Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.1486.origin
Network activity:
Connects to:
- UDP(???) analy####.ah####.com:443
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) tw####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) 91p####.com:443
- TCP(TLS/1.0) up####.google####.com:443
- TCP(TLS/1.0) yjmti####.i1zxf53####.com:4516
- TCP(TLS/1.0) analy####.ah####.com:443
- TCP(TLS/1.0) ed####.me.g####.com:443
DNS requests:
- 91p####.com
- analy####.ah####.com
- analy####.go####.com
- ed####.me.g####.com
- s####.g.doublec####.net
- sv####.5q7####.cc
- tw####.com
- up####.google####.com
- www.go####.ru
- www.googlet####.com
- yjmti####.i1zxf53####.com
File system changes:
Creates the following files:
- /app_webview/BrowserMetrics/BrowserMetrics-6AB383C5-EFE.pma (deleted)
- /app_webview/Default/####/000003.log
- /app_webview/Default/####/LOCK
- /app_webview/Default/####/LOG
- /app_webview/Default/####/MANIFEST-000001
- /app_webview/Default/Cookies
- /app_webview/Default/Web Data
- /app_webview/Default/Web Data-journal
- /app_webview/webview_data.lock
- /cache/WebView/####/0f771a83e6d8caf5_0
- /cache/WebView/####/125dabcf153887b0_0
- /cache/WebView/####/199400ab99e5aca6_0
- /cache/WebView/####/2477fb5f68028b50_0
- /cache/WebView/####/364f3b95f04a766c_0
- /cache/WebView/####/4e60d150dcd6bfd7_0
- /cache/WebView/####/51fc8d76923b2397_0
- /cache/WebView/####/580eb4b2b35daf26_0
- /cache/WebView/####/5fd9425faf6d5de8_0
- /cache/WebView/####/68403a9e3b169684_0
- /cache/WebView/####/6a280b97365b8479_0
- /cache/WebView/####/8ced82134c5fdafe_0
- /cache/WebView/####/92b3bbbaf1b1e746_0
- /cache/WebView/####/a68b26f617c45041_0
- /cache/WebView/####/aef10af73fef638b_0
- /cache/WebView/####/d5517ca9284939f7_0
- /cache/WebView/####/e8127545669b8a54_0
- /cache/WebView/####/ee9c41ebb1b80efe_0
- /data/data/####/.org.chromium.Chromium.2A6nrP (deleted)
- /data/data/####/.org.chromium.Chromium.JTzNSr
- /data/data/####/.org.chromium.Chromium.TrgRsB (deleted)
- /data/data/####/.org.chromium.Chromium.YZT6Cf
- /data/data/####/.org.chromium.Chromium.kXv41T (deleted)
- /data/data/####/000001.dbtmp
- /data/data/####/0aa26bf738581519_0
- /data/data/####/0f771a83e6d8caf5_0
- /data/data/####/125dabcf153887b0_0
- /data/data/####/199400ab99e5aca6_0
- /data/data/####/2477fb5f68028b50_0
- /data/data/####/29f11414eec9588e_0
- /data/data/####/35262ec57c1d0195_0
- /data/data/####/364f3b95f04a766c_0
- /data/data/####/426c1b7620e69e2a_0
- /data/data/####/490d26fa0c93c12d_0
- /data/data/####/4e60d150dcd6bfd7_0
- /data/data/####/4f4921751f055da0_0
- /data/data/####/51fc8d76923b2397_0
- /data/data/####/5381fd19bb485aec_0
- /data/data/####/580eb4b2b35daf26_0
- /data/data/####/5fd9425faf6d5de8_0
- /data/data/####/6a280b97365b8479_0
- /data/data/####/840e60d7f30996e5_0
- /data/data/####/85063dc983919746_0
- /data/data/####/8ced82134c5fdafe_0
- /data/data/####/92b3bbbaf1b1e746_0
- /data/data/####/BrowserMetrics-spare.pma.tmp
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/LOCK
- /data/data/####/LOCK (deleted)
- /data/data/####/MANIFEST-000001
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a354e85c0d2973c9_0
- /data/data/####/a68b26f617c45041_0
- /data/data/####/aef10af73fef638b_0
- /data/data/####/androidx.work.workdb-journal (deleted)
- /data/data/####/androidx.work.workdb-wal
- /data/data/####/androidx.work.workdb.lck
