Android.Spy.5004

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Spy.996.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) and####.a####.go####.com:443
TCP(TLS/1.0) 64.2####.165.95:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) and####.b####.qq.com:443
TCP(TLS/1.0) pla####.google####.com:443
TCP(TLS/1.0) rr1---s####.g####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.2) 64.2####.165.95:443
TCP(TLS/1.2) 64.2####.164.94:443
UDP and####.google####.com:443
UDP rr1---s####.g####.com:443
UDP 64.2####.165.95:443
UDP rr2---s####.g####.com:443

DNS requests:

and####.a####.go####.com
and####.b####.qq.com
and####.google####.com
app-mea####.com
f####.google####.com
gmscomp####.google####.com
m####.go####.com
p####.google####.com
pla####.google####.com
rr1---s####.g####.com
rr2---s####.g####.com

HTTP POST requests:

and####.b####.qq.com:443/rqd/async?aid=####

File system changes:

Creates the following files:

/data/data/####/1.mp3
/data/data/####/1004
/data/data/####/2.mp3
/data/data/####/3.mp3
/data/data/####/4.mp3
/data/data/####/6ee5a16ab022937f_0
/data/data/####/7API.RSA
/data/data/####/7API.SF
/data/data/####/AndroidManifest.xml
/data/data/####/Annotations.gwt.xml
/data/data/####/Cookies-journal
/data/data/####/Google_internal.gwt.xml
/data/data/####/Jsr305_annotations.gwt.xml
/data/data/####/PDonut.js
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/abc_ab_share_pack_mtrl_alpha.9.png
/data/data/####/abc_action_bar_item_background_material.xml
/data/data/####/abc_action_bar_title_item.xml
/data/data/####/abc_action_bar_up_container.xml
/data/data/####/abc_action_menu_item_layout.xml
/data/data/####/abc_action_menu_layout.xml
/data/data/####/abc_action_mode_bar.xml
/data/data/####/abc_action_mode_close_item_material.xml
/data/data/####/abc_activity_chooser_view.xml
/data/data/####/abc_activity_chooser_view_list_item.xml
/data/data/####/abc_alert_dialog_button_bar_material.xml
/data/data/####/abc_alert_dialog_material.xml
/data/data/####/abc_alert_dialog_title_material.xml
/data/data/####/abc_background_cache_hint_selector_material_dark.xml
/data/data/####/abc_background_cache_hint_selector_material_light.xml
/data/data/####/abc_btn_borderless_material.xml
/data/data/####/abc_btn_check_material.xml
/data/data/####/abc_btn_check_to_on_mtrl_000.png
/data/data/####/abc_btn_check_to_on_mtrl_015.png
/data/data/####/abc_btn_colored_borderless_text_material.xml
/data/data/####/abc_btn_colored_material.xml
/data/data/####/abc_btn_colored_text_material.xml
/data/data/####/abc_btn_default_mtrl_shape.xml
/data/data/####/abc_btn_radio_material.xml
/data/data/####/abc_btn_radio_to_on_mtrl_000.png
/data/data/####/abc_btn_radio_to_on_mtrl_015.png
/data/data/####/abc_btn_switch_to_on_mtrl_00001.9.png
/data/data/####/abc_btn_switch_to_on_mtrl_00012.9.png
/data/data/####/abc_cab_background_internal_bg.xml
/data/data/####/abc_cab_background_top_material.xml
/data/data/####/abc_cab_background_top_mtrl_alpha.9.png
/data/data/####/abc_cascading_menu_item_layout.xml
/data/data/####/abc_color_highlight_material.xml
/data/data/####/abc_control_background_material.xml
/data/data/####/abc_dialog_material_background.xml
/data/data/####/abc_dialog_title_material.xml
/data/data/####/abc_edit_text_material.xml
/data/data/####/abc_expanded_menu_layout.xml
/data/data/####/abc_fade_in.xml
/data/data/####/abc_fade_out.xml
/data/data/####/abc_grow_fade_in_from_bottom.xml
/data/data/####/abc_hint_foreground_material_dark.xml
/data/data/####/abc_hint_foreground_material_light.xml
/data/data/####/abc_ic_ab_back_material.xml
/data/data/####/abc_ic_arrow_drop_right_black_24dp.xml
/data/data/####/abc_ic_clear_material.xml
/data/data/####/abc_ic_commit_search_api_mtrl_alpha.png
/data/data/####/abc_ic_go_search_api_material.xml
/data/data/####/abc_ic_menu_copy_mtrl_am_alpha.png
/data/data/####/abc_ic_menu_cut_mtrl_alpha.png
/data/data/####/abc_ic_menu_overflow_material.xml
/data/data/####/abc_ic_menu_paste_mtrl_am_alpha.png
