Technical information
Malicious functions:
Prompts to install third-party apps.
Removes app icon from the screen.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) canaryt####.com:80
- TCP(TLS/1.0) rr3---s####.g####.com:443
- TCP(TLS/1.0) www.ar####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) js.ar####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) rr5---s####.g####.com:443
- TCP(TLS/1.0) 1####.251.36.46:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.2) 1####.251.39.99:443
- TCP(TLS/1.2) 1####.217.168.202:443
- UDP rr3---s####.g####.com:443
- UDP rr5---s####.g####.com:443
- UDP p####.google####.com:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- canaryt####.com
- gmscomp####.google####.com
- js.ar####.com
- m####.go####.com
- p####.google####.com
- rr3---s####.g####.com
- rr5---s####.g####.com
- s####.serv####.moz####.com
- www.ar####.com
HTTP GET requests:
- canaryt####.com/feedback/a81b9cvggyy216xowtqt1t7io/post.jsp
- canaryt####.com/resources/favicon.ico
HTTP POST requests:
- canaryt####.com/feedback/a81b9cvggyy216xowtqt1t7io/post.jsp
File system changes:
Creates the following files:
- /data/data/####/1d80f88ae68248c5_0
- /data/data/####/21a6bdad80a8af35_0
- /data/data/####/23de53e6ef56ac88_0
- /data/data/####/2fd9775d485156ac_0
- /data/data/####/32e0f94f5fd314e6_0
- /data/data/####/47661ab213bda65c_0
- /data/data/####/47f3db5cce1fc7b2_0
- /data/data/####/4ac6bd0050df3eaa_0
- /data/data/####/4ac6bd0050df3eaa_1
- /data/data/####/4c9e8394166e3652_0
- /data/data/####/549d8f3849e268d6_0
- /data/data/####/61a024e5d238d0c2_0
- /data/data/####/6a628e6913bfac2e_0
- /data/data/####/70e858c6576afc07_0
- /data/data/####/70e858c6576afc07_1
- /data/data/####/7873c05b85e46b07_0
- /data/data/####/82918a78a62cab7a_0
- /data/data/####/8eea0f22d5c8799a_0
- /data/data/####/8eea0f22d5c8799a_1
- /data/data/####/9183b1dcf6c1c20d_0
- /data/data/####/94cd8da20eee72f3_0
- /data/data/####/9fdbaaad82341f7c_0
- /data/data/####/9fdbaaad82341f7c_1
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a119f09cc924b437_0
- /data/data/####/b7d9c64030029a0a_0
- /data/data/####/bb5b43ec27c93487_0
- /data/data/####/bfe87c14231c1321_0
- /data/data/####/c44faf0753776208_0
- /data/data/####/c9aaefbf0a50f5f5_0
- /data/data/####/cac4084781616d2f_0
- /data/data/####/cde281f13545584d_0
- /data/data/####/com.goyal.website2apk_preferences.xml
- /data/data/####/d33a560f0b640879_0
- /data/data/####/d33a560f0b640879_0 (deleted)
- /data/data/####/d4340bf23cfa078c_0
- /data/data/####/dbe7a7804e7b2d77_0
- /data/data/####/df59ffe15d72074d_0
- /data/data/####/e46d5062da48f474_0
- /data/data/####/fc4d853d9273e572_0
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/package.name.suffix_preferences.xml
- /data/data/####/the-real-index
- /data/media/####/.apk.apk
Miscellaneous:
Gets information about network.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
