Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) kin####.us-ea####.amazo####.com:443
- TCP(TLS/1.0) in####.appsf####.com:443
- TCP(TLS/1.0) rr13---####.g####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) api.appsfly####.com.####.net:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) api.ad####.io:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) convers####.appsf####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) firebas####.crashly####.com:443
- TCP(TLS/1.0) gc####.appsf####.com:443
- TCP(TLS/1.0) api.mixp####.com:443
- TCP(TLS/1.2) firebas####.google####.com:443
- TCP(TLS/1.2) connect####.gst####.com:443
- TCP a####.ampli####.com:443
DNS requests:
- a####.ampli####.com
- and####.a####.go####.com
- and####.google####.com
- api.ad####.io
- api.mixp####.com
- app-mea####.com
- cdn-set####.appsfly####.com
- connect####.gst####.com
- convers####.appsf####.com
- de####.mixp####.com
- firebas####.crashly####.com
- firebas####.google####.com
- gc####.appsf####.com
- gmscomp####.google####.com
- in####.appsf####.com
- kin####.us-ea####.amazo####.com
- m####.go####.com
- p####.google####.com
- pla####.google####.com
- rr13---####.g####.com
HTTP GET requests:
- api.ad####.io:443/api/v1/sdk/analytics/profiles/1eb3455a-da6b-4d14-8b94-...
- api.ad####.io:443/api/v1/sdk/in-apps/purchase-containers/?profile_id=###...
- api.appsfly####.com.####.net:443/android/v1/270b0ebb91ae8818a6d33781fda3...
- api.mixp####.com:443/decide?version=####&lib=####&token=####&distinct_id...
- firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:980159899...
- gc####.appsf####.com:443/install_data/v4.0/<Package>?devkey=####&device_...
HTTP PATCH requests:
- api.ad####.io:443/api/v1/sdk/analytics/profiles/1eb3455a-da6b-4d14-8b94-...
HTTP POST requests:
- api.ad####.io:443/api/v1/sdk/analytics/profiles/1eb3455a-da6b-4d14-8b94-...
- api.ad####.io:443/api/v1/sdk/analytics/profiles/9aac21c0-dcc6-466c-ab35-...
- api.ad####.io:443/api/v1/sdk/analytics/profiles/c87f28a9-f364-42ba-a47b-...
- api.mixp####.com:443/track?ip=####
- convers####.appsf####.com:443/api/v6.5/androidevent?app_id=####&buildnum...
- firebas####.google####.com:443/identitytoolkit/v3/relyingparty/getAccoun...
- firebas####.google####.com:443/identitytoolkit/v3/relyingparty/signupNew...
- firebas####.google####.com:443/v1/projects/avatarify-41225/installations
- in####.appsf####.com:443/api/v6.5/androidevent?app_id=####&buildnumber=#...
- kin####.us-ea####.amazo####.com:443/
File system changes:
Creates the following files:
- /data/data/####/.font3415-3415-0
- /data/data/####/.font3556-3556-0
- /data/data/####/.jg.ac
- /data/data/####/.
- /data/data/####/. .flock (deleted)
- /data/data/####/.
- /data/data/####/. .flock (deleted)
- /data/data/####/.
- /data/data/####/.
- /data/data/####/.
- /data/data/####/AdaptySDKPrefs.xml
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo5ODAxNTk4OTk2N...U1.xml
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo5ODAxNTk4...1.json
- /data/data/####/PersistedInstallation1620492977tmp
- /data/data/####/PersistedInstallation1910262167tmp
- /data/data/####/appsflyer-data.xml
- /data/data/####/avatarify-log.txt
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.oat
- /data/data/####/com.amplitude.api
- /data/data/####/com.amplitude.api-journal
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/com.google.firebase.auth.api.Store.W0RFRkFVTFRd...U1.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/com.mixpanel.android.mpmetrics.Mixpanel.xml
- /data/data/####/com.mixpanel.android.mpmetrics.Mixpanel.xml.bak
- /data/data/####/com.mixpanel.android.mpmetrics.MixpanelAPI.Time...f5.xml
- /data/data/####/com.mixpanel.android.mpmetrics.MixpanelAPI_13f7...f5.xml
- /data/data/####/com.mixpanel.android.mpmetrics.ReferralInfo.xml
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/libjiagu.so
- /data/data/####/libjiagu_64.so
- /data/data/####/mixpanel
- /data/data/####/mixpanel-journal
- /data/data/####/mixpanel.viewcrawler.changes13f751d9fc0abe333d2...f5.xml
- /data/data/####/report
- /data/data/####/start-time
- /data/data/####/userlog.tmp
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu_64
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