- /data/data/####/b0e5d9a2eac0a4f9_0
- /data/data/####/b15a1772cc3d0cd0_0
- /data/data/####/cb4e34e8037e7446_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex.cur.prof
- /data/data/####/classes.vdex
- /data/data/####/classes2.dex
- /data/data/####/classes2.dex.cur.prof
- /data/data/####/classes2.vdex
- /data/data/####/classes3.dex
- /data/data/####/classes3.dex.cur.prof
- /data/data/####/classes3.vdex
- /data/data/####/classes4.dex
- /data/data/####/classes4.dex.cur.prof
- /data/data/####/classes4.vdex
- /data/data/####/d4e4d75dec9d5e86_0
- /data/data/####/d5517ca9284939f7_0
- /data/data/####/e3512f7c787568b3_0
- /data/data/####/ee9c41ebb1b80efe_0
- /data/data/####/font_unique_name_table.pb
- /data/data/####/index
- /data/data/####/myc7xq.zjv45j.kqrgfjq.xml
- /data/data/####/settings.dat
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/todelete_0f771a83e6d8caf5_0_1 (deleted)
- /data/data/####/todelete_125dabcf153887b0_0_1 (deleted)
- /data/data/####/todelete_199400ab99e5aca6_0_1 (deleted)
- /data/data/####/todelete_2477fb5f68028b50_0_1 (deleted)
- /data/data/####/todelete_364f3b95f04a766c_0_1 (deleted)
- /data/data/####/todelete_39d2b17637227d02_0_1 (deleted)
- /data/data/####/todelete_4e60d150dcd6bfd7_0_1 (deleted)
- /data/data/####/todelete_51fc8d76923b2397_0_1 (deleted)
- /data/data/####/todelete_5381fd19bb485aec_0_1 (deleted)
- /data/data/####/todelete_580eb4b2b35daf26_0_1 (deleted)
- /data/data/####/todelete_68403a9e3b169684_0_1 (deleted)
- /data/data/####/todelete_82aa3dbcb576a061_0_1 (deleted)
- /data/data/####/todelete_8ced82134c5fdafe_0_1 (deleted)
- /data/data/####/todelete_92b3bbbaf1b1e746_0_1 (deleted)
- /data/data/####/todelete_a68b26f617c45041_0_1 (deleted)
- /data/data/####/todelete_aef10af73fef638b_0_1 (deleted)
- /data/data/####/todelete_b3b6cdba241ea1e6_0_1 (deleted)
- /data/data/####/todelete_d5517ca9284939f7_0_1 (deleted)
- /data/data/####/todelete_ee9c41ebb1b80efe_0_1 (deleted)
- /data/data/####/variations_seed_new
- /data/data/####/variations_stamp
- /no_backup/androidx.work.workdb
- /no_backup/androidx.work.workdb-shm
- /no_backup/androidx.work.workdb-wal
Miscellaneous:
Executes the following shell scripts:
- /system/bin/app_process64 /system/bin --application org.chromium.components.crash.browser.CrashpadMain /system/bin/app_process64 --sanitization-information=0x1c78000204e0 --write-minidump-to-log --database=/data/user/0/<Package>/cache/WebView/Crashpad --annotation=abi_name=x86_64, x86 --annotation=android_build_fp=<System Property>/drw_x86_64/dimas_x86_64:12/SP2A.220505.008/eng.develo.20260610.110942:eng/test-keys --annotation=android_build_id=SP2A.220505.008 --annotation=board=goldfish_x86_64 --annotation=brand=<System Property> --annotation=channel=unknown --annotation=custom_themes=false --annotation=device=dimas_x86_64 --annotation=gms_core_version=gms versionCode not available. --annotation=installer_package_name= --annotation=model=SM-G780G --annotation=plat=Android --annotation=prod=AndroidWebView --annotation=ptype=browser --annotation=resources_version=Not Enabled --annotation=sdk=32 --annotation=ver=95.0.4638.74 --trace-parent-with-exception=0x1c78000b8808
Displays its own windows over windows of other apps.
Requests the system alert window permission.
Appears corrupted in a way typical for malicious files.
Contains hidden alternative main activities.
