Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Harly.9.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) 1####.194.221.94:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) h####.dushem####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.2) 2####.58.207.234:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 1####.194.221.102:443
- TCP(TLS/1.2) 1####.250.74.106:443
- TCP(TLS/1.2) 1####.250.74.68:443
- TCP(TLS/1.2) 64.2####.163.138:443
- TCP(TLS/1.2) 1####.194.221.94:443
DNS requests:
- and####.google####.com
- gmscomp####.google####.com
- h####.dushem####.com
- p####.google####.com
File system changes:
Creates the following files:
- /data/data/####/.dex2oatlock
- /data/data/####/.updateIV.dat
- /data/data/####/.updateIV.dat_0
- /data/data/####/.updateIV.dat_1
- /data/data/####/0000000lllll_0.dex
- /data/data/####/0000000lllll_1.dex
- /data/data/####/000O00ll111l_0.dex
- /data/data/####/000O00ll111l_1.dex
- /data/data/####/00O000ll111l_0.dex
- /data/data/####/00O000ll111l_0.dex (deleted)
- /data/data/####/00O000ll111l_0.dex.flock
- /data/data/####/00O000ll111l_0.dex.flock (deleted)
- /data/data/####/00O000ll111l_1.dex
- /data/data/####/00O000ll111l_1.dex (deleted)
- /data/data/####/00O000ll111l_1.dex.flock
- /data/data/####/00O000ll111l_1.dex.flock (deleted)
- /data/data/####/0OO00l111l1l
- /data/data/####/0OO00l111l1l.lock
- /data/data/####/7652e37036cd4d3b_0
- /data/data/####/854208b8caca9fa3_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/com.dushe.movie_preferences.xml
- /data/data/####/crash_dump.log
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/index
- /data/data/####/jsserver_start.log
- /data/data/####/libbreakpad-core.so
- /data/data/####/libc++_shared.so
- /data/data/####/libdcblur.so
- /data/data/####/libdsUtils.so
- /data/data/####/libfreetype.so
- /data/data/####/libgcanvas.so
- /data/data/####/libgifimage.so
- /data/data/####/libijkffmpeg.so
- /data/data/####/libijkplayer.so
- /data/data/####/libijksdl.so
- /data/data/####/libimagepipeline.so
- /data/data/####/libnative-filters.so
- /data/data/####/libnative-imagetranscoder.so
- /data/data/####/libpl_droidsonroids_gif.so
- /data/data/####/libsecsdk.so
- /data/data/####/libshellx-super.com.dushe.movie.so
- /data/data/####/libweexcore.so
- /data/data/####/libweexjsb.so
- /data/data/####/libweexjss.so
- /data/data/####/libweexjst.so
- /data/data/####/metrics_guid
- /data/data/####/o0oooOO0ooOo.dat
- /data/data/####/pdr.xml
- /data/data/####/proc_auxv
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/tosversion
- /data/data/####/weex_default_settings.xml
- /data/misc/####/primary.prof
- /data/user_de/####/move_to_de_records.xml
Miscellaneous:
Executes the following shell scripts:
- <Package>:jse 36 45 1 /data/user/0/<Package>/app_crash/crash_dump.log
- <Package>:jse 45 46 1 /data/user/0/<Package>/app_crash/crash_dump.log
Loads the following dynamic libraries:
- libbreakpad-core
- libc++_shared
- libshellx-super.com.dushe.movie
- libweexcore
Gets information about network.
Displays its own windows over windows of other apps.
