Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.358.origin
Network activity:
Connects to:
- TCP(???) 1####.24.78.241:9998
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 39.1####.226.196:8801
- TCP(HTTP/1.1) web####.ik####.cn.####.net:80
- TCP(HTTP/1.1) na61-####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) 39.1####.226.196:8802
- TCP(HTTP/1.1) mrtgcl####.ikuk####.com:80
- TCP(TLS/1.2) 1####.251.1.95:443
- TCP(TLS/1.2) 74.1####.205.105:443
- TCP(TLS/1.2) 1####.194.221.95:443
DNS requests:
- mrtgcl####.ikuk####.com
- na61-####.wagbr####.ali####.####.com
- web####.ik####.cn.####.net
HTTP GET requests:
- na61-####.wagbr####.ali####.####.com/service/getIpInfo.php?ip=####
- web####.ik####.cn.####.net/user/article/20250709/1967d8e3-b811-407a-8e7f...
HTTP POST requests:
- 39.1####.226.196:8801/
- 39.1####.226.196:8802/
- mrtgcl####.ikuk####.com/monitor/client/agreement/get
File system changes:
Creates the following files:
- /data/data/####/1079283425.dex
- /data/data/####/1079283425.dex.flock (deleted)
- /data/data/####/1079283425.jar
- /data/data/####/1079283425.jar.temp
- /data/data/####/2d8b3a974771a653f6cc2ee5d88dc341
- /data/data/####/3b7371c07eefca10f31786447962b669
- /data/data/####/6b219deb5c2d6dd05cbd3c089d5ed2d8
- /data/data/####/ccabc51e3be72d1f42c9dd205cc41d23
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/plugin_file.name
- /data/data/####/proc_auxv
- /data/data/####/share_date.xml
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- cat /sys/class/net/eth0/address
- cat /sys/class/net/wlan0/address
- chmod 777 /data/user/0/<Package>/files/.statistic
- sh
- su -c cat /proc/net/xt_qtaguid/stats
Loads the following dynamic libraries:
- libmmkv
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- RSA
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses elevated priveleges.
Gets information about installed apps.
Displays its own windows over windows of other apps.
Attempts to detect sandbox environment.
