Technical information
Malicious functions:
Sends SMS:
- 900: баланс
Network activity:
Connects to:
- TCP(???) 95.2####.108.110:80
- UDP(???) tikto####.top:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) prefere####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) cdn.sho####.com:443
- TCP(TLS/1.0) w####.at:443
- TCP(TLS/1.0) tikto####.top:443
- TCP(TLS/1.0) na.naw####.com:443
- TCP(TLS/1.0) st####.cloudfl####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) earring####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) js.ca####.com:443
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) cafewar####.com:443
- TCP(TLS/1.0) protraf####.com:443
DNS requests:
- cafewar####.com
- cdn.sho####.com
- clients####.google####.com
- earring####.com
- ed####.me.g####.com
- f####.google####.com
- f####.gst####.com
- js.ca####.com
- js.wpad####.com
- kettled####.com
- na.naw####.com
- prefere####.com
- protraf####.com
- st####.cloudfl####.com
- tikto####.top
- up####.google####.com
- w####.at
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/Databases.db
- /app_webview/Default/####/Databases.db-journal
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/QuotaManager
- /app_webview/Default/QuotaManager-journal
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /cache/WebView/####/37fa55f05ca963fd_0
- /cache/WebView/####/51f14f425c1e8db4_0
- /cache/WebView/####/7b16819cea32ec9c_0
- /cache/WebView/####/803e1cf334129b63_0
- /cache/WebView/####/862a2e8fe769a22c_0
- /cache/WebView/####/e1f07cacc64915c9_0
- /cache/WebView/####/ec332f1d8c2a99e0_0
- /cache/WebView/####/fca9327cf295fac5_0
- /data/data/####/.org.chromium.Chromium.7selQy (deleted)
- /data/data/####/.org.chromium.Chromium.LtJUuy
- /data/data/####/000001.dbtmp
- /data/data/####/02b3aac6d793400e_0
- /data/data/####/0921845ad2e97f12_0
- /data/data/####/122331004a9721ca_0
- /data/data/####/12c45e933cd1bf4d_0
- /data/data/####/163dad36c1fbc771_0
- /data/data/####/17236f6d178348e0_0
- /data/data/####/17f65dac012a1f0a_0
- /data/data/####/1bc965ab157e94eb_0
- /data/data/####/24339e50e79243b5_0
- /data/data/####/3766c0037f16583b_0
- /data/data/####/4662fafb4ab649e8_0
- /data/data/####/47f31bc930fec2c6_0
- /data/data/####/4b159e4e4215acf5_0
- /data/data/####/4bc56df0910be7c0_0
- /data/data/####/4c483ccb5590ce6b_0
- /data/data/####/54c4d770813419c6_0
- /data/data/####/5759a5fd4369ae9a_0
- /data/data/####/59b853baa63a1bda_0
- /data/data/####/5ec03dae2785e99d_0
- /data/data/####/60687b3a959c9ce0_0
- /data/data/####/686f9c4a5df765eb_0
- /data/data/####/710843fd3856c7fb_0
- /data/data/####/7537818cc08e9784_0
- /data/data/####/82d6e140a4365aac_0
- /data/data/####/88e8268e643ebaac_0
- /data/data/####/8d079023330bc68d_0
- /data/data/####/922e4a14c0197968_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a5f4b6ea32632993_0
- /data/data/####/a80e621527131ad0_0
- /data/data/####/androidx.work.workdb-journal
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/b3aca500a80d4e3a_0
- /data/data/####/c86ed1e7caa315b7_0
- /data/data/####/dd0d11658f9d94b2_0
- /data/data/####/dfef30d85bfb9864_0
- /data/data/####/e8fbe877546e65fc_0
- /data/data/####/e9254cbaab0cd5b8_0
- /data/data/####/e99c3eec3070b62d_0
- /data/data/####/edfe3363bd834d24_0
- /data/data/####/f3aa396ba98e108c_0
- /data/data/####/f9842cace5783f80_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/installed_apps.txt
- /data/data/####/preferences.preferences_pb.tmp
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/settings.dat
- /data/data/####/sms_history.txt
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/misc/####/primary.prof
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Accesses the ITelephony private interface.
Contains functionality for automatic SMS sending.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
