Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.CoinSteal.6
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) 2####.239.38.223:443
- TCP(TLS/1.0) 2####.239.32.223:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- TCP(TLS/1.2) 64.2####.164.94:443
- TCP(TLS/1.2) 1####.177.14.147:443
- TCP(TLS/1.2) 64.2####.164.102:443
- TCP(TLS/1.2) 2####.239.32.223:443
- UDP 1####.177.14.139:443
- UDP 64.2####.161.94:443
- UDP www.gst####.com:443
- UDP 74.1####.163.21:443
DNS requests:
- android####.go####.com
- gmscomp####.google####.com
- rr2---s####.g####.com
- www.gst####.com
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/1.jpg
- /data/data/####/2.jpg
- /data/data/####/3.jpg
- /data/data/####/4.jpg
- /data/data/####/5.jpg
- /data/data/####/6.jpg
- /data/data/####/7.jpg
- /data/data/####/origin.apk
- /data/data/####/proc_auxv
Miscellaneous:
Loads the following dynamic libraries:
- libSignatureKiller
- libconnector
- libnmtk
Requests the system alert window permission.