/data/data/####/abc_ic_menu_selectall_mtrl_alpha.png
/data/data/####/abc_ic_menu_share_mtrl_alpha.png
/data/data/####/abc_ic_search_api_material.xml
/data/data/####/abc_ic_star_black_16dp.png
/data/data/####/abc_ic_star_black_36dp.png
/data/data/####/abc_ic_star_black_48dp.png
/data/data/####/abc_ic_star_half_black_16dp.png
/data/data/####/abc_ic_star_half_black_36dp.png
/data/data/####/abc_ic_star_half_black_48dp.png
/data/data/####/abc_ic_voice_search_api_material.xml
/data/data/####/abc_item_background_holo_dark.xml
/data/data/####/abc_item_background_holo_light.xml
/data/data/####/abc_list_divider_material.xml
/data/data/####/abc_list_divider_mtrl_alpha.9.png
/data/data/####/abc_list_focused_holo.9.png
/data/data/####/abc_list_longpressed_holo.9.png
/data/data/####/abc_list_menu_item_checkbox.xml
/data/data/####/abc_list_menu_item_icon.xml
/data/data/####/abc_list_menu_item_layout.xml
/data/data/####/abc_list_menu_item_radio.xml
/data/data/####/abc_list_pressed_holo_dark.9.png
/data/data/####/abc_list_pressed_holo_light.9.png
/data/data/####/abc_list_selector_background_transition_holo_dark.xml
/data/data/####/abc_list_selector_background_transition_holo_light.xml
/data/data/####/abc_list_selector_disabled_holo_dark.9.png
/data/data/####/abc_list_selector_disabled_holo_light.9.png
/data/data/####/abc_list_selector_holo_dark.xml
/data/data/####/abc_list_selector_holo_light.xml
/data/data/####/abc_menu_hardkey_panel_mtrl_mult.9.png
/data/data/####/abc_popup_background_mtrl_mult.9.png
/data/data/####/abc_popup_enter.xml
/data/data/####/abc_popup_exit.xml
/data/data/####/abc_popup_menu_header_item_layout.xml
/data/data/####/abc_popup_menu_item_layout.xml
/data/data/####/abc_primary_text_disable_only_material_dark.xml
/data/data/####/abc_primary_text_disable_only_material_light.xml
/data/data/####/abc_primary_text_material_dark.xml
/data/data/####/abc_primary_text_material_light.xml
/data/data/####/abc_ratingbar_indicator_material.xml
/data/data/####/abc_ratingbar_material.xml
/data/data/####/abc_ratingbar_small_material.xml
/data/data/####/abc_screen_content_include.xml
/data/data/####/abc_screen_simple.xml
/data/data/####/abc_screen_simple_overlay_action_mode.xml
/data/data/####/abc_screen_toolbar.xml
/data/data/####/abc_scrubber_control_off_mtrl_alpha.png
/data/data/####/abc_scrubber_control_to_pressed_mtrl_000.png
/data/data/####/abc_scrubber_control_to_pressed_mtrl_005.png
/data/data/####/abc_scrubber_primary_mtrl_alpha.9.png
/data/data/####/abc_scrubber_track_mtrl_alpha.9.png
/data/data/####/abc_search_dropdown_item_icons_2line.xml
/data/data/####/abc_search_url_text.xml
/data/data/####/abc_search_view.xml
/data/data/####/abc_secondary_text_material_dark.xml
/data/data/####/abc_secondary_text_material_light.xml
/data/data/####/abc_seekbar_thumb_material.xml
/data/data/####/abc_seekbar_tick_mark_material.xml
/data/data/####/abc_seekbar_track_material.xml
/data/data/####/abc_select_dialog_material.xml
/data/data/####/abc_shrink_fade_out_from_bottom.xml
/data/data/####/abc_slide_in_bottom.xml
/data/data/####/abc_slide_in_top.xml
/data/data/####/abc_slide_out_bottom.xml
/data/data/####/abc_slide_out_top.xml
/data/data/####/abc_spinner_mtrl_am_alpha.9.png
/data/data/####/abc_spinner_textfield_background_material.xml
/data/data/####/abc_switch_thumb_material.xml
/data/data/####/abc_switch_track_mtrl_alpha.9.png
/data/data/####/abc_tab_indicator_material.xml
/data/data/####/abc_tab_indicator_mtrl_alpha.9.png
/data/data/####/abc_text_cursor_material.xml
/data/data/####/abc_text_select_handle_left_mtrl_dark.png
/data/data/####/abc_text_select_handle_left_mtrl_light.png
/data/data/####/abc_text_select_handle_middle_mtrl_dark.png
/data/data/####/abc_text_select_handle_middle_mtrl_light.png
/data/data/####/abc_text_select_handle_right_mtrl_dark.png
/data/data/####/abc_text_select_handle_right_mtrl_light.png
/data/data/####/abc_textfield_activated_mtrl_alpha.9.png
/data/data/####/abc_textfield_default_mtrl_alpha.9.png
