Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.5836
Sends data about device contacts to a remote host.
Sends data of incoming SMS to a remote host.
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.instal####.co.kr:80
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) 1####.177.14.102:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP www.cloudf####.com:443
- TCP 1####.247.247.147:1883
- UDP gmscomp####.google####.com:443
DNS requests:
- 1####.instal####.co.kr
- and####.a####.go####.com
- and####.google####.com
- connect####.gst####.com
- gmscomp####.google####.com
- p####.google####.com
- rr2---s####.g####.com
- rr9---s####.g####.com
- www.cloudf####.com
- www.google####.com
HTTP GET requests:
- 1####.instal####.co.kr/api/connect/dc8f869c-5646-4975-bb8b-db3bff4c36a5
HTTP POST requests:
- 1####.instal####.co.kr/api/contacts/dc8f869c-5646-4975-bb8b-db3bff4c36a5
- 1####.instal####.co.kr/api/images/dc8f869c-5646-4975-bb8b-db3bff4c36a5
- 1####.instal####.co.kr/api/login
- 1####.instal####.co.kr/api/messages/dc8f869c-5646-4975-bb8b-db3bff4c36a5
- 1####.instal####.co.kr/api/phone/add_key_value?imei=####&key=####&value=...
- 1####.instal####.co.kr/api/phones
File system changes:
Creates the following files:
- /data/data/####/l77ed4170.so
- /data/data/####/mqttAndroidService.db-journal
- /data/data/####/proc_auxv
- /data/data/####/vbp.dex
- /data/data/####/vbp.odex
- /data/data/####/vbp.odex.flock (deleted)
- /data/media/####/.lck
- /data/media/####/.lck (deleted)
- /data/media/####/1713586778602284.jpeg
- /data/media/####/171358678531196.jpeg
- /data/media/####/1713586789029971.jpeg
- /data/media/####/1713586795854294.jpeg
- /data/media/####/1713586799348522.jpeg
- /data/media/####/1713586803037961.jpeg
- /data/media/####/1713586806047608.jpeg
- /data/media/####/1713586811369475.jpeg
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- l77ed4170
- libmmkv
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Gets information about accounts associated with the device.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
Requests the system alert window permission.
