Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mobifun.11.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) 74.1####.131.95:443
- TCP(TLS/1.0) api.higam####.com:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.2) 64.2####.161.95:443
- TCP(TLS/1.2) 2####.85.233.101:443
- UDP rr1---s####.g####.com:443
- UDP 74.1####.131.95:443
- UDP 85.1####.117.141:443
DNS requests:
- api.higam####.com
- rr1---s####.g####.com
- ssl.google-####.com
File system changes:
Creates the following files:
- /data/data/####/05b39de6_4999_4ff8_947b_6a0d8de4e426.jar
- /data/data/####/6732362f_bccb_469c_b2ee_86deb022ee59.dex
- /data/data/####/6732362f_bccb_469c_b2ee_86deb022ee59.dex.flock (deleted)
- /data/data/####/6732362f_bccb_469c_b2ee_86deb022ee59.jar
- /data/data/####/69bf5dad_a7b8_466c_bef3_dab832ca26f5.dex
- /data/data/####/69bf5dad_a7b8_466c_bef3_dab832ca26f5.dex.flock (deleted)
- /data/data/####/69bf5dad_a7b8_466c_bef3_dab832ca26f5.jar
- /data/data/####/7936b2bd-4854-49b7-8d2a-e75760bba208
- /data/data/####/8c27e49f_25c3_412a_a2b2_d29611bd306b.dex
- /data/data/####/8c27e49f_25c3_412a_a2b2_d29611bd306b.dex.flock (deleted)
- /data/data/####/8c27e49f_25c3_412a_a2b2_d29611bd306b.jar
- /data/data/####/9f87e6c1_ceb0_4f4d_a05a_5de04c16c18c.dex
- /data/data/####/9f87e6c1_ceb0_4f4d_a05a_5de04c16c18c.dex.flock (deleted)
- /data/data/####/9f87e6c1_ceb0_4f4d_a05a_5de04c16c18c.jar
- /data/data/####/a.xml
- /data/data/####/a29990e9-188b-4aa5-8c72-ca40753fb8b9
- /data/data/####/aa8b863a-3d75-42d5-b92e-bb9c271d6a32
- /data/data/####/b6cf1ea5_79d2_4a48_a9ff_29d90f297449.dex
- /data/data/####/b6cf1ea5_79d2_4a48_a9ff_29d90f297449.dex.flock (deleted)
- /data/data/####/b6cf1ea5_79d2_4a48_a9ff_29d90f297449.jar
- /data/data/####/com.dota2.parkour_preferences.xml
- /data/data/####/enforce.dex
- /data/data/####/enforce.dex.flock (deleted)
- /data/data/####/enforce.jar
- /data/data/####/f4c3b044-e09d-4254-8f4c-e87cfe53b1c0
- /data/data/####/gaClientId
- /data/data/####/gpay_jquery_1_7.ap
- /data/data/####/gpay_pay_event_6_7.ap
- /data/data/####/gpay_pay_method_card_1_7.ap
- /data/data/####/gpay_pay_method_mobile_1_7.ap
- /data/data/####/gpay_pay_sms_5_7.ap
- /data/data/####/jquery_1_7.applet
- /data/data/####/la.so
- /data/data/####/pay_event_6_7.applet
- /data/data/####/pay_method_card_1_7.applet
- /data/data/####/pay_method_mobile_1_7.applet
- /data/data/####/pay_sms_5_7.applet
- /data/data/####/preferences.xml
- /data/data/####/preferences.xml.bak (deleted)
- /data/data/####/proc_auxv
- /data/data/####/unsent_requests
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- cat /proc/cpuinfo
- grep <Package>
- grep u0_a65
- ps
- sh -c cat /proc/3537/cmdline
- sh -c cat /proc/3633/cmdline
- sh -c ps | grep <Package>
- sh -c ps | grep u0_a65
Loads the following dynamic libraries:
- la
- libgnio
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CFB-NoPadding
- RSA-ECB-PKCS1Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
