Technical information
Malicious functions:
Prompts to install third-party apps.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(???) f####.gst####.com:443
- UDP(???) p####.go####.com:443
- UDP(???) www.go####.com:443
- UDP(???) ogad####.clie####.go####.com:443
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) 1####.102.40.145:80
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) i.i####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) pla####.googleu####.com:443
- TCP(TLS/1.0) ogad####.clie####.go####.com:443
- TCP(TLS/1.0) content####.google####.com:443
- TCP(TLS/1.0) www.gst####.com:443
DNS requests:
- content####.google####.com
- f####.google####.com
- f####.gst####.com
- i.i####.com
- ogad####.clie####.go####.com
- p####.go####.com
- pla####.googleu####.com
- www.go####.com
- www.gst####.com
HTTP GET requests:
- www.go####.com/
HTTP HEAD requests:
- 1####.102.40.145/yaarsa/private/yarsap_80541.php
File system changes:
Creates the following files:
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/variations_seed_new
- /app_webview/webview_data.lock
- /cache/WebView/####/9704bf727b7c9f1d_0
- /data/app/####/puxlolj.apk
- /data/data/####/.org.chromium.Chromium.0xMfgL (deleted)
- /data/data/####/.org.chromium.Chromium.LhdxF2
- /data/data/####/.org.chromium.Chromium.deLdqb
- /data/data/####/.org.chromium.Chromium.ezrtOc
- /data/data/####/000001.dbtmp
- /data/data/####/00165bd3678c6c0f_0
- /data/data/####/09c1568ea739bafa_0
- /data/data/####/10de26a232892464_0
- /data/data/####/13a1fe97731b53a3_0
- /data/data/####/1f3bf2b134ab7a2d_0
- /data/data/####/2026-07-15.bin
- /data/data/####/28e032528d8db938_0
- /data/data/####/317611d41e64ba2c_0
- /data/data/####/3688b5474700ebc8_0
- /data/data/####/433b00bcd6d7305a_0
- /data/data/####/440e1a95332fa9b7_0
- /data/data/####/45f7cd562592c8f1_0
- /data/data/####/477f709c4b4d8963_0
- /data/data/####/4ab6e4ab8b007ad5_0
- /data/data/####/502cda934fc8aa20_0
- /data/data/####/5056c9ecac20645c_0
- /data/data/####/50db9a544531807f_0
- /data/data/####/850834fd8d03573a_0
- /data/data/####/8889071435d7ca08_0
- /data/data/####/8c266321bd6db87a_0
- /data/data/####/8c4865b4f55f5eb1_0
- /data/data/####/8e42f73ef1b34fb9_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a7d194f313cd5e38_0
- /data/data/####/a7ed5873a3fad4d9_0
- /data/data/####/a91c02ef098f3e7e_0
- /data/data/####/af8b614daec74134_0
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/b039467724834e51_0
- /data/data/####/b24b5d2f06c80645_0
- /data/data/####/b5306b361615ca99_0
- /data/data/####/b8e7d9a1e75cd9f9_0
- /data/data/####/badda3ec21df7604_0
- /data/data/####/bec4781c9cc8fb1e_0
- /data/data/####/c045845f650a1686_0
- /data/data/####/c0f97f3abb47da9c_0
- /data/data/####/c113690545d345c5_0
- /data/data/####/cfg.xml
- /data/data/####/d5dd0dcba5bca0ac_0
- /data/data/####/dddaf817c939d24b_0
- /data/data/####/ec1da65053c29625_0
- /data/data/####/ee6e9e0de1e67ef1_0
- /data/data/####/ef79b2cc6547fe7b_0
- /data/data/####/f31bf3ea1b537f64_0
- /data/data/####/fctijbsuj.dat
- /data/data/####/fec387b4ad6bc9a0_0
- /data/data/####/ffe467ef2926ca51_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/my_skipes.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/rizz.tkvlhx.wioeuwf.xml
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_317611d41e64ba2c_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- id
- sh
- su
- su -c id
Uses elevated priveleges.
Displays its own windows over windows of other apps.
