Technical information
Malicious functions:
Prompts to install third-party apps.
Removes app icon from the screen.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) canaryt####.com:80
- TCP(TLS/1.0) www.ar####.com:443
- TCP(TLS/1.0) js.ar####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.2) 1####.251.36.46:443
- TCP(TLS/1.2) 1####.251.39.99:443
DNS requests:
- assd####.d####.net
- assd####.d####.net.####.8
- canaryt####.com
- js.ar####.com
- m####.go####.com
- md####.google####.com
- s####.serv####.moz####.com
- www.ar####.com
HTTP GET requests:
- canaryt####.com/feedback/a81b9cvggyy216xowtqt1t7io/post.jsp
- canaryt####.com/resources/favicon.ico
HTTP POST requests:
- canaryt####.com/feedback/a81b9cvggyy216xowtqt1t7io/post.jsp
File system changes:
Creates the following files:
- /data/data/####/057252c2013e5471_0
- /data/data/####/1d80f88ae68248c5_0
- /data/data/####/21a6bdad80a8af35_0
- /data/data/####/21a6bdad80a8af35_1
- /data/data/####/23de53e6ef56ac88_0
- /data/data/####/23de53e6ef56ac88_1
- /data/data/####/2690472368778402_0
- /data/data/####/27f47a38c85e5db0_0
- /data/data/####/2fd9775d485156ac_0
- /data/data/####/2fd9775d485156ac_1
- /data/data/####/32e0f94f5fd314e6_0
- /data/data/####/32e0f94f5fd314e6_1
- /data/data/####/39569d5c5d328602_0
- /data/data/####/47661ab213bda65c_0
- /data/data/####/47f3db5cce1fc7b2_0
- /data/data/####/47f3db5cce1fc7b2_1
- /data/data/####/4ac6bd0050df3eaa_0
- /data/data/####/4ac6bd0050df3eaa_1
- /data/data/####/4c9e8394166e3652_0
- /data/data/####/549d8f3849e268d6_0
- /data/data/####/549d8f3849e268d6_1
- /data/data/####/61a024e5d238d0c2_0
- /data/data/####/6a628e6913bfac2e_0
- /data/data/####/70e858c6576afc07_0
- /data/data/####/70e858c6576afc07_1
- /data/data/####/7222c89c63d198da_0
- /data/data/####/7844f999f0a343e3_0
- /data/data/####/7873c05b85e46b07_0
- /data/data/####/7873c05b85e46b07_1
- /data/data/####/7bccd59d66898bf1_0
- /data/data/####/7d98f84f5e3d8b00_0
- /data/data/####/82918a78a62cab7a_0
- /data/data/####/82918a78a62cab7a_1
- /data/data/####/8eea0f22d5c8799a_0
- /data/data/####/8eea0f22d5c8799a_1
- /data/data/####/9183b1dcf6c1c20d_0
- /data/data/####/94cd8da20eee72f3_0
- /data/data/####/9724b65677acef6f_0
- /data/data/####/984398ed16d1d285_0
- /data/data/####/9cf5474228fd53ce_0
- /data/data/####/9ea41f555e0f6b0b_0
- /data/data/####/9fdbaaad82341f7c_0
- /data/data/####/9fdbaaad82341f7c_1
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a119f09cc924b437_0
- /data/data/####/a119f09cc924b437_1
- /data/data/####/a4889da8973069f7_0
- /data/data/####/a60511266b982846_0
- /data/data/####/b7223a818eb2da5e_0
- /data/data/####/b7d9c64030029a0a_0
- /data/data/####/b8a09402603659fe_0
- /data/data/####/bb5b43ec27c93487_0
- /data/data/####/bfe87c14231c1321_0
- /data/data/####/bfe87c14231c1321_1
- /data/data/####/c44faf0753776208_0
- /data/data/####/c5189966ab5c0c3b_0
- /data/data/####/c7fd53180b3947e0_0
- /data/data/####/c9aaefbf0a50f5f5_0
- /data/data/####/c9aaefbf0a50f5f5_1
- /data/data/####/cac4084781616d2f_0
- /data/data/####/cac4084781616d2f_1
- /data/data/####/cde281f13545584d_0
- /data/data/####/com.goyal.website2apk_preferences.xml
- /data/data/####/d33a560f0b640879_0
- /data/data/####/d33a560f0b640879_0 (deleted)
- /data/data/####/d4340bf23cfa078c_0
- /data/data/####/dbe7a7804e7b2d77_0
- /data/data/####/dbe7a7804e7b2d77_1
- /data/data/####/df59ffe15d72074d_0
- /data/data/####/df59ffe15d72074d_1
- /data/data/####/e46d5062da48f474_0
- /data/data/####/e46d5062da48f474_1
- /data/data/####/e909c6d184c1b5f9_0
- /data/data/####/e9e6cd1ff9478e29_0
- /data/data/####/f39451a26eab7b88_0
- /data/data/####/f44a59df38147570_0
- /data/data/####/f8240c23b96f8374_0
- /data/data/####/fc4d853d9273e572_0
- /data/data/####/fc4d853d9273e572_1
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/package.name.suffix_preferences.xml
- /data/data/####/the-real-index
- /data/media/####/.apk.apk
Miscellaneous:
Gets information about network.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
