Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Was.1.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) 1####.251.39.106:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
- TCP(TLS/1.0) pang####.sn####.com.####.net:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.2) 1####.250.179.174:443
- TCP(TLS/1.2) android####.go####.com:443
- TCP(TLS/1.2) 2####.58.208.99:443
- TCP(TLS/1.2) 2####.58.208.106:443
- TCP(TLS/1.2) 1####.250.179.202:443
- UDP 1####.251.39.106:443
- UDP 1####.217.132.136:443
DNS requests:
- and####.google####.com
- android####.go####.com
- g####.face####.com
- m####.go####.com
- pang####.sn####.com
- sconten####.xx.f####.net
HTTP GET requests:
- api.face####.com:443/v5.0/411795806029152/mobile_sdk_gk?fields=####&form...
- api.face####.com:443/v5.0/411795806029152?fields=####&format=####&sdk=####
File system changes:
Creates the following files:
- /data/data/####/.dex2oatlock
- /data/data/####/.updateIV.dat
- /data/data/####/0000000lllll_0.dex
- /data/data/####/000O00ll111l_0.dex
- /data/data/####/00O000ll111l_0.dex
- /data/data/####/00O000ll111l_0.dex (deleted)
- /data/data/####/00O000ll111l_0.dex.flock
- /data/data/####/00O000ll111l_0.dex.flock (deleted)
- /data/data/####/0OO00l111l1l
- /data/data/####/0OO00l111l1l.lock
- /data/data/####/122.xml
- /data/data/####/1d7842c4752cfad2ae1855d9ce1d687a-4011-4011.apk
- /data/data/####/MultiDex.lock
- /data/data/####/base-1.apk
- /data/data/####/base-1.dex
- /data/data/####/base-1.dex.flock (deleted)
- /data/data/####/base.apk.classes1.dex.flock (deleted)
- /data/data/####/base.apk.classes1.zip
- /data/data/####/base.apk.classes2.dex
- /data/data/####/base.apk.classes2.dex.flock (deleted)
- /data/data/####/base.apk.classes2.zip
- /data/data/####/base.apk.classes3.dex
- /data/data/####/base.apk.classes3.dex.flock (deleted)
- /data/data/####/base.apk.classes4.dex
- /data/data/####/base.apk.classes4.dex.flock (deleted)
- /data/data/####/base.apk.classes5.dex
- /data/data/####/base.apk.classes5.dex.flock (deleted)
- /data/data/####/base.apk.classes6.dex
- /data/data/####/base.apk.classes6.dex.flock (deleted)
- /data/data/####/base.apk.classes6.zip
- /data/data/####/base.apk.classes7.dex
- /data/data/####/base.apk.classes7.dex.flock (deleted)
- /data/data/####/com.facebook.sdk.USER_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/downloader.db-journal
- /data/data/####/libPglmetasec_ml.so
- /data/data/####/libavmdl_lite.so
- /data/data/####/libshellx-super.2019.so
- /data/data/####/libtobEmbedEncrypt.so
- /data/data/####/libttmplayer_lite.so
- /data/data/####/multidex.version.xml
- /data/data/####/o0oooOO0ooOo.dat
- /data/data/####/pangle_meta_data_sp.xml
- /data/data/####/proc_auxv
- /data/data/####/sp_preload_plugin.xml
- /data/data/####/temp (deleted)
- /data/data/####/tmp-base.apk.classes1002797407.zip
- /data/data/####/tmp-base.apk.classes1060416838.zip
- /data/data/####/tmp-base.apk.classes1098662321.zip
- /data/data/####/tmp-base.apk.classes1118016416.zip
- /data/data/####/tmp-base.apk.classes1119906756.zip
- /data/data/####/tmp-base.apk.classes1149070770.zip
- /data/data/####/tmp-base.apk.classes118593364.zip
- /data/data/####/tmp-base.apk.classes1195783285.zip
- /data/data/####/tmp-base.apk.classes1254463404.zip
- /data/data/####/tmp-base.apk.classes1432365491.zip
- /data/data/####/tmp-base.apk.classes1515057510.zip
- /data/data/####/tmp-base.apk.classes1628487078.zip
- /data/data/####/tmp-base.apk.classes1668071330.zip
- /data/data/####/tmp-base.apk.classes170982183.zip
- /data/data/####/tmp-base.apk.classes1725794613.zip
- /data/data/####/tmp-base.apk.classes1726260374.zip
- /data/data/####/tmp-base.apk.classes1812760084.zip
- /data/data/####/tmp-base.apk.classes1882737777.zip
- /data/data/####/tmp-base.apk.classes1939234569.zip
- /data/data/####/tmp-base.apk.classes2089072140.zip
- /data/data/####/tmp-base.apk.classes256034752.zip
- /data/data/####/tmp-base.apk.classes49877052.zip
- /data/data/####/tmp-base.apk.classes555746490.zip
- /data/data/####/tmp-base.apk.classes558432063.zip
- /data/data/####/tmp-base.apk.classes660646598.zip
- /data/data/####/tmp-base.apk.classes684024078.zip
- /data/data/####/tmp-base.apk.classes797855966.zip
- /data/data/####/tmp-base.apk.classes80399008.zip
- /data/data/####/tmp-base.apk.classes886232511.zip
- /data/data/####/tmp-base.apk.classes983233185.zip
- /data/data/####/tosversion
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- getprop ro.product.cpu.abi
- ls /data/local
