Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.986.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) sqs.ap-nort####.amazo####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 1####.251.1.100:443
- TCP(TLS/1.2) and####.google####.com:443
- UDP 1####.194.220.95:443
- UDP and####.google####.com:443
DNS requests:
- 2.and####.p####.####.org
- and####.google####.com
- gmscomp####.google####.com
- sqs.ap-nort####.amazo####.com
- www.google####.com
HTTP POST requests:
- sqs.ap-nort####.amazo####.com:443/664144478517/report_queue_svc
File system changes:
Creates the following files:
- /data/data/####/.browser_com_browser.meta
- /data/data/####/19
- /data/data/####/2022-11-18AM094457.str
- /data/data/####/29
- /data/data/####/CDL133S7TK2WQGGIYD7DWYW2DEPXH6D.dex
- /data/data/####/CDL133S7TK2WQGGIYD7DWYW2DEPXH6D.dex.flock (deleted)
- /data/data/####/CDL133S7TK2WQGGIYD7DWYW2DEPXH6D.zip
- /data/data/####/HVHSJ98P53VM2RH16CB49K4CLS1Z24Y.dex
- /data/data/####/HVHSJ98P53VM2RH16CB49K4CLS1Z24Y.dex.flock (deleted)
- /data/data/####/HVHSJ98P53VM2RH16CB49K4CLS1Z24Y.zip
- /data/data/####/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex
- /data/data/####/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex.flock (deleted)
- /data/data/####/empty_classes.dex
- /data/data/####/empty_classes.zip
- /data/data/####/lastReportSendTimeFile
- /data/data/####/proc_auxv
- /data/data/####/sealed1.obk
- /data/data/####/sealeh.bdc
- /data/data/####/stat1
- /data/data/####/working
Miscellaneous:
Executes the following shell scripts:
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/HVHSJ98P53VM2RH16CB49K4CLS1Z24Y.zip.cur.prof
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/CDL133S7TK2WQGGIYD7DWYW2DEPXH6D.odex
- chmod 777 /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/oat/arm/HVHSJ98P53VM2RH16CB49K4CLS1Z24Y.odex
- cp /data/user/0/<Package>/app_payload_lib/empty_classes.dex /data/user/0/<Package>/app_payload_lib/<Package>/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex
- cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/CDL133S7TK2WQGGIYD7DWYW2DEPXH6D.zip
- cp /data/user/0/<Package>/app_payload_lib/empty_classes.zip /data/user/0/<Package>/app_payload_lib/<Package>_empty_classes/HVHSJ98P53VM2RH16CB49K4CLS1Z24Y.zip
- dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex --oat-file=/data/user/0/<Package>/cache/<Package>/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex --compiler-filter=verify-none --instruction-set=x86
- getprop ro.dalvik.vm.isa.arm
- getprop ro.dalvik.vm.isa.arm64
- sh -c dex2oat --dex-file=/data/user/0/<Package>/app_payload_lib/<Package>/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex --oat-file=/data/user/0/<Package>/cache/<Package>/PHH257OMO0QL7779K55RR4AYXW7204ZG.dex --compiler-filter=verify-none --instruction-set=x86
Loads the following dynamic libraries:
- libcovault-appsec
Uses administrator priveleges.
Gets information about network.
Gets information about active device administrators.
Gets information about installed apps.
Displays its own windows over windows of other apps.
