Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Hidden.8661
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) 1####.217.16.206:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
DNS requests:
- a####.r####.co
- app-mea####.com
- firebas####.google####.com
- g####.face####.com
- sconten####.xx.f####.net
File system changes:
Creates the following files:
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/FBAdPrefs.xml
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/MTML_3
- /data/data/####/MultiDex.lock
- /data/data/####/PersistedInstallation1235871387tmp
- /data/data/####/PersistedInstallation898307445tmp
- /data/data/####/audience_network.dex
- /data/data/####/cloneSettings.json
- /data/data/####/com.facebook.internal.MODEL_STORE.xml
- /data/data/####/com.facebook.internal.PURCHASE.xml
- /data/data/####/com.facebook.internal.SKU_DETAILS.xml
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.rectv.rectv_apq_preferences.xml
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/journal.tmp
- /data/data/####/multidex.version.xml
- /data/data/####/natives_sec_blob-1505419429.dex
- /data/data/####/status_app.xml
- /data/data/####/tmp-com.rectv.rectv_apq-1.apk.classes-1556398604.zip
- /data/data/####/tmp-com.rectv.rectv_apq-1.apk.classes1432005470.zip
- /data/data/####/tmp-com.rectv.rectv_apq-1.apk.classes856932630.zip
Miscellaneous:
Loads the following dynamic libraries:
- AK
- AKCompat
- conceal
Uses the following algorithms to decrypt data:
- AES
Gets information about network.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
