Technical information
Malicious functions:
Overlays the screen with its own window and blocks GUI access.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) api.onesi####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) 1####.217.168.202:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.2) 1####.250.179.174:443
- TCP(TLS/1.2) 1####.217.168.202:443
- TCP(TLS/1.2) 1####.217.168.195:443
- TCP firebas####.crashly####.com:443
DNS requests:
- and####.google####.com
- android####.go####.com
- api.onesi####.com
- firebas####.crashly####.com
- firebas####.google####.com
- instant####.google####.com
- md####.google####.com
- www.gst####.com
HTTP GET requests:
- api.onesi####.com:443/apps/e3795aba-effa-4179-b4b2-4d4d6020b160/android_...
HTTP POST requests:
- firebas####.google####.com:443/v1/projects/onesignal-shared-public/insta...
- firebas####.google####.com:443/v1/projects/whatscrop-a86e9/installations
File system changes:
Creates the following files:
- /data/data/####/.ae1643459753842
- /data/data/####/.font3389-3389-0
- /data/data/####/.font3543-3543-0
- /data/data/####/61F534A20140-0001-0D3D-E3417F7E8803BeginSession.cls
- /data/data/####/61F534A20140-0001-0D3D-E3417F7E8803SessionApp.cls
- /data/data/####/61F534A20140-0001-0D3D-E3417F7E8803SessionDevice.cls
- /data/data/####/61F534A20140-0001-0D3D-E3417F7E8803SessionOS.cls
- /data/data/####/61F534A20140-0001-0D3D-E3417F7E8803SessionUser.cls
- /data/data/####/61F534A2014000010D3DE3417F7E8803
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803.cls
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803BeginSession.cls_temp
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803SessionApp.cls
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803SessionCrash.cls
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803SessionDevice.cls
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803SessionOS.cls
- /data/data/####/61F534A70342-0001-0DD7-E3417F7E8803SessionUser.cls
- /data/data/####/61F534A7034200010DD7E3417F7E8803
- /data/data/####/61F534AB037D-0002-0DD7-E3417F7E8803BeginSession.cls
- /data/data/####/61F534AB037D-0002-0DD7-E3417F7E8803SessionApp.cls
- /data/data/####/61F534AB037D-0002-0DD7-E3417F7E8803SessionDevice.cls
- /data/data/####/61F534AB037D-0002-0DD7-E3417F7E8803SessionOS.cls
- /data/data/####/61F534AB037D-0002-0DD7-E3417F7E8803SessionUser.cls
- /data/data/####/61F53503013F-0001-12E0-E3417F7E8803BeginSession.cls
- /data/data/####/61F53503013F-0001-12E0-E3417F7E8803SessionApp.cls
- /data/data/####/61F53503013F-0001-12E0-E3417F7E8803SessionDevice.cls
- /data/data/####/61F53503013F-0001-12E0-E3417F7E8803SessionOS.cls
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/GTPlayerPurchases.xml
- /data/data/####/OneSignal.db-journal
- /data/data/####/OneSignalTriggers.xml
- /data/data/####/PersistedInstallation.T05FU0lHTkFMX1NES19GQ01fQ...z.json
- /data/data/####/PersistedInstallation1300731469tmp
- /data/data/####/PersistedInstallation1329215050tmp
- /data/data/####/PersistedInstallation561594564tmp
- /data/data/####/PersistedInstallation871903185tmp
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/androidx.work.util.id.xml
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/crash_marker
- /data/data/####/event0000000000_
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/metrics_guid
- /data/data/####/report
- /data/data/####/t2.xml
Miscellaneous:
Accesses the ITelephony private interface.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
