Play interactive tour

Edit tour

Analysis Report wdeQEksXgm

Overview

General Information

Joe Sandbox Version:	26.0.0
Analysis ID:	84847
Start date:	16.09.2019
Start time:	09:56:56
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	wdeQEksXgm
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android 5.1 Native (Motorola Moto G 3rd Generation)
APK Instrumentation enabled:	true
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.and@0/254@1/0
Warnings:	Show All Excluded IPs from analysis (whitelisted): 216.58.215.234, 172.217.168.42, 172.217.168.74 Excluded domains from analysis (whitelisted): cloudconfig.googleapis.com, googleapis.l.google.com No interacted views Not all executed log events are in report (maximum 10 identical API calls) Not all non-executed APIs are in report Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	100	0 - 100	Report FP / FN	false	Nicro

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Mitre Att&ck Matrix

Signature Overview

Click to jump to signature section

Privilege Escalation:

Requests root access

Show sources

Source: com.omg.event.utils.RootContext$ScriptRunner;->run:38	API Call: java.lang.Runtime.exec ("su")
Source: Lcom/omgSdk/outport/GetParamsUtil;->f()Z	Method string: "/system/bin/su"
Source: Lcom/omgSdk/outport/GetParamsUtil;->f()Z	Method string: "/system/xbin/su"
Source: Lcom/omg/event/utils/RootContext;->getInstance()Lcom/omg/event/utils/RootContext;	Method string: "/system/xbin/su"
Source: Lcom/omg/event/utils/RootContext;->getInstance()Lcom/omg/event/utils/RootContext;	Method string: "/system/bin/su"

Spreading:

Has permission to change the WIFI configuration including connecting and disconnecting

Show sources

Source: submitted apk

Request permission: android.permission.CHANGE_WIFI_STATE

Accesses external storage location

Show sources

Source: b.a.m;->c:20	API Call: android.os.Environment.getExternalStorageState
Source: b.a.m;->c:23	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.omg.tool.builds.FileBuild;-><init>:3	API Call: android.os.Environment.getExternalStorageDirectory
Source: sdk.nicro.lu.l;->a:46	API Call: android.os.Environment.getExternalStorageState
Source: sdk.nicro.lu.l;->b:62	API Call: android.os.Environment.getExternalStorageDirectory
Source: sdk.nicro.lu.l;->c:100	API Call: android.os.Environment.getExternalStorageDirectory
Source: sdk.nicro.lu.l;->c:105	API Call: android.os.Environment.getExternalStorageDirectory
Source: sdk.nicro.lu.s;->c:39	API Call: android.os.Environment.getExternalStorageDirectory
Source: sdk.nicro.lu.s;->a:68	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.core.model.h;->a:6	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.omgSdk.outport.LiveApplication;->fastCoupleIn:45	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.omg.tool.StorageManager;->a:30	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.omg.tool.StorageManager;->createFile:45	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.omg.tool.StorageManager;->createWriteFile:79	API Call: android.os.Environment.getExternalStorageDirectory
Source: com.omg.tool.StorageManager;->validExternal:108	API Call: android.os.Environment.getExternalStorageState
Source: com.omg.tool.URLManager;->addFromSd:24	API Call: android.os.Environment.getExternalStorageState
Source: com.omg.tool.URLManager;->addFromSd:30	API Call: android.os.Environment.getExternalStorageDirectory

Networking:

Checks an internet connection is available

Show sources

Source: com.omg.base.terminal.OmgTerminalinfo;->c:49	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omg.tool.net.NetworkCheck;->isNetworkConnected:14	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omg.tool.net.NetworkCheck;->isNetworkConnected:15	API Call: android.net.NetworkInfo.isAvailable
Source: com.omg.tool.net.NetworkCheck;->isNetworkConnected:16	API Call: android.net.NetworkInfo.isConnected
Source: b.a.at;->h:193	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: b.a.at;->h:194	API Call: android.net.NetworkInfo.getState
Source: b.a.at;->h:197	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: b.a.at;->h:198	API Call: android.net.NetworkInfo.getState
Source: b.a.at;->j:209	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: b.a.at;->j:210	API Call: android.net.NetworkInfo.isConnectedOrConnecting
Source: b.a.at;->y:336	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: b.a.w;->c:137	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omgSdk.andoclib.d;->a:7	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omgSdk.commen.d;->a:153	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omgSdk.commen.d;->a:154	API Call: android.net.NetworkInfo.isConnected
Source: com.omgSdk.commen.d;->a:155	API Call: android.net.NetworkInfo.getState
Source: com.omg.base.phone.factoryimpl.PhoneController;->b:32	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.omg.base.phone.factoryimpl.PhoneController;->b:33	API Call: android.net.NetworkInfo.getState
Source: com.omg.base.phone.factoryimpl.PhoneController;->c:37	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.omg.base.phone.factoryimpl.PhoneController;->c:38	API Call: android.net.NetworkInfo.getState
Source: sdk.nicro.lu.k;->a:8	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: sdk.nicro.lu.k;->a:9	API Call: android.net.NetworkInfo.isAvailable
Source: sdk.nicro.lu.k;->a:10	API Call: android.net.NetworkInfo.isConnected
Source: com.omg.tool.net.NetProxyManager;->getProxy:8	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omg.tool.net.NetProxyManager;->getProxy:9	API Call: android.net.NetworkInfo.isAvailable
Source: com.omg.tool.net.NetworkCheck;->getConnectedType:4	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: com.omg.tool.net.NetworkCheck;->getConnectedType:5	API Call: android.net.NetworkInfo.isAvailable
Source: com.omg.tool.net.NetworkCheck;->isMobileConnected:9	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.omg.tool.net.NetworkCheck;->isMobileConnected:10	API Call: android.net.NetworkInfo.isAvailable
Source: com.omg.tool.net.NetworkCheck;->isMobileConnected:11	API Call: android.net.NetworkInfo.isConnected
Source: com.omg.tool.net.NetworkCheck;->isWifiConnected:19	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: com.omg.tool.net.NetworkCheck;->isWifiConnected:20	API Call: android.net.NetworkInfo.isAvailable
Source: com.omg.tool.net.NetworkCheck;->isWifiConnected:21	API Call: android.net.NetworkInfo.isConnected

