Android.Joker.1211

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Joker.495

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) f####.oss-us-####.aliy####.com:80
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) 1####.251.36.10:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) 2####.58.208.106:443
TCP(TLS/1.0) 1####.251.36.3:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.2) 1####.251.36.3:443
TCP(TLS/1.2) 2####.58.208.106:443
TCP(TLS/1.2) and####.cli####.go####.com:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP 2####.58.208.106:443

DNS requests:

and####.a####.go####.com
and####.cli####.go####.com
android####.go####.com
f####.oss-us-####.aliy####.com
firebas####.google####.com
instant####.google####.com
m####.go####.com
md####.google####.com

HTTP GET requests:

f####.oss-us-####.aliy####.com/feel/made.asx

HTTP POST requests:

firebas####.google####.com:443/v1/projects/app-analytics-dd6f3/installat...

File system changes:

Creates the following files:

/data/data/####/.ae1644559412437
/data/data/####/.dex2oatlock
/data/data/####/.font3541-3541-0
/data/data/####/.updateIV.dat
/data/data/####/.updateIV.dat_0
/data/data/####/.updateIV.dat_1
/data/data/####/.updateIV.dat_2
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/0000000lllll_2.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/000O00ll111l_2.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex (deleted)
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex (deleted)
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/00O000ll111l_2.dex
/data/data/####/00O000ll111l_2.dex (deleted)
/data/data/####/00O000ll111l_2.dex.flock
/data/data/####/00O000ll111l_2.dex.flock (deleted)
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/6205FC320380-0001-0DD5-E486C4170554.cls
/data/data/####/6205FC320380-0001-0DD5-E486C4170554BeginSession.cls
/data/data/####/6205FC320380-0001-0DD5-E486C4170554SessionApp.cls
/data/data/####/6205FC320380-0001-0DD5-E486C4170554SessionCrash.cls
/data/data/####/6205FC320380-0001-0DD5-E486C4170554SessionDevice.cls
/data/data/####/6205FC320380-0001-0DD5-E486C4170554SessionOS.cls_temp
/data/data/####/6205FC320380-0001-0DD5-E486C4170554SessionUser.cls_temp
/data/data/####/6205FC32038000010DD5E486C4170554
/data/data/####/6205FC3E01EC-0002-0DD5-E486C4170554BeginSession.cls
/data/data/####/6205FC3E01EC-0002-0DD5-E486C4170554SessionApp.cls
/data/data/####/6205FC3E01EC-0002-0DD5-E486C4170554SessionDevice.cls
/data/data/####/6205FC3E01EC-0002-0DD5-E486C4170554SessionOS.cls
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/FirebaseAppHeartBeat.xml.bak
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MToyMTkzMjA4...4.json
/data/data/####/PersistedInstallation1570224691tmp
/data/data/####/PersistedInstallation982264931tmp
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/androidx.work.workdb
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/com.google.android.datatransport.events
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/crash_marker
/data/data/####/event0000000000_
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/initialization_marker
/data/data/####/libshellx-super.2019.so
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/proc_auxv
/data/data/####/report
/data/data/####/tosversion
/data/data/####/user_data.xml
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

getprop ro.product.cpu.abi

Displays its own windows over windows of other apps.

Intercepts notifications.

Contains Play Store Frosting.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial