Technical information
Malicious functions:
Prompts to install third-party apps.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(???) ree####.tv:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) clients####.google####.com:443
- TCP(TLS/1.0) yanglin####.gi####.io:443
- TCP(TLS/1.0) api.grab####.cc:443
- TCP(TLS/1.0) coinlis####.s3.ap-sou####.####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) cdn.n####.live:443
- TCP(TLS/1.0) ree####.tv:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) st####.cloudfl####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) cdn.night####.live:443
- TCP(TLS/1.0) api.rewardr####.app:443
DNS requests:
- api.grab####.cc
- api.rewardr####.app
- cdn.n####.live
- cdn.night####.live
- clients####.google####.com
- coinlis####.s3.ap-sou####.####.com
- ed####.me.g####.com
- f####.google####.com
- f####.gst####.com
- ree####.tv
- st####.cloudfl####.com
- up####.google####.com
- yanglin####.gi####.io
File system changes:
Creates the following files:
- /data/app/####/libandroidx.graphics.path.so
- /data/app/####/libdatastore_shared_counter.so
- /data/app/####/libeasl.so
- /data/app/####/libv2shell.so
- /data/app/####/payload.apk
- /data/app/####/tmp.BT6ai6
- /data/data/####/.org.chromium.Chromium.B5ENtD
- /data/data/####/.org.chromium.Chromium.edAmJM (deleted)
- /data/data/####/0316f79b71805a65_0
- /data/data/####/0cab9a40ad270a76_0
- /data/data/####/0d5dbd984e83c35c_0
- /data/data/####/14a91165b27b2231_0
- /data/data/####/151f5f8ff109c8fe_0
- /data/data/####/1cab98f0266f88a0_0
- /data/data/####/1e99a23de9e04ae5_0
- /data/data/####/2411df1e8db3757f_0
- /data/data/####/2f4c3af377ac3ca7_0
- /data/data/####/2fac6e0ba6b4a4c9_0
- /data/data/####/3b5143f31c2fa064_0
- /data/data/####/3b6a0a1e351835a6_0
- /data/data/####/3e3072441e80df04_0
- /data/data/####/4649cb8e094008d6_0
- /data/data/####/48ea6cb6c5a05105_0
- /data/data/####/4bec429746632e77_0
- /data/data/####/4e82db1ef3c6a8a2_0
- /data/data/####/52dd2da9271c5362_0
- /data/data/####/57963608cd458910_0
- /data/data/####/586ab6fa62872039_0
- /data/data/####/59936e0ba8909cf3_0
- /data/data/####/5c87cad4c95a3274_0
- /data/data/####/65011b1b813f223a_0
- /data/data/####/6a3e7103ceb0625c_0
- /data/data/####/6e94202d3f8c90ae_0
- /data/data/####/70fa1b05ba2c27fe_0
- /data/data/####/73418ac7108473c4_0
- /data/data/####/755cf41b32ff74e7_0
- /data/data/####/77b88ed459f4c189_0
- /data/data/####/7a573e69244c8dc2_0
- /data/data/####/7a58815957c71e61_0
- /data/data/####/7eabf108dac9734c_0
- /data/data/####/7ff9a81e5c60c540_0
- /data/data/####/84f1fe5078749b99_0
- /data/data/####/8ad617c7c55c94d6_0
- /data/data/####/8e211348510b2a11_0
- /data/data/####/904d657703eb52d7_0
- /data/data/####/91ce946a684f029d_0
- /data/data/####/99036afbe21c7637_0
- /data/data/####/9c07a94d615a1fa2_0
- /data/data/####/Anonymous-DexFile@3765269875.vdex
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a4be93561f042ac4_0
- /data/data/####/a6b919b292ce02e6_0
- /data/data/####/adf30c298c2eb219_0
- /data/data/####/af2ab43b3aacc050_0
- /data/data/####/b59abe69e252f706_0
- /data/data/####/b72aa6248b6ee59a_0
- /data/data/####/b9e991f465f91005_0
- /data/data/####/bef76a7e843c6a0c_0
- /data/data/####/cd46f22a29d2a2e0_0
- /data/data/####/connection.preferences_pb
- /data/data/####/connection.preferences_pb.tmp
- /data/data/####/connection_bridge_xproc_v1.xml
- /data/data/####/d05e8436c96ca713_0
- /data/data/####/d3c5ca3c1920e7bc_0
- /data/data/####/d49c01c7fa4acde2_0
- /data/data/####/df2a2fe603d34e76_0
- /data/data/####/domain_resolver.xml
- /data/data/####/e2c7c0a94b63d07e_0
- /data/data/####/e57edb74baf51bac_0
- /data/data/####/e6e9c2cf72c41a16_0
- /data/data/####/e8cfd36c8a596128_0
- /data/data/####/eea919a4d4a93273_0
- /data/data/####/f0723fd8243d14a2_0
- /data/data/####/fe7283124aa461fa_0
- /data/data/####/fef7c30199641f77_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/installer_domain_resolver.xml
- /data/data/####/installer_launcher_visibility.xml
- /data/data/####/installer_prefs.xml
- /data/data/####/installer_report_prefs.xml
- /data/data/####/installer_runtime_config.xml
- /data/data/####/libandroidx.graphics.path.so
- /data/data/####/libdatastore_shared_counter.so
- /data/data/####/libeasl.so
- /data/data/####/libjingle_peerconnection_so.so
- /data/data/####/libv2shell.so
- /data/data/####/nightplay_prefs.xml
- /data/data/####/offline_diagnostics.xml
- /data/data/####/p0.dex
- /data/data/####/p0.dex.cur.prof
- /data/data/####/p0.vdex
- /data/data/####/payload.apk
- /data/data/####/permission_status_diagnostics.xml
- /data/data/####/profileInstalled
- /data/data/####/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- /data/data/####/settings.dat
- /data/data/####/system_helper.apk
- /data/data/####/the-real-index
- /data/data/####/todelete_097538513d4f31dc_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /data/misc/####/primary.prof
- /data/user_de/####/control_app_connection.xml
- /data/user_de/####/control_keep_alive_telemetry.xml
- /data/user_de/####/native_bridge.xml
- /data/user_de/####/nightplay_xproc_state.xml
Miscellaneous:
Loads the following dynamic libraries:
- libandroid_cmac
Appears corrupted in a way typical for malicious files.