Loads a webpage with cache disabled

Show sources

Source: com.omg.event.EventPlayController;->setSettings:26

API Call: android.webkit.WebSettings.setCacheMode

Opens an internet connection

Show sources

Source: b.a.n;->b:27	API Call: java.net.URL.openConnection (not executed)
Source: b.a.w;->a:47	API Call: java.net.URL.openConnection (not executed)
Source: b.a.w;->a:95	API Call: java.net.URL.openConnection (not executed)
Source: com.omgSdk.a.c;->b:7	API Call: java.net.URL.openConnection (not executed)
Source: com.omgSdk.a.c;->c:98	API Call: java.net.URL.openConnection (not executed)
Source: sdk.nicro.lu.a.a$a;->b:3	API Call: java.net.URL.openConnection (not executed)
Source: a.a.b.b;->a:10	API Call: java.net.URL.openConnection (not executed)
Source: a.a.b.b;->a:28	API Call: java.net.URL.openConnection (not executed)
Source: com.omg.base.network.connection.HTTPConnection$Http;->b:4	API Call: java.net.URL.openConnection (not executed)
Source: sdk.nicro.lu.a;->a:27	API Call: java.net.URL.openConnection (not executed)
Source: sdk.nicro.lu.a;->a:28	API Call: java.net.URL.openConnection (not executed)
Source: sdk.nicro.lu.e$b;->b:9	API Call: java.net.URL.openConnection (not executed)
Source: com.omg.tool.net.WebClient$HttpBackgroudTask;->a:6	API Call: java.net.URL.openConnection (not executed)
Source: com.omg.tool.net.WebClient$HttpBackgroudTask;->a:7	API Call: java.net.URL.openConnection (not executed)

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188

Found strings which match to known social media urls

Show sources

Source: android	String found in binary or memory: com.facebook.katana equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: facebook equals www.facebook.com (Facebook)

Monitors network connection state

Show sources

Source: com.omg.services.download.DownLoadClientService;->onCreate:117	API Call: android.content.IntentFilter.addAction android.net.conn.CONNECTIVITY_CHANGE
Source: com.omgSdk.outport.BackgroundService;->a:151	API Call: android.content.IntentFilter.addAction android.net.conn.CONNECTIVITY_CHANGE
Source: com.omgSdk.outport.BackgroundService;->onCreate:267	API Call: android.content.IntentFilter.addAction android.net.conn.CONNECTIVITY_CHANGE

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: api.niumobi.com

Urls found in memory or binary data

Show sources

Source: android	String found in binary or memory: http://alog.umeng.com/app_logs
Source: android	String found in binary or memory: http://alog.umengcloud.com/app_logs
Source: abc_tint_switch_thumb.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto
Source: abc_action_menu_layout.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto((android.support.v7.widget.ActionMenuView
Source: abc_screen_toolbar.xml	String found in binary or memory: http://schemas.android.com/apk/res-auto00android.support.v7.widget.ActionBarOverlayLayout
Source: abc_tint_switch_thumb.xml, abc_slide_in_top.xml, abc_list_menu_item_icon.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: abc_expanded_menu_layout.xml	String found in binary or memory: http://schemas.android.com/apk/res/android--android.support.v7.view.menu.ExpandedMenuView
Source: abc_list_menu_item_layout.xml	String found in binary or memory: http://schemas.android.com/apk/res/android--android.support.v7.view.menu.ListMenuItemView
Source: abc_screen_simple_overlay_action_mode.xml	String found in binary or memory: http://schemas.android.com/apk/res/android//android.support.v7.widget.FitWindowsFrameLayout
Source: abc_dialog_title_material.xml	String found in binary or memory: http://schemas.android.com/apk/res/android00android.support.v7.widget.FitWindowsLinearLayout
Source: abc_screen_simple.xml	String found in binary or memory: http://schemas.android.com/apk/res/android00android.support.v7.widget.FitWindowsLinearLayout((androi
Source: android	String found in binary or memory: http://xmlpull.org/v1/doc/features.html#indent-output
Source: android	String found in binary or memory: https://cmnsguider.yunos.com:443/genDeviceToken
Source: android	String found in binary or memory: https://uop.umeng.com

