Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.218.origin
- Android.Triada.219.origin
- Android.Triada.389.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 4####.33.48.159:9898
- TCP(TLS/1.0) api.face####.com:443
DNS requests:
- g####.face####.com
Modified file system:
Creates the following files:
- /data/data/####/1523874284431.apk
- /data/data/####/1523874289517.apk
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/Signature_0.key
- /data/data/####/base-1.apk
- /data/data/####/base-1.dex
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.zh.slimgo_preferences.xml
- /data/data/####/core_service
- /data/data/####/def.xml
- /data/data/####/jvabvx.so
- /data/data/####/libs_data
- /data/data/####/nohctk.apk
- /data/data/####/rmfio1.png
- /data/data/####/share_cache.pref.xml
- /data/data/####/su.sqlite
- /data/data/####/su.sqlite-journal
Miscellaneous:
Uses the following algorithms to decrypt data:
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
