Android.Joker.1306

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Joker.207.origin
Android.Joker.835

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) reb####.ly:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) crashly####.google####.com:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) 1####.217.168.202:443
TCP(TLS/1.0) firebas####.crashly####.com:443
TCP(TLS/1.0) www.ca####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) 1####.217.168.238:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) vtoge####.oss-us-####.aliy####.com:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.0) firebas####.google####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) oss-acc####.aliy####.com.####.com:443
TCP(TLS/1.0) app-mea####.com:443
TCP(TLS/1.2) 1####.250.179.202:443
TCP(TLS/1.2) 1####.217.168.195:443
TCP(TLS/1.2) 1####.217.168.202:443
TCP(TLS/1.2) 1####.217.168.238:443

DNS requests:

app-mea####.com
ca####.oss-acc####.aliy####.com
crashly####.google####.com
csi.gst####.com
f####.google####.com
firebas####.crashly####.com
firebas####.google####.com
firebas####.google####.com
g####.face####.com
googl####.g.doublec####.net
reb####.ly
safebro####.google####.com
tpc.googles####.com
vtoge####.oss-us-####.aliy####.com
www.ca####.com
www.face####.com
www.gst####.com

HTTP GET requests:

api.face####.com:443/v12.0/439628567794829/mobile_sdk_gk?fields=####&for...
api.face####.com:443/v12.0/439628567794829/model_asset?fields=####&forma...
api.face####.com:443/v12.0/439628567794829?fields=####&format=####&sdk=#...
firebas####.crashly####.com:443/spi/v2/platforms/android/gmp/1:403534839...
oss-acc####.aliy####.com.####.com:443/canbye
reb####.ly:443/ip5n5cz
vtoge####.oss-us-####.aliy####.com:443/bestonescanner
vtoge####.oss-us-####.aliy####.com:443/feeltye

HTTP POST requests:

api.face####.com:443/v12.0/439628567794829/activities
crashly####.google####.com:443/v1/firelog/legacy/batchlog
f####.google####.com:443/v1/projects/qr-scanner-5ba89/installations
firebas####.google####.com:443/v1/projects/403534839363/namespaces/fireb...
www.ca####.com:443/canbye/v1
www.face####.com:443/adnw_sync2

File system changes:

Creates the following files:

/data/data/####/.ae1647161611225
/data/data/####/.ae1647161612928
/data/data/####/.ae1647161618216
/data/data/####/0fecfaa6145b8289_0
/data/data/####/1629828815138.dex
/data/data/####/1629828815138.dex.flock (deleted)
/data/data/####/1629828815138.jar
/data/data/####/1629828815138.tmp
/data/data/####/34fceacffe57c610_0
/data/data/####/34fceacffe57c610_1
/data/data/####/3c1ccf32788cbb88_0
/data/data/####/3c1ccf32788cbb88_1
/data/data/####/4461f8dd9ed8e393_0
/data/data/####/4461f8dd9ed8e393_1
/data/data/####/5b874e2dc7e40873_0
/data/data/####/622DB10C011700020EF5C1694E0C3FA2
/data/data/####/622DB110014100011014C1694E0C3FA2
/data/data/####/774d6c95adcf42fe_0
/data/data/####/774d6c95adcf42fe_1
/data/data/####/7e16a59f7c3d2861_0
/data/data/####/7e16a59f7c3d2861_1
/data/data/####/AppEventsLogger.persistedevents
/data/data/####/Cookies
/data/data/####/Cookies-journal
/data/data/####/FBAdPrefs.xml
/data/data/####/FirebaseAppHeartBeat.xml
/data/data/####/PersistedInstallation.W0RFRkFVTFRd+MTo0MDM1MzQ4...2.json
/data/data/####/PersistedInstallation1054153021tmp
/data/data/####/PersistedInstallation1375088838tmp
/data/data/####/Web Data
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Yang
/data/data/####/Yang.dex
/data/data/####/Yang.dex.flock (deleted)
/data/data/####/ab13de78ea290658_0
/data/data/####/admob.xml
/data/data/####/admob.xml.bak
/data/data/####/afa78c0698f80254_0
/data/data/####/androidx.work.workdb
/data/data/####/androidx.work.workdb-journal (deleted)
/data/data/####/androidx.work.workdb-shm
/data/data/####/androidx.work.workdb-wal
/data/data/####/audience_network.dex
/data/data/####/audience_network.dex.flock (deleted)
/data/data/####/baecd80ff138bb1c_0
/data/data/####/baecd80ff138bb1c_1
/data/data/####/bshwai.xml
/data/data/####/c2da97472a00a5e8_0
/data/data/####/c2da97472a00a5e8_1
/data/data/####/cf6eb82a3f84871e_0
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.facebook.ads.idfa.xml
/data/data/####/com.facebook.internal.MODEL_STORE.xml
/data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.feeltye.qrcode.bestonescanner_preferences.xml
/data/data/####/com.feeltye.qrcode.bestonescanner_preferences.xml.bak
/data/data/####/com.google.android.datatransport.events
/data/data/####/com.google.android.datatransport.events-journal
/data/data/####/com.google.android.gms.appid-no-backup
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml.bak
/data/data/####/com.google.firebase.crashlytics.xml
/data/data/####/crash_2022_03_13.log
/data/data/####/crash_marker
/data/data/####/darkmagic_def_app_config.xml
/data/data/####/device__prefs_010.xml
/data/data/####/dfe6b2497a7513ba_0
/data/data/####/event0000000000_
/data/data/####/event0000000001_
/data/data/####/f01f2a4f3669eb70_0
/data/data/####/f038e94cb33282ab_0
/data/data/####/files-ip5n5cz
/data/data/####/frc_1;403534839363;android;5869a5f88b9a8521f3de...e.json
/data/data/####/frc_1;403534839363;android;5869a5f88b9a8521f3de...gs.xml
/data/data/####/frc_1;403534839363;android;5869a5f88b9a8521f3de...h.json
/data/data/####/friendsfriendsfriends
/data/data/####/friendsfriendsfriends.dex
/data/data/####/friendsfriendsfriends.dex.flock (deleted)
/data/data/####/generatefid.lock
/data/data/####/google_app_measurement_local.db
/data/data/####/google_app_measurement_local.db-journal
/data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/index
/data/data/####/initialization_marker
/data/data/####/metrics_guid
/data/data/####/primary.xml
/data/data/####/profile.db-journal (deleted)
/data/data/####/profile_config.xml
/data/data/####/report
/data/data/####/start-time
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/webview_data.lock
/data/misc/####/primary.prof
/data/user_de/####/bypass-china.acl
/data/user_de/####/bypass-lan-china.acl
/data/user_de/####/bypass-lan.acl
/data/user_de/####/china-list.acl
/data/user_de/####/config.db
/data/user_de/####/config.db-journal (deleted)
/data/user_de/####/config.db-shm
/data/user_de/####/config.db-wal
/data/user_de/####/gfwlist.acl

Miscellaneous:

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Accesses camera interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Intercepts notifications.

Contains Play Store Frosting.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial