Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.961.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) kt####.net:443
DNS requests:
- kt####.com
- kt####.net
File system changes:
Creates the following files:
- /data/data/####/2026-09-03.jsonl
- /data/data/####/a.2910.tmp
- /data/data/####/a.jar.cur.prof
- /data/data/####/a.vdex
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/keepalive_process_diagnostics.xml
- /data/data/####/keepalive_process_diagnostics.xml (deleted)
- /data/data/####/libconscrypt_jni.so.2910.tmp
- /data/data/####/libspake2.so
- /data/data/####/permission_diagnostics.xml
- /data/data/####/profileInstalled
- /data/data/####/remote_control_prefs.xml
- /data/misc/####/primary.prof
- /data/user_de/####/keepalive_state_v1.xml
- /data/user_de/####/process_recovery_rate_v1.xml
- /data/user_de/####/remote_control_direct_boot.xml
- /data/user_de/####/remote_control_direct_boot.xml (deleted)
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Accesses the ITelephony private interface.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
