Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.293.origin
- Android.Xiny.5386
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) log.koapk####.com:80
- TCP(HTTP/1.1) 1####.237.136.195:80
- TCP(HTTP/1.1) 13.2####.16.115:8081
DNS requests:
- log.koapk####.com
HTTP POST requests:
- log.koapk####.com/pgm/sr/gm/gy
File system changes:
Creates the following files:
- /data/data/####/iavi.txt.xml
- /data/data/####/lob.xml
- /data/data/####/m2020071317.apk
- /data/data/####/s2020071317.apk
- /data/data/####/temp.zip (deleted)
Miscellaneous:
Loads the following dynamic libraries:
- com.healthy
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Displays its own windows over windows of other apps.
