Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.1044.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) connect####.gst####.com:80
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) rr18---####.g####.com:443
- TCP(TLS/1.0) 74.1####.205.100:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) dog####.abhigam####.r####.co:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.2) p####.google####.com:443
- TCP(TLS/1.2) www.go####.com:443
- UDP p####.google####.com:443
- UDP rr18---####.g####.com:443
- UDP md####.google####.com:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- connect####.gst####.com
- dog####.abhigam####.r####.co
- f####.gst####.com
- gmscomp####.google####.com
- m####.go####.com
- md####.google####.com
- p####.google####.com
- rr18---####.g####.com
- rr2---s####.g####.com
- rr9---s####.g####.com
- www.go####.com
- www.google####.com
HTTP POST requests:
- dog####.abhigam####.r####.co:443/uploadText/
File system changes:
Creates the following files:
- /data/data/####/.font3431-3431-0
- /data/data/####/48s5qUHm68mRmqnNbNIMeFqMWRsEixpz.dex
- /data/data/####/48s5qUHm68mRmqnNbNIMeFqMWRsEixpz.dex.flock (deleted)
- /data/data/####/7RpIex7RocqmQMkAILaeYQbMsxm3KMZ3.dex
- /data/data/####/AEfxVtgx93jKYABDWggMr39nVKcxkdYM.dex
- /data/data/####/Dcx6YDHMYaJ0F1RnQlim8TwE2o5wdSpy.dex
- /data/data/####/GYPobf30gQa6DXgWgt99RlNiLwmsjnIu.dex
- /data/data/####/Hd8qLZiN5a0YQYfzasTphSzM5Fq247Yt.dex
- /data/data/####/Hd8qLZiN5a0YQYfzasTphSzM5Fq247Yt.dex.flock (deleted)
- /data/data/####/KAVvkTLbgnYWtVq3gt9fji86b2ATW2SE.dex
- /data/data/####/P9heL3rJeSeSqvyAg9aAffwO51inIBHk.dex
- /data/data/####/PlAI8dBwvSOAAGjmTZNO43aLgq5vbmp9.dex
- /data/data/####/Q6Roqs8ac4kLrgyhTPD3IuJfYL7MTroG.dex
- /data/data/####/TRN3U5Fpg3TIqk7nzjNHvXR94g7N0cpF.dex
- /data/data/####/TRN3U5Fpg3TIqk7nzjNHvXR94g7N0cpF.dex.flock (deleted)
- /data/data/####/TVHq4hJayi4EHn2FmOCehMT1PNEv9mEK.dex
- /data/data/####/U8W3F3f9jubxcaeG22UJLLQcEp5VGpEE.dex
- /data/data/####/W7Sm0sUdI0Ns1fKhJp8Pqdf1sF5yYUvT.dex
- /data/data/####/Wp3OffgoZGQwfB8iSVVDmoWZrRPzbUcn.dex
- /data/data/####/YJLkKXlJtLvnyf7kRR2kscrWWnHW2Kot.dex
- /data/data/####/YJLkKXlJtLvnyf7kRR2kscrWWnHW2Kot.dex.flock (deleted)
- /data/data/####/YkfeJJaC6K2ER36a97EA2RbL5BpC7EeV.dex
- /data/data/####/aKm35MZPK3GcN0CaMn1DqXjsdCmHw9Wi.dex
- /data/data/####/jUiRHmDvXIPuly73GHLVWEcpGy4KYN4p.dex
- /data/data/####/jUiRHmDvXIPuly73GHLVWEcpGy4KYN4p.dex.flock (deleted)
- /data/data/####/l5985r0KmoALywszoFn5ZOnghHvz3wzU.dex
- /data/data/####/pw6G4dCoINl6WEziBwyOITI19F5t8Dd8.dex
- /data/data/####/pw6G4dCoINl6WEziBwyOITI19F5t8Dd8.dex.flock (deleted)
- /data/data/####/rFagBKha4ONHTAmBK1MzvUt7BsR1nxBQ.dex
- /data/data/####/tl2QI7Kj8zuJFbAa8sMoMxNGq2XZGk6V.dex
- /data/data/####/tl2QI7Kj8zuJFbAa8sMoMxNGq2XZGk6V.dex.flock (deleted)
- /data/data/####/w92Qwf1lwkWB6sHb7I9Cj4YNw30szSCD.dex
- /data/data/####/wJMxnifP8LQGXd33h6ccHOKHZNUbfalE.dex
- /data/data/####/y98vgy3cgufWamZ83ELiz4vrRK6ps5bt.dex
- /data/data/####/y98vgy3cgufWamZ83ELiz4vrRK6ps5bt.dex.flock (deleted)
- /data/data/####/z0YomWZheSN6O45R2QyMNgfOnaOfgBtZ.dex
- /data/data/####/z0YomWZheSN6O45R2QyMNgfOnaOfgBtZ.dex.flock (deleted)
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES
- AES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Parses information from SMS.
Intercepts notifications.
Appears corrupted in a way typical for malicious files.