/data/data/####/abc_textfield_search_activated_mtrl_alpha.9.png
/data/data/####/abc_textfield_search_default_mtrl_alpha.9.png
/data/data/####/abc_textfield_search_material.xml
/data/data/####/abc_tint_btn_checkable.xml
/data/data/####/abc_tint_default.xml
/data/data/####/abc_tint_edittext.xml
/data/data/####/abc_tint_seek_thumb.xml
/data/data/####/abc_tint_spinner.xml
/data/data/####/abc_tint_switch_track.xml
/data/data/####/abc_tooltip.xml
/data/data/####/abc_tooltip_enter.xml
/data/data/####/abc_tooltip_exit.xml
/data/data/####/abc_vector_test.xml
/data/data/####/access_mark.gif
/data/data/####/android.arch.core_runtime.version
/data/data/####/android.arch.lifecycle_livedata-core.version
/data/data/####/android.arch.lifecycle_livedata.version
/data/data/####/android.arch.lifecycle_runtime.version
/data/data/####/android.arch.lifecycle_viewmodel.version
/data/data/####/androidx.appcompat_appcompat.version
/data/data/####/androidx.coordinatorlayout_coordinatorlayout.version
/data/data/####/androidx.core_core.version
/data/data/####/androidx.customview_customview.version
/data/data/####/androidx.documentfile_documentfile.version
/data/data/####/androidx.fragment_fragment.version
/data/data/####/androidx.interpolator_interpolator.version
/data/data/####/androidx.legacy_legacy-support-core-ui.version
/data/data/####/androidx.print_print.version
/data/data/####/androidx.slidingpanelayout_slidingpanelayout.version
/data/data/####/androidx.vectordrawable_vectordrawable-animated.version
/data/data/####/androidx.vectordrawable_vectordrawable.version
/data/data/####/androidx.versionedparcelable_versionedparcelable.version
/data/data/####/app.html
/data/data/####/ark.css
/data/data/####/banner_webaward.gif
/data/data/####/bg_btn_yellow.gif
/data/data/####/bg_ctg_line.png
/data/data/####/bg_ctg_open.png
/data/data/####/bg_footer_util.gif
/data/data/####/bg_ic_gnb_util.gif
/data/data/####/bg_mgnb_01.gif
/data/data/####/bg_mgnb_02.gif
/data/data/####/bg_quick_line.png
/data/data/####/bg_util_search.gif
/data/data/####/bn_mask_img.gif
/data/data/####/bn_thumb_event01.gif
/data/data/####/bn_thumb_event02.gif
/data/data/####/bn_thumb_event03.gif
/data/data/####/bn_thumb_notify01.gif
/data/data/####/bn_thumb_notify02.gif
/data/data/####/bn_thumb_notify03.gif
/data/data/####/btn_close.gif
/data/data/####/btn_more.png
/data/data/####/btn_search_sch.gif
/data/data/####/btn_top_r.png
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/com.pegPDL.qAVdqo_preferences.xml
/data/data/####/common.css
/data/data/####/common.js
/data/data/####/commonPub.js
/data/data/####/common_dialog_content.xml
/data/data/####/contents.css
/data/data/####/cpn_tit_img.gif
/data/data/####/crashrecord.xml
/data/data/####/default.js
/data/data/####/exo_player_control_view.xml
/data/data/####/file_details_fragment.xml
/data/data/####/file_paths.xml
/data/data/####/fontsize.js
/data/data/####/foot_select.gif
/data/data/####/foot_select2.gif
/data/data/####/gid
/data/data/####/gnb_all_menu.gif
/data/data/####/gnb_bk.png
/data/data/####/gnb_card.gif
/data/data/####/gnb_company.gif
/data/data/####/gnb_info.gif
/data/data/####/gnb_privacy.gif
/data/data/####/gnb_product.gif
/data/data/####/gnb_quick.js
/data/data/####/gnb_service.gif
/data/data/####/gnb_util01.gif
/data/data/####/gnb_util02.gif
/data/data/####/gnb_util03.gif
/data/data/####/gnb_util04.gif
/data/data/####/gnb_util05.gif
/data/data/####/gnb_util06.gif
/data/data/####/gnb_util_dataopen.gif
/data/data/####/gnb_util_mypage.gif
/data/data/####/h1_logo_sub.gif
/data/data/####/h3_loan_total.gif
/data/data/####/h3_onebank.gif
/data/data/####/happy_logo.jpg
/data/data/####/huokuan.html
/data/data/####/ibk_common.js
/data/data/####/ic_launcher.png
/data/data/####/ic_youtube_new.gif
/data/data/####/icon_home.gif
/data/data/####/icon_slider_arrow_big_spr.png
/data/data/####/icon_slider_arrow_small_spr.png
/data/data/####/icon_slider_dot_type01_spr.png
/data/data/####/icon_slider_dot_type02_spr.png
/data/data/####/icon_slider_func_spr.png
