Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google Host>
- TCP(Google Services) <Google Host>
- TCP(Google Services) <Google Host>
- TCP(HTTP/1.1) ipo####.net:80
- TCP(HTTP/1.1) p.axc####.store:80
- TCP(HTTP/1.1) log####.lo####.com:80
- TCP(HTTP/1.1) u.axc####.store:80
- TCP(TLS/1.1) www.go####.com:443
DNS requests:
- g.axc####.store
- ipo####.net
- log####.lo####.com
- mt####.go####.com
- p.axc####.store
- u.axc####.store
- www.go####.com
HTTP GET requests:
- log####.lo####.com/inputs/f04296fa-fa7a-41f2-8ace-00459b4d5df3.gif?sourc...
- u.axc####.store/?izxiz=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/index (deleted)
- <Package Folder>/databases/music_db
- <Package Folder>/databases/music_db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Uses administrator priveleges.
Displays its own windows over windows of other applications.
