Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.1044.origin
- Android.SpyMax.42.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) 74.1####.205.95:443
- TCP(TLS/1.0) dogerat####.r####.co:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) 64.2####.164.95:443
- TCP(TLS/1.2) 64.2####.164.95:443
- TCP(TLS/1.2) 74.1####.131.100:443
- TCP(TLS/1.2) 74.1####.205.95:443
DNS requests:
- connect####.gst####.com
- dogerat####.r####.co
- f####.gst####.com
- rr9---s####.g####.com
HTTP POST requests:
- dogerat####.r####.co:443/uploadText/
File system changes:
Creates the following files:
- /data/data/####/.font3492-3492-0
- /data/data/####/2xwh9AyZeAQeq00rM9WseKzAw0v6hgwR.dex
- /data/data/####/7TtDomHD2OGDBJdDBx59IOFFQejlMI1z.dex
- /data/data/####/AlOPnfTxKJYDKFJWDkwxuHpPPPW94sOl.dex
- /data/data/####/AlOPnfTxKJYDKFJWDkwxuHpPPPW94sOl.dex.flock (deleted)
- /data/data/####/GjoN6XpQXqvmhiLwQ9NjLiXc5nMftRb0.dex
- /data/data/####/Gp18BX8luo5uBRr9yKxstzsa4Zabi5B6.dex
- /data/data/####/Gp18BX8luo5uBRr9yKxstzsa4Zabi5B6.dex.flock (deleted)
- /data/data/####/JqyVpyYeLomylHgr2bWPzPH7dnMhcM1e.dex
- /data/data/####/JqyVpyYeLomylHgr2bWPzPH7dnMhcM1e.dex.flock (deleted)
- /data/data/####/Qq9gd8a1pKO7F8boMHJwAjxvXxC7gFJi.dex
- /data/data/####/Qq9gd8a1pKO7F8boMHJwAjxvXxC7gFJi.dex.flock (deleted)
- /data/data/####/TZ6owBrdbVuwqApkzV1sXU1D6riHSAkV.dex
- /data/data/####/TZ6owBrdbVuwqApkzV1sXU1D6riHSAkV.dex.flock (deleted)
- /data/data/####/TbVGPoxSH5nKMz6ExqKHJe03QnEAf7kS.dex
- /data/data/####/TbVGPoxSH5nKMz6ExqKHJe03QnEAf7kS.dex.flock (deleted)
- /data/data/####/Vbsc0gp6Ydh9Kjf7VYd7R9sfx7rPW4Yr.dex
- /data/data/####/ZRa8alt06olL5h0qB60cmkbUaVUJiVBM.dex
- /data/data/####/ZgQHDQPU0DacZEuZKiSf7H2cxTN6jZeX.dex
- /data/data/####/ZgQHDQPU0DacZEuZKiSf7H2cxTN6jZeX.dex.flock (deleted)
- /data/data/####/aADrYUaVumUsdLMTXklXhtQNXAVaFKe8.dex
- /data/data/####/aADrYUaVumUsdLMTXklXhtQNXAVaFKe8.dex.flock (deleted)
- /data/data/####/c7zAo2Ha57dywHkMYBEnqF6CbpcbkU30.dex
- /data/data/####/chqMf2JJQziCbVghmFgHLDFWv1GphDPG.dex
- /data/data/####/chqMf2JJQziCbVghmFgHLDFWv1GphDPG.dex.flock (deleted)
- /data/data/####/dQnl5M7j4AUcZhTvW6U3IlrNC6lNCtNY.dex
- /data/data/####/f2OUghE9Qip7aRbr5on7G8LkWVBXebkx.dex
- /data/data/####/f2OUghE9Qip7aRbr5on7G8LkWVBXebkx.dex.flock (deleted)
- /data/data/####/n7ftfbpAlqMJ4nCzBJeUuQek8Genj1EI.dex
- /data/data/####/nx26fBpJBwpPcZshfPpwAPczYluX1qEA.dex
- /data/data/####/rFjGd0ihED32uaTVp8acTk2P1b9yxcEQ.dex
- /data/data/####/willi.fiend.xml
- /data/data/####/willi.fiend_preferences.xml
- /data/media/####/log-2023-11-09.txt
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES
- AES-ECB-PKCS5Padding
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Intercepts notifications.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
