Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.513.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cdn.rg####.com:8080
- TCP(TLS/1.0) dy.kr.wildpet####.info:443
- TCP(TLS/1.0) s.fzxy####.com:7777
DNS requests:
- cdn.rg####.com
- dy.kr.wildpet####.info
- s.fzxy####.com
HTTP GET requests:
- cdn.rg####.com:8080/group1/M01/00/0B/ChmjBl9YdD6AVDiMAAHcvmdjCfQ.2020-0
File system changes:
Creates the following files:
- /data/data/####/AndroidManifest.xml
- /data/data/####/CNHUA7.RSA
- /data/data/####/CNHUA7.SF
- /data/data/####/MANIFEST.MF
- /data/data/####/activity_main.xml
- /data/data/####/classes.dex
- /data/data/####/classes_bak.enc
- /data/data/####/classes_bak.enc.dex
- /data/data/####/db61e8769de8.xml
- /data/data/####/f87f8be59566d0033
- /data/data/####/ic_launcher.png
- /data/data/####/ic_launcher_background.png
- /data/data/####/ic_launcher_background.xml
- /data/data/####/ic_launcher_round.png
- /data/data/####/resources.arsc
- /data/data/####/simple-main-msg.dat
- /data/data/####/simple-main-req.dat
Miscellaneous:
Executes the following shell scripts:
- ps
- sh
Uses the following algorithms to encrypt data:
- DES
- DESede
Uses the following algorithms to decrypt data:
- DES
- DESede
- RSA-ECB-PKCS1Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
