Technical information
Malicious functions:
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ws####.ldofjs####.cfd:80
DNS requests:
- ws####.ldofjs####.cfd
HTTP GET requests:
- ws####.ldofjs####.cfd/
File system changes:
Creates the following files:
- /data/app/####/libnmmp.so
- /data/app/####/libnmmvm.so
- /data/app/####/package_apk
- /data/data/####/MyPrefsFile.xml
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/base
- /data/data/####/base.cur.prof
- /data/data/####/profileInstalled
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
- /storage/emulated/####/asset4811645070101327511.enc
- /storage/emulated/####/asset4811645070101327511.enc (deleted)
- /storage/emulated/####/update.apk (deleted)
Miscellaneous:
Displays its own windows over windows of other apps.
Appears corrupted in a way typical for malicious files.
Attempts to detect sandbox environment.
