Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) 1####.250.74.67:443
- TCP(TLS/1.0) crashly####.google####.com:443
- TCP(TLS/1.0) 1####.250.74.170:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) 1####.21.32.1:443
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.2) 1####.21.32.1:443
DNS requests:
- app-mea####.com
- app.ad####.com
- crashly####.google####.com
File system changes:
Creates the following files:
- /data/data/####/.ae1752513231359
- /data/data/####/68753A95001400010E1EBE4F03C5F5BF
- /data/data/####/68753ACE01B2000110CDBE4F03C5F5BF
- /data/data/####/AdjustIoActivityState
- /data/data/####/AdjustIoPackageQueue
- /data/data/####/AdjustSessionCallbackParameters
- /data/data/####/Anonymous-DexFile@1097719991.vdex
- /data/data/####/Anonymous-DexFile@1188772955.vdex
- /data/data/####/Anonymous-DexFile@2140979419.vdex
- /data/data/####/FirebaseHeartBeatW0RFRkFVTFRd+MTo5MjA4NzQ4OTMzO...k4.xml
- /data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo5MjA4NzQ4...4.json
- /data/data/####/PersistedInstallation3457381253652780780tmp
- /data/data/####/PersistedInstallation3610923572281887866tmp
- /data/data/####/adjust_preferences.xml
- /data/data/####/app_set_id_storage.xml
- /data/data/####/aqs.40d8f51eac1044e7a1b6eaaba8fe67a8
- /data/data/####/aqs.44da995815524b7b801ece140abb3de4
- /data/data/####/aqs.660749ba790a4141b7dc6cc976ca6025
- /data/data/####/aqs.d183f2ff09d244a38f2be2ad44f85a86
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.google.android.datatransport.events-journal
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.google.firebase.crashlytics.xml
- /data/data/####/crash_marker
- /data/data/####/event0000000000_
- /data/data/####/firebase_session_settings.preferences_pb
- /data/data/####/firebase_session_settings.preferences_pb.tmp
- /data/data/####/generatefid.lock
- /data/data/####/google_app_measurement.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/libdmcoreswduurkc.so
- /data/data/####/liblysdkiufovbel.so
- /data/data/####/lysdk_prefs.dat
- /data/data/####/lywx_sdk.xml
- /data/data/####/report
- /data/data/####/resource.apk
- /data/data/####/start-time
- /data/data/####/userlog (deleted)
- /data/data/####/userlog.tmp
- /databases/com.google.android.datatransport.events
- /databases/google_app_measurement.db
- /databases/google_app_measurement.db-journal
- /files/.com.google.firebase.crashlytics.files.v2;mood.aspamg.as...serlog
- /files/google_app_measurement.db
Miscellaneous:
Executes the following shell scripts:
- /system/bin/su
- getprop ro.build.MiFavor_version
- getprop ro.build.freeme.label
- getprop ro.build.version.emui
- getprop ro.build.version.oplusrom
- getprop ro.build.version.opporom
- getprop ro.flyme.published
- getprop ro.letv.release.version
- getprop ro.miui.ui.version.name
- getprop ro.product.flyme.model
- getprop ro.smartisan.version
- getprop ro.tranos.type
- getprop ro.vivo.os.build.display.id
- getprop ro.vivo.os.version
Uses elevated priveleges.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Sample from Google Play Store.
Attempts to detect sandbox environment.
Contains hidden alternative main activities.
