Technical information
Malicious functions:
Prompts to install third-party apps.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) voice####.vip:443
- TCP(TLS/1.0) api.grab####.cc:443
- TCP(TLS/1.0) yanglin####.gi####.io:443
- TCP(TLS/1.0) coinlis####.s3.ap-sou####.####.com:443
DNS requests:
- api.grab####.cc
- coinlis####.s3.ap-sou####.####.com
- night####.live
- voice####.vip
- yanglin####.gi####.io
File system changes:
Creates the following files:
- /data/app/####/payload.apk
- /data/data/####/Anonymous-DexFile@3332402071.vdex
- /data/data/####/app_framework.apk
- /data/data/####/connection.preferences_pb.tmp
- /data/data/####/connection_bridge_xproc_v1.xml
- /data/data/####/domain_resolver.xml
- /data/data/####/installer_domain_resolver.xml
- /data/data/####/installer_launcher_visibility.xml
- /data/data/####/installer_prefs.xml
- /data/data/####/installer_report_prefs.xml
- /data/data/####/libandroidx.graphics.path.so
- /data/data/####/libdatastore_shared_counter.so
- /data/data/####/libjingle_peerconnection_so.so
- /data/data/####/libv2shell.so
- /data/data/####/libzduqdfvjt.so
- /data/data/####/nightplay_prefs.xml
- /data/data/####/offline_diagnostics.xml
- /data/data/####/p0.dex
- /data/data/####/p0.dex.cur.prof
- /data/data/####/p0.vdex
- /data/data/####/payload.apk
- /data/data/####/permission_status_diagnostics.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/misc/####/primary.prof
- /data/user_de/####/control_app_connection.xml
- /data/user_de/####/control_keep_alive_telemetry.xml
- /data/user_de/####/nightplay_xproc_state.xml
Miscellaneous:
Loads the following dynamic libraries:
- libgraphics_gmctpv
Appears corrupted in a way typical for malicious files.
