/data/####/1d5275f6e630e201_0
- /data/data/####/25052b1931ec4c51_0
- /data/data/####/3af4aafb8a72ef71_0
- /data/data/####/4101b43c51afdd37_0
- /data/data/####/47c0a7c5d5f99e68_0
- /data/data/####/4f8be49dd027ef6b_0
- /data/data/####/555224aa331e1a65_0
- /data/data/####/580cc2c96a6fe702_0
- /data/data/####/59fd6d5fa3f789cd_0
- /data/data/####/63b3c6dc1f701f59_0
- /data/data/####/6af7638f4e8ebebe_0
- /data/data/####/6c01f9dbc411c542_0
- /data/data/####/7290ac99fc046237_0
- /data/data/####/75ea43d494f1aa63_0
- /data/data/####/8f6dfb0e630529cb_0
- /data/data/####/94b0e9086ec7c4a8_0
- /data/data/####/9b4fe87474adbcb1_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/GP.txt
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a839dc3a4221d12d_0
- /data/data/####/a9a13108b7ebda8c_0
- /data/data/####/aace3276f91623bb_0
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/b19f53321ad3298c_0
- /data/data/####/b1abfe4a53b1b3be_0
- /data/data/####/b7a274b8fefbcc44_0
- /data/data/####/bc61365a576703a2_0
- /data/data/####/c8aea512deb86fe5_0
- /data/data/####/efc4bbfaec3af65f_0
- /data/data/####/efd3316086652b69_0
- /data/data/####/f5127adbd8c4d999_0
- /data/data/####/f68f03756f634730_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/notification_persistence.xml
- /data/data/####/org.gakurmxc.pro4bc.xml
- /data/data/####/profileInstalled
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_0d0f800d6e526ecc_0_1 (deleted)
- /data/data/####/todelete_0f181c2886d34a25_0_1 (deleted)
- /data/data/####/todelete_181ac0ac0150dedc_0_1 (deleted)
- /data/data/####/todelete_1c1828a63f6f02c9_0_1 (deleted)
- /data/data/####/todelete_2f2aba817bc7f656_0_1 (deleted)
- /data/data/####/todelete_304c2676c2d02bb6_0_1 (deleted)
- /data/data/####/todelete_31622fa0f7975e08_0_1 (deleted)
- /data/data/####/todelete_33d65bf46134c33e_0_1 (deleted)
- /data/data/####/todelete_3809e5fcab6c915e_0_1 (deleted)
- /data/data/####/todelete_3d7c184c4400c91a_0_1 (deleted)
- /data/data/####/todelete_4c3b67b582fe727a_0_1 (deleted)
- /data/data/####/todelete_61c404aa44cc5dc4_0_1 (deleted)
- /data/data/####/todelete_6785b15516230787_0_1 (deleted)
- /data/data/####/todelete_6a537755cff55551_0_1 (deleted)
- /data/data/####/todelete_83dfd1048b32523c_0_1 (deleted)
- /data/data/####/todelete_9547de06a3d44881_0_1 (deleted)
- /data/data/####/todelete_9eeb9ab151e59b49_0_1 (deleted)
- /data/data/####/todelete_a52279e0fc82d856_0_1 (deleted)
- /data/data/####/todelete_a88d776935c91f3b_0_1 (deleted)
- /data/data/####/todelete_ac0fc5f05002cadd_0_1 (deleted)
- /data/data/####/todelete_dddf9898bcec0b46_0_1 (deleted)
- /data/data/####/todelete_ff7e4238f95e0cae_0_1 (deleted)
- /data/data/####/uninstall_protection.xml
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/misc/####/primary.prof
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Accesses camera interface.
Gets information about active device administrators.
Gets information about installed apps.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