/data/data/####/index
/data/data/####/insight.js
/data/data/####/jquery-1.9.1.min.js
/data/data/####/jquery-ui-1.10.3.custom.min.js
/data/data/####/jquery.cookie.js
/data/data/####/layout.css
/data/data/####/libBugly.so
/data/data/####/libdn_ssl.so
/data/data/####/lmendb.apk
/data/data/####/loading.xml
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/main.css
/data/data/####/mainNew.css
/data/data/####/metrics_guid
/data/data/####/modernizr.js
/data/data/####/native_record_lock
/data/data/####/notification_action.xml
/data/data/####/notification_action_background.xml
/data/data/####/notification_action_tombstone.xml
/data/data/####/notification_bg.xml
/data/data/####/notification_bg_low.xml
/data/data/####/notification_bg_low_normal.9.png
/data/data/####/notification_bg_low_pressed.9.png
/data/data/####/notification_bg_normal.9.png
/data/data/####/notification_bg_normal_pressed.9.png
/data/data/####/notification_icon_background.xml
/data/data/####/notification_media_action.xml
/data/data/####/notification_media_cancel_action.xml
/data/data/####/notification_template_big_media.xml
/data/data/####/notification_template_big_media_custom.xml
/data/data/####/notification_template_big_media_narrow.xml
/data/data/####/notification_template_big_media_narrow_custom.xml
/data/data/####/notification_template_custom_big.xml
/data/data/####/notification_template_icon_group.xml
/data/data/####/notification_template_lines_media.xml
/data/data/####/notification_template_media.xml
/data/data/####/notification_template_media_custom.xml
/data/data/####/notification_template_part_chronometer.xml
/data/data/####/notification_template_part_time.xml
/data/data/####/notification_tile_bg.xml
/data/data/####/notify_panel_notification_icon_bg.png
/data/data/####/ok.html
/data/data/####/pro_tit_img.gif
/data/data/####/proc_auxv
/data/data/####/resources.arsc
/data/data/####/rwd_default.js
/data/data/####/rwd_footer.js
/data/data/####/rwd_slider_main.js
/data/data/####/rwd_ui_new.js
/data/data/####/savbcn.sz
/data/data/####/secret-classes.dex
/data/data/####/secret-classes.dex.flock (deleted)
/data/data/####/select_dialog_item_material.xml
/data/data/####/select_dialog_multichoice_material.xml
/data/data/####/select_dialog_singlechoice_material.xml
/data/data/####/sns_blog_new.gif
/data/data/####/sns_facebook_new.gif
/data/data/####/sns_instagram_new.gif
/data/data/####/sns_naverpost_new.gif
/data/data/####/sns_twitter_new.gif
/data/data/####/subutils.js
/data/data/####/support_simple_spinner_dropdown_item.xml
/data/data/####/switch_thumb_material_dark.xml
/data/data/####/switch_thumb_material_light.xml
/data/data/####/tag_ibk.js
/data/data/####/the-real-index
/data/data/####/thumb_bn_cpn.gif
/data/data/####/thumb_bn_mask_phone_small.png
/data/data/####/thumb_bn_product.gif
/data/data/####/thumb_product_bg.gif
/data/data/####/thumb_sub_visual01.png
/data/data/####/thumb_sub_visual03.gif
/data/data/####/thumb_sub_visual04.gif
/data/data/####/thumb_sub_visual_mask_phone_small.png
/data/data/####/thumb_visual01_btn.png
/data/data/####/thumb_visual01_img_04.png
/data/data/####/thumb_visual02_btn.png
/data/data/####/thumb_visual02_img_01.png
/data/data/####/thumb_visual02_text_01.png
/data/data/####/thumb_visual02_text_02.png
/data/data/####/thumb_visual03-02_btn.png
/data/data/####/thumb_visual03_img_01_3.png
/data/data/####/thumb_visual04_text_01.png
/data/data/####/thumb_visual04_text_02.png
/data/data/####/thumb_visual05_text_01.png
/data/data/####/thumb_visual05_text_02.png
/data/data/####/tit_onebank.gif
/data/data/####/title_news.png
/data/data/####/title_notify.png
/data/data/####/tooltip_frame_dark.xml
/data/data/####/tooltip_frame_light.xml
/data/data/####/underscore.gif
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

getprop

Loads the following dynamic libraries:

libBugly
libdn_ssl

Gets information about network.

Displays its own windows over windows of other apps.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial