Technical information
Malicious functions:
Removes app icon from the screen.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) sasam####.ru:443
- TCP(TLS/1.0) chec####.su:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.2) 2####.58.214.10:443
- TCP(TLS/1.2) 1####.217.17.67:443
- TCP(TLS/1.2) 74.1####.205.113:443
- TCP(TLS/1.2) 2####.58.208.110:443
- TCP(TLS/1.2) 1####.217.168.234:443
DNS requests:
- and####.google####.com
- android####.go####.com
- chec####.su
- instant####.google####.com
- p####.google####.com
- sasam####.ru
File system changes:
Creates the following files:
- /data/data/####/20a3cda017ec41f6_0
- /data/data/####/20a3cda017ec41f6_0 (deleted)
- /data/data/####/3020294ae6681a8f_0
- /data/data/####/336613ea4f1f8eb9_0
- /data/data/####/336613ea4f1f8eb9_0 (deleted)
- /data/data/####/621228132ba480bc_0
- /data/data/####/621228132ba480bc_0 (deleted)
- /data/data/####/621228132ba480bc_1
- /data/data/####/864c51769f904136_0
- /data/data/####/864c51769f904136_0 (deleted)
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/c033a353dd34e1fc_0
- /data/data/####/https_checkout.su_0.localstorage-journal
- /data/data/####/index
- /data/data/####/kpwokw.tlxvaphti.zetpkzh.xml
- /data/data/####/kpwokw.tlxvaphti.zetpkzh_preferences.xml
- /data/data/####/metrics_guid
- /data/data/####/the-real-index
- /data/misc/####/primary.prof
Miscellaneous:
Gets information about network.
Displays its own windows over windows of other apps.
