Adware.NativeAd.5

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.NativeAd.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) ad####.flyer####.com:80
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) 2####.58.214.10:443
TCP(TLS/1.2) 1####.217.168.227:443
TCP(TLS/1.2) 2####.58.214.10:443
TCP(TLS/1.2) 2####.58.208.110:443
TCP(TLS/1.2) 1####.250.179.202:443

DNS requests:

ad####.flyer####.com
app-mea####.com
av1.x####.com
i.t####.com
instant####.google####.com
www.flyer####.com

HTTP GET requests:

ad####.flyer####.com/adbsc?aid=####&hasGP=####&sid=####&sv=####&udid=###...
ad####.flyer####.com/adbux?v=####&pk=####&sid=####&rv=####&id=####&cid=#...

File system changes:

Creates the following files:

/data/data/####/1620240973866_3619
/data/data/####/1620240974188_3619
/data/data/####/1620240977884_3717
/data/data/####/1620240977963_3717
/data/data/####/1620240980943_3717
/data/data/####/1620240980971_3717
/data/data/####/1620240981016_3717
/data/data/####/1620240981052_3717
/data/data/####/1620240981514_3717
/data/data/####/1620240981993_3717
/data/data/####/1620240983036_3717
/data/data/####/1620240983056_3717
/data/data/####/1620240984821_3717
/data/data/####/1620240984852_3717
/data/data/####/1620240986320_3717
/data/data/####/1620240986343_3717
/data/data/####/1620240987629_3717
/data/data/####/1620240987676_3717
/data/data/####/1620240989118_3717
/data/data/####/1620240989164_3717
/data/data/####/1620240990680_3717
/data/data/####/1620240990742_3717
/data/data/####/1620240992466_3717
/data/data/####/1620240992482_3717
/data/data/####/1620240994077_3717
/data/data/####/1620240994090_3717
/data/data/####/1620240995932_3717
/data/data/####/1620240996018_3717
/data/data/####/1620240997737_3717
/data/data/####/1620240997839_3717
/data/data/####/1620240999658_3717
/data/data/####/1620240999735_3717
/data/data/####/1620241001628_3717
/data/data/####/1620241001657_3717
/data/data/####/1620241003483_3717
/data/data/####/1620241003497_3717
/data/data/####/1620241005135_3717
/data/data/####/1620241005333_3717
/data/data/####/1620241006817_3717
/data/data/####/1620241006972_3717
/data/data/####/1620241008495_3717
/data/data/####/1620241008506_3717
/data/data/####/1620241010170_3717
/data/data/####/1620241010422_3717
/data/data/####/1620241011688_3717
/data/data/####/1620241011714_3717
/data/data/####/1620241013550_3717
/data/data/####/1620241013712_3717
/data/data/####/1620241016699_3717
/data/data/####/1620241016714_3717
/data/data/####/1620241018126_3717
/data/data/####/1620241018143_3717
/data/data/####/1620241019726_3717
/data/data/####/1620241019751_3717
/data/data/####/1620241021338_3717
/data/data/####/1620241021357_3717
/data/data/####/1620241023110_3717
/data/data/####/1620241023139_3717
/data/data/####/1620241024829_3717
/data/data/####/1620241024902_3717
/data/data/####/1620241026474_3717
/data/data/####/1620241026497_3717
/data/data/####/1620241029599_3717
/data/data/####/1620241029786_3717
/data/data/####/1620241030744_3717
/data/data/####/1620241030802_3717
/data/data/####/1620241032383_3717
/data/data/####/1620241032397_3717
/data/data/####/1620241033394_3717
/data/data/####/1620241033500_3717
/data/data/####/1620241034844_3717
/data/data/####/1620241034900_3717
/data/data/####/1620241036276_3717
/data/data/####/1620241036381_3717
/data/data/####/1620241037821_3717
/data/data/####/1620241037837_3717
/data/data/####/1620241037902_3717
/data/data/####/1620241066401_4531
/data/data/####/1620241066473_4531
/data/data/####/1620241067751_4531
/data/data/####/NATIVE123456_FILE.xml
/data/data/####/NATIVE123456_FILE.xml.bak
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime0.xml
/data/data/####/TDpref_longtime0.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime.xml.bak
/data/data/####/TDpref_shorttime0.xml
/data/data/####/b_patch.dex
/data/data/####/b_patch.dex.flock (deleted)
/data/data/####/b_patch.jar
/data/data/####/b_patch.tmp.jar
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.appid.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak (deleted)
/data/data/####/com.idea.easyapplocker_preferences.xml
/data/data/####/com.idea.easyapplocker_preferences.xml.bak
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/random_sdkdb_data-journal
/data/data/####/tdid.xml
/data/media/####/.tcookieid
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/b_patch.jar --oat-fd=41 --oat-location=/data/user/0/<Package>/files/b_patch.dex --compiler-filter=speed
getprop

Uses the following algorithms to encrypt data: