Technical information
Malicious functions:
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) 1####.177.14.94:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) rr4---s####.g####.com:443
- TCP(TLS/1.0) rr6---s####.g####.com:443
- TCP(TLS/1.0) cdn.tap####.ir:443
- TCP(TLS/1.0) api.tap####.ir:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) rr8---s####.g####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) poly####.io:443
- TCP(TLS/1.2) 1####.177.14.94:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- TCP(TLS/1.2) p####.google####.com:443
- UDP 85.1####.117.144:443
- UDP p####.google####.com:443
- UDP 85.1####.117.141:443
DNS requests:
- and####.a####.go####.com
- and####.cli####.go####.com
- and####.google####.com
- api.tap####.ir
- back####.tap####.ir
- cdn.tap####.ir
- https:/####.go####.com
- https:/####.go####.com.####.8
- https:/####.googl####.net
- https:/####.googl####.net.####.8
- p####.google####.com
- p####.tap####.ir
- pla####.google####.com
- pla####.googleu####.com
- poly####.io
- rr4---s####.g####.com
- rr6---s####.g####.com
- rr8---s####.g####.com
- sto####.back####.com
File system changes:
Creates the following files:
- /data/data/####/2704ea418eaf26bf_0
- /data/data/####/3f977b6eb78b37a2_0
- /data/data/####/4dd5d484-5ea0-4dd8-82d0-a339c147a501
- /data/data/####/5fb41e41c07a3984_0
- /data/data/####/681f6b4df5ea8d3b_0
- /data/data/####/828a8cfd6e7fd533_0
- /data/data/####/828a8cfd6e7fd533_1
- /data/data/####/9092b7270b7407d0_0
- /data/data/####/BackgroundLogger.db-journal
- /data/data/####/Cookies-journal
- /data/data/####/EzVvdC2HCAyswmNe9eC475Zl8Rk
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MToyMjE1NzE4NDEzM...gw.xml
- /data/data/####/TapseelPreferences.xml
- /data/data/####/TapseelPreferences.xml.bak
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/a7ec7625aaf2068a_0
- /data/data/####/a7ec7625aaf2068a_1
- /data/data/####/accounts_valuestore.pb.lock
- /data/data/####/ad83d85f-bce6-4f5c-a3e5-e3db04201d58
- /data/data/####/ad_id_valuestore.pb
- /data/data/####/ad_id_valuestore.pb.lock
- /data/data/####/ad_id_valuestore.pb.tmp
- /data/data/####/apk_processor_valuestore.pb.tmp
- /data/data/####/app_usage_stats_valuestore.pb.tmp
- /data/data/####/auto_update.db-journal
- /data/data/####/background_counters.db-journal
- /data/data/####/background_system_job_valuestore.pb
- /data/data/####/background_system_job_valuestore.pb.tmp
- /data/data/####/bcfc4f1e-fdef-42da-a10b-06019e78d63b
- /data/data/####/bkoodb.ttf
- /data/data/####/cache_performance_summary.db-journal
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/co.ronash.pushe.keystore.xml.bak
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gcm.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.clearcut_client#com.andr...7872-1
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.android.libraries.consentverifier#co...3889-5
- /data/data/####/com.google.android.libraries.mdi.sync#com.andro...9881-2
- /data/data/####/com.google.android.libraries.onegoogle#com.andr...5010-0
- /data/data/####/com.google.android.libraries.personalization.fo...3210-4
- /data/data/####/counters.db-journal
- /data/data/####/data_loader_readlogs_cache_metadata_valuestore.pb.lock
- /data/data/####/dataloader_failure_valuestore.pb.lock
- /data/data/####/device_id.xml.xml
- /data/data/####/dfae944044dabe7c_0
- /data/data/####/download_service-journal
- /data/data/####/download_service_preferences_key.xml
- /data/data/####/event_generator.xml
- /data/data/####/event_generator_6.xml
- /data/data/####/eventlog.store1314121468.log
- /data/data/####/eventlog.store1543921735.log
- /data/data/####/eventlog.store1598373908.log
- /data/data/####/eventlog.store1720217168.log
- /data/data/####/eventlog.store1753265253.log
- /data/data/####/eventlog.store24333854.log
- /data/data/####/eventlog.store296368306.log
- /data/data/####/eventlog.store358206062.log
- /data/data/####/eventlog.store537150601.log
- /data/data/####/eventlog.store603156737.log
- /data/data/####/eventlog.store744093885.log
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/experiment-flags-process-stable
- /data/data/####/experiment-flags-regular-null-account
- /data/data/####/f3b91631829b63f8_0
- /data/data/####/finsky.xml
- /data/data/####/frosting.db-journal
- /data/data/####/generatefid.lock
- /data/data/####/gfbfv11507903998old
- /data/data/####/gfbfv12089870783old
- /data/data/####/gfbfv1850484594old
- /data/data/####/gi.barrk.sooor.ghorann_preferences.xml
- /data/data/####/gmscompliance.pb
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/hygiene_valuestore.pb
- /data/data/####/hygiene_valuestore.pb.tmp
- /data/data/####/index
- /data/data/####/installed_apks_valuestore.pb.tmp
- /data/data/####/language_split_per_app_valuestore.pb.lock
- /data/data/####/localappstate.db-journal
- /data/data/####/logs_upload_attempt.log
- /data/data/####/main_scheduler_preferences_valuestore.pb.tmp
- /data/data/####/main_system_job_valuestore.pb
- /data/data/####/main_system_job_valuestore.pb.tmp
- /data/data/####/metrics_guid
- /data/data/####/p_com.android.vending1532098693.apk
- /data/data/####/p_config.en313248557.apk
- /data/data/####/p_config.x86_64459302310.apk
- /data/data/####/payload_valuestore.pb
- /data/data/####/payload_valuestore.pb.tmp
- /data/data/####/permission_revocation_valuestore.pb.tmp
- /data/data/####/phenotype.db
- /data/data/####/phenotype.db-journal
- /data/data/####/phenotype.db-journal (deleted)
- /data/data/####/phenotype.db-shm (deleted)
- /data/data/####/phenotype.db-wal (deleted)
- /data/data/####/phonesky_header_valuestore.pb
- /data/data/####/phonesky_header_valuestore.pb.lock
- /data/data/####/phonesky_header_valuestore.pb.tmp
- /data/data/####/play_metalog.log
- /data/data/####/proc_background.pb.tmp
- /data/data/####/quick_launch_counters.db-journal
- /data/data/####/scheduler_background-journal
- /data/data/####/scheduler_main-journal
- /data/data/####/selfupdate_scheduler.xml
- /data/data/####/server_logs_cookie_valuestore.pb.lock
- /data/data/####/setup_status_observer_valuestore.pb.tmp
- /data/data/####/store_update_checker_valuestore.pb.tmp
- /data/data/####/streamdatastore.db-journal
- /data/data/####/temp-experiment-flags-process-stable
- /data/data/####/temp-experiment-flags-regular-null-account
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/unified_sync_accounts_valuestore.pb
- /data/data/####/unified_sync_accounts_valuestore.pb.tmp
- /data/data/####/update_prompt_valuestore.pb.lock
- /data/data/####/verify_apps.db-journal
- /data/misc/####/primary.prof
- /data/user_de/####/com.google.android.libraries.performance.pri...2037-3
- /data/user_de/####/com.google.android.libraries.performance.pri...ing.pb
Miscellaneous:
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about APN settings.
Gets information about active device administrators.
Gets information about installed apps.
Gets information about accounts associated with the device.
Displays its own windows over windows of other apps.
