Technical information
Malicious functions:
Downloads the following detected threats from the Internet:
- Android.Siggen.Susp2.725
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) coinlis####.s3.ap-sou####.####.com:443
- TCP(TLS/1.0) yanglin####.gi####.io:443
- TCP(TLS/1.0) api.grab####.cc:443
DNS requests:
- api.grab####.cc
- coinlis####.s3.ap-sou####.####.com
- yanglin####.gi####.io
HTTP GET requests:
- coinlis####.s3.ap-sou####.####.com:443/videos/thumbnails/cores/my-yd/VPL...
- yanglin####.gi####.io:443/project-docs/d/config.json
HTTP HEAD requests:
- api.grab####.cc:443/api/health
HTTP POST requests:
- api.grab####.cc:443/api/app/public/track
File system changes:
Creates the following files:
- /cache/task_runtime.apk
- /data/data/####/installer_domain_resolver.xml
- /data/data/####/installer_prefs.xml
- /data/data/####/installer_report_prefs.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/misc/####/primary.prof
Miscellaneous:
Displays its own windows over windows of other apps.
Attempts to detect sandbox environment.
