Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BankBot.125
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) f####.b####.com:443
- TCP(TLS/1.0) def####.cn.zb.####.com:443
- TCP(TLS/1.0) er####.u####.com.####.com:443
- TCP(TLS/1.0) lo####.mm####.com:443
- TCP(TLS/1.0) 1####.250.150.138:443
- TCP(TLS/1.0) www.pa####.cn.####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) gw.usd.alibab####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) ss.bscsto####.com:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 1####.177.14.106:443
- TCP(TLS/1.2) 64.2####.164.100:443
DNS requests:
- a####.ss.bscsto####.com
- c.c####.com
- connect####.gst####.com
- er####.u####.com
- f####.b####.com
- frag####.t####.com
- fx####.b####.com
- g.al####.com
- gw.al####.com
- hm.b####.com
- img.al####.com
- log.mm####.com
- s.u####.com
- v1.c####.com
- www.google####.com
- www.pa####.cn
- www.u####.com
- z6.c####.com
File system changes:
Creates the following files:
- /data/data/####/.fsgkea
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/0da6b6d9d03b7225_0
- /data/data/####/1e8a4052a430657b_0
- /data/data/####/2024-11-17.log
- /data/data/####/346e171fab99201c_0
- /data/data/####/4bac350a3b2ff3f1_0
- /data/data/####/4bac350a3b2ff3f1_1
- /data/data/####/5d1888825e4b7085_0 (deleted)
- /data/data/####/666a7886994c9991_0
- /data/data/####/666a7886994c9991_1
- /data/data/####/6a8bb0d949650647_0
- /data/data/####/6a8bb0d949650647_1
- /data/data/####/6e0e0cb884340581_0
- /data/data/####/723502f3ed7b441d_0
- /data/data/####/723502f3ed7b441d_1
- /data/data/####/7909cb4a88c51a5f_0 (deleted)
- /data/data/####/7e11f8fa19905454_0
- /data/data/####/7e11f8fa19905454_1
- /data/data/####/83b49e875031f945_0
- /data/data/####/83b49e875031f945_1
- /data/data/####/84da53fa20371d17_0
- /data/data/####/84da53fa20371d17_1
- /data/data/####/8d33d9a93808e572_0 (deleted)
- /data/data/####/8df103cfdc850073_0
- /data/data/####/8df103cfdc850073_0 (deleted)
- /data/data/####/91ebdb6077f25289_0 (deleted)
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/ZYJAGU.xml
- /data/data/####/ZYJAGU.xml.bak (deleted)
- /data/data/####/a0be312e131b9a23_0
- /data/data/####/a0be312e131b9a23_1
- /data/data/####/a24d304f8fdd7043_0
- /data/data/####/a24d304f8fdd7043_1
- /data/data/####/a303a844fd185c1e_0
- /data/data/####/b23b6f8aff8be08f_0
- /data/data/####/b23b6f8aff8be08f_1
- /data/data/####/b36e2aee69cb5bbb_0
- /data/data/####/b36e2aee69cb5bbb_1
- /data/data/####/c007dc5516dc5c7f_0
- /data/data/####/c007dc5516dc5c7f_1
- /data/data/####/c1fbb3e6ce53c5f6_0
- /data/data/####/c731f7cc709cf403_0
- /data/data/####/c731f7cc709cf403_1
- /data/data/####/classes
- /data/data/####/classes.dex
- /data/data/####/classes.dex (deleted)
- /data/data/####/classes.dex.flock (deleted)
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/classes2
- /data/data/####/classes2.dex
- /data/data/####/classes2.dex (deleted)
- /data/data/####/classes2.dex.flock (deleted)
- /data/data/####/com.kelongyiqu.l_preferences.xml
- /data/data/####/data.mdb
- /data/data/####/e1a21ff46f6b77cc_0
- /data/data/####/e1a21ff46f6b77cc_1
- /data/data/####/f1ee2504bdc9041c_0
- /data/data/####/f1ee2504bdc9041c_1
- /data/data/####/f22c911d7a9b2183_0 (deleted)
- /data/data/####/index
- /data/data/####/jgobfppppp
- /data/data/####/jgobfppppp (deleted)
- /data/data/####/libjiagu.so
- /data/data/####/lock.mdb
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
- /data/data/####/zy_ad.xml
- /data/data/####/zy_agrts.xml
- /data/data/####/zy_agrts.xml.bak
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
- libobjectbox-jni
- libop_ssl
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5PADDING
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5PADDING
Uses special library to hide executable bytecode.
Gets information about network.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
