Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Siggen.Susp.17865
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) www.a####.ru:443
- TCP(TLS/1.0) 1####.250.74.35:443
- TCP(TLS/1.0) g####.face####.com:443
- TCP(TLS/1.2) 1####.250.74.46:443
- TCP(TLS/1.2) 1####.250.74.68:443
- TCP(TLS/1.2) 1####.217.21.174:443
- TCP(TLS/1.2) 1####.250.74.35:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP www.a####.ru:443
DNS requests:
- and####.google####.com
- app.ad####.com
- d####.fl####.com
- g####.face####.com
- gmscomp####.google####.com
- p####.google####.com
- rr9---s####.g####.com
- sett####.crashly####.com
- www.a####.ru
- www.google####.com
HTTP GET requests:
- app.ad####.com:443/attribution?needs_response_details=####&gps_adid=####...
HTTP POST requests:
- app.ad####.com:443/event
- app.ad####.com:443/session
- d####.fl####.com:443/aap.do
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_8D566RPC...7P_249
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.yflurrydatasenderblock.06a28842-a26e-4432-9778...86707d
- /data/data/####/.yflurryreport.-4e34ea4531b6ef94
- /data/data/####/678505B10293-0001-0F8B-99240F7E92E9BeginSession.cls
- /data/data/####/678505B10293-0001-0F8B-99240F7E92E9SessionApp.cls
- /data/data/####/678505B10293-0001-0F8B-99240F7E92E9SessionApp.cls_temp
- /data/data/####/678505B10293-0001-0F8B-99240F7E92E9SessionOS.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9BeginSession.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionApp.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionApp.cls_temp
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionDevice.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionEvent...01.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionEvent...02.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionEvent...s_temp
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionOS.cls
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9SessionOS.cls_temp
- /data/data/####/678505B402A0-0001-0FF0-99240F7E92E9keys.meta
- /data/data/####/94f76cf5-ce32-4609-9392-bbc2deb0703c
- /data/data/####/AdjustIoActivityState
- /data/data/####/AdjustIoPackageQueue
- /data/data/####/AdjustSessionCallbackParameters
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/admob.xml
- /data/data/####/avito_brite.db-journal
- /data/data/####/avito_data.db-journal
- /data/data/####/com.avito.android_preferences.xml
- /data/data/####/com.avito.android_preferences.xml.bak
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/crashlytics-userlog-678505B402A0-0001-0FF0-9924...9.temp
- /data/data/####/crashlytics-userlog-678505B402A0-0001-0FF0-9924...leted)
- /data/data/####/crashlytics-userlog-678505B402A0-0001-0FF0-9924...mp.tmp
- /data/data/####/evernote_jobs.db
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/initialization_marker (deleted)
- /data/data/####/journal
- /data/data/####/libdexprotector.1lfglej.4080.so
- /data/data/####/metrics_guid
- /data/data/####/new.apk
- /data/data/####/new.odex
- /data/data/####/new.odex.flock (deleted)
- /data/data/####/proc_auxv
- /data/data/####/sa_668633e2-8209-4457-b888-1fe7751eb4ab_1736771058195.tap
- /data/data/####/sa_6847872e-9f54-4ca4-bfc2-53692892e1f8_1736771005744.tap
- /data/data/####/sa_be3ae37e-4305-4c19-90f8-7c7586826d9d_1736771051660.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- cat /dev/qemu_pipe
- cat /dev/socket/qemud
- cat /proc/tty/drivers
- cat /sys/qemu_trace
- getprop
- ls /dev/qemu_pipe
- ls /dev/socket/qemud
- ls /sys/qemu_trace
Loads the following dynamic libraries:
- libcrashlytics
- libdexprotector.1lfglej.4080
Gets information about network.
Displays its own windows over windows of other apps.
