Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) 1####.194.73.95:443
- TCP(TLS/1.0) 64.2####.165.100:443
- TCP(TLS/1.0) 64.2####.161.95:443
- TCP(TLS/1.0) 1####.194.220.95:443
- TCP(TLS/1.0) onesi####.com:443
- TCP(TLS/1.2) 64.2####.165.94:443
- TCP(TLS/1.2) 64.2####.161.95:443
- TCP(TLS/1.2) 64.2####.165.91:443
- TCP(TLS/1.2) 64.2####.165.100:443
DNS requests:
- app-mea####.com
- firebas####.google####.com
- instant####.google####.com
- onesi####.com
File system changes:
Creates the following files:
- /data/data/####/FirebaseAppHeartBeat.xml
- /data/data/####/FirebaseAppHeartBeat.xml.bak
- /data/data/####/GTPlayerPurchases.xml
- /data/data/####/OneSignal.xml
- /data/data/####/PersistedInstallation1240848345tmp
- /data/data/####/PersistedInstallation1398906008tmp
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
Miscellaneous:
Gets information about network.
Gets information about installed apps.
