Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) 74.1####.131.100:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) 1####.177.14.94:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.2) firebas####.google####.com:443
- TCP(TLS/1.2) md####.google####.com:443
- TCP(TLS/1.2) 1####.177.14.94:443
- TCP reminia####.or####.bending####.com:443
- TCP a####.p####.in:10007
DNS requests:
- a####.p####.in
- and####.a####.go####.com
- and####.google####.com
- f####.gst####.com
- firebas####.crashly####.com
- firebas####.google####.com
- firebas####.google####.com
- gmscomp####.google####.com
- md####.google####.com
- p####.google####.com
- reminia####.or####.bending####.com
- rr9---s####.g####.com
HTTP GET requests:
- firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:873934306...
File system changes:
Creates the following files:
- /data/data/####/.jg.ac
- /data/data/####/.xml
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo4NzM5MzQzMDY4N...My.xml
- /data/data/####/INSTALL_MANAGER.xml
- /data/data/####/INSTALL_MANAGER.xml.bak
- /data/data/####/PersistedInstallation785616363tmp
- /data/data/####/SafeDKToggles.xml
- /data/data/####/app_set_id_storage.xml
- /data/data/####/aqs.0d0249808c934d1087663889df456dbb
- /data/data/####/audience_network.dex
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes10.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/classes.dex;classes5.dex
- /data/data/####/classes.dex;classes6.dex
- /data/data/####/classes.dex;classes7.dex
- /data/data/####/classes.dex;classes8.dex
- /data/data/####/classes.dex;classes9.dex
- /data/data/####/com.applovin.sdk.preferences.CP6wULIVzxoRdrEz13...tQ.xml
- /data/data/####/com.applovin.sdk.shared.xml
- /data/data/####/com.applovin.sdk.shared.xml.bak
- /data/data/####/com.bigwinepot.nwdn.international_preferences.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/external_ids.pb
- /data/data/####/external_ids.pb.tmp
- /data/data/####/firebase_session_Y29tLmJpZ3dpbmVwb3Qubndkbi5pbn...ces_pb
- /data/data/####/firebase_session_Y29tLmJpZ3dpbmVwb3Qubndkbi5pbn...leted)
- /data/data/####/firebase_session_Y29tLmJpZ3dpbmVwb3Qubndkbi5pbn...pb.tmp
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/installReferrerPreferences.xml
- /data/data/####/internal_backup_persistent_ids.pb
- /data/data/####/internal_backup_persistent_ids.pb.tmp
- /data/data/####/internal_non_backup_persistent_ids.pb
- /data/data/####/internal_non_backup_persistent_ids.pb.tmp
- /data/data/####/jgobfppppp (deleted)
- /data/data/####/journal.tmp
- /data/data/####/keys
- /data/data/####/libjiagu_64.so
- /data/data/####/notice.xml
- /data/data/####/pico_database-journal (deleted)
- /data/data/####/pico_database.lck
- /data/data/####/remini_datastore.preferences_pb
- /data/data/####/remini_datastore.preferences_pb.tmp
- /data/data/####/report
- /data/data/####/sessionInfo.pb
- /data/data/####/sessionInfo.pb.tmp
- /data/data/####/spidersense_database-journal (deleted)
- /data/data/####/spidersense_database.lck
- /data/data/####/start-time
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libconscrypt_gmscore_jni
- libjiagu_64
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
