Technical information
Malicious functions:
Sends data about device contacts to a remote host.
Sends data of incoming SMS to a remote host.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.0.0.1:7911
- TCP(HTTP/1.1) api.ra####.live:443
- TCP(TLS/1.0) api.ra####.live:7000
- TCP(TLS/1.0) api.ra####.live:443
DNS requests:
- a####.ra####.live
- api.ra####.live
HTTP GET requests:
- api.ra####.live:443/api/agent/query.json?deviceId=####
- api.ra####.live:443/api/containerApi/getCacheTask?containerCode=####&dev...
- api.ra####.live:443/api/device/mainPackageName?deviceId=####
- api.ra####.live:443/api/listen/windows.json?containerCode=####&deviceId=...
- api.ra####.live:443/api/locateValue/entryAppMap.json?deviceId=####&langC...
- api.ra####.live:443/api/pairKeyFile/query.json?deviceId=####
- api.ra####.live:443/api/smsRecognize/plug.json?deviceId=####
- api.ra####.live:443/bridge
- api.ra####.live:443/download/file/843926274171092992.ini
HTTP POST requests:
- api.ra####.live:443/api/contact/post.json
- api.ra####.live:443/api/device/register.json
- api.ra####.live:443/api/message/post.json
- api.ra####.live:443/api/package/post.json
- api.ra####.live:443/api/permission/post.json
- api.ra####.live:443/api/smsMessage/post.json
File system changes:
Creates the following files:
- /data/data/####/Cookies;api.rathat.live.xml
- /data/data/####/DEVICE_UNIQUE_ID.xml
- /data/data/####/batteryPercent.xml
- /data/data/####/batteryStatus.xml
- /data/data/####/deviceId.xml
- /data/data/####/isRoot.xml
- /data/data/####/mainPackageName.xml
- /data/data/####/screenMetrics.xml
- /data/data/####/screenState.xml
- /data/data/####/syncContacts.xml
- /data/data/####/syncPackages.xml
- /data/data/####/syncSmsMessage.xml
- /data/data/####/systemLangCode.xml
- /data/data/####/wifiState.xml
- /data/misc/####/primary.prof
- /storage/emulated/####/cert.pem (deleted)
- /storage/emulated/####/frpc.ini
- /storage/emulated/####/frpc.ini (deleted)
- /storage/emulated/####/libfrpc.so.error.log (deleted)
- /storage/emulated/####/libfrpc.so.out.log (deleted)
- /storage/emulated/####/listenWindows.json
- /storage/emulated/####/listenWindows.json (deleted)
- /storage/emulated/####/locateValues.json
- /storage/emulated/####/locateValues.json (deleted)
- /storage/emulated/####/private.key (deleted)
- /storage/emulated/####/smsRecognizePlugs.json
- /storage/emulated/####/smsRecognizePlugs.json (deleted)
Miscellaneous:
Executes the following shell scripts:
- /data/app/~~zxbsRfASVm1sshMX9jgq1Q==/<Package>-UQo2fSEhogXOq4J3Xs9M4Q==/lib/arm64/libfrpc.so -c /storage/emulated/0/Android/data/<Package>/files/frpc.ini
- echo root
- sh
- su
Uses elevated priveleges.
Accesses the ITelephony private interface.
Gets information about location.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Gets information about installed apps.
Gets information about accounts associated with the device.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Intercepts notifications.
Requests the system alert window permission.
Attempts to detect sandbox environment.
