Technical information
Malicious functions:
Sends data about device contacts to a remote host.
Sends data of incoming SMS to a remote host.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) f####.sbs:80
DNS requests:
- f####.sbs
HTTP POST requests:
- f####.sbs/client/a.ashx
- f####.sbs/client/c.ashx
- f####.sbs/client/d.ashx
- f####.sbs/client/g.ashx
- f####.sbs/client/h.ashx
- f####.sbs/client/i.ashx
- f####.sbs/client/j.ashx
File system changes:
Creates the following files:
- /data/data/####/2131689472
- /data/data/####/2131689473
- /data/data/####/2131689475
- /data/data/####/2131689476
- /data/data/####/2131689477
- /data/data/####/2131689478
- /data/data/####/2131689479
- /data/data/####/2131689485
- /data/data/####/dada-journal
- /data/data/####/libandroid-support.so
- /data/data/####/libncursesw.so.6
- /data/data/####/libreadline.so.8
- /data/data/####/libz.so.1
- /data/data/####/normalXml_ssaid_20250830162733416.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/runtimestamp
- /data/data/####/sqlite3
- /data/misc/####/primary.prof
- /databases/dada
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
- getprop ro.miui.ui.version.code
- sh -c getprop ro.miui.ui.version.code
- sh -c which su > /dev/null || exit 1; su -v
- su
- su -v
- which su
- whoami
Uses elevated priveleges.
Accesses the ITelephony private interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
Attempts to detect sandbox environment.