Uses HTTP for connecting to the internet

Show sources

Source: b.a.w;->a:173	API Call: org.apache.http.impl.client.DefaultHttpClient.execute
Source: sdk.nicro.lu.a;->a:102	API Call: java.net.HttpURLConnection.connect

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33038
Source: unknown	Network traffic detected: HTTP traffic on port 44275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33038 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Has permission to take photos

Show sources

Source: submitted apk

Request permission: android.permission.CAMERA

E-Banking Fraud:

Has functionalty to add an overlay to other apps

Show sources

Source: com.omgSdk.andoclib.b;->a:28

API Call: WindowManager.addView

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Loads a webpage with cache disabled

Show sources

Source: com.omg.event.EventPlayController;->setSettings:26

API Call: android.webkit.WebSettings.setCacheMode

May query for the most recent running application (usually for UI overlaying)

Show sources

Source: com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp	getRunningTasks and getPackageName invocations in same method: com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp:8, com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp:12
Source: com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp	getRunningTasks and getPackageName invocations in same method: com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp:8, com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp:12

Spam, unwanted Advertisements and Ransom Demands:

Blocks or controls phone keys

Show sources

Source: com.core.model.a;->d:64

API Call: android.app.KeyguardManager.newKeyguardLock

May use Google Cloud Messaging (GCM) or Google's Cloud to Device Messaging (C2DM) services

Show sources

Source: submitted apk

Request permission: com.yonder.robi.permission.C2D_MESSAGE

Operating System Destruction:

Kills background processes

Show sources

Source: com.omgSdk.andoclib.AutoAccessibilityService;->onAccessibilityEvent:499	API Call: android.app.ActivityManager.killBackgroundProcesses
Source: com.omgSdk.andoclib.AutoAccessibilityService;->onAccessibilityEvent:507	API Call: android.app.ActivityManager.killBackgroundProcesses

Lists and deletes files in the same context

Show sources

Source: a.a.b.b;->a:90	API Calls in same method context: File.listFiles,File.delete
Source: b.a.bb$a;->a:24	API Calls in same method context: File.listFiles,File.delete
Source: com.cultivate.fairly.Incredible;->celebrate:29	API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: AndroidManifest.xml	String found in binary or memory: android.permission.GET_TASKS&android.permission.SYSTEM_ALERT_WINDOW android.permission.SET_WALLPAPER$android.permission.EXPAND_STATUS_BAR'android.permission.CHANGE_NETWORK_STATE#android.permission.DISABLE_KEYGUARD"android.permission.READ_SYNC_STATS(android.permission.AUTHENTICATE_ACCOUNTS'dianxin.permission.ACCESS_LAUNCHER_DATA&android.permission.SET_WALLPAPER_HINTS)android.permission.ACCESS_BLUETOOTH_SHARE,android.permission.MOUNT_UNMOUNT_FILESYSTEMS(android.permission.MODIFY_AUDIO_SETTINGS#com.goibibo.permission.MAPS_RECEIVE&android.permission.RUN_INSTRUMENTATION!android.permission.WRITE_CONTACTS"android.permission.MANAGE_ACCOUNTS
Source: android	String found in binary or memory: keyguard

Acquires a wake lock

Show sources

Source: com.google.apps.tiktok.concurrent.AndroidFutures;->a:9	API Call: android.os.PowerManager$WakeLock.acquire
Source: com.core.model.a;->d:59	API Call: android.os.PowerManager$WakeLock.acquire

Sets a repeating alarm

Show sources

Source: com.omgSdk.outport.LiveService;->a:8	API Call: android.app.AlarmManager.setRepeating
Source: com.omg.services.CommonReceiver;->startAlarm:72	API Call: android.app.AlarmManager.setRepeating

System Summary:

Tries to change file permissions on the native system using chmod

Show sources

Source: com.omg.event.utils.RootContext$ScriptRunner;->run:38

API Call: java.lang.Runtime.exec

Executes native commands

Show sources

Source: com.inasmuch.trample.Fly;->deceive:19	API Call: java.lang.ProcessBuilder.start
Source: com.omgSdk.outport.GetParamsUtil;->w:6	API Call: java.lang.ProcessBuilder.start
Source: com.omgSdk.commen.b;->a:80	API Call: java.lang.Runtime.exec ("ps")
Source: com.omgSdk.outport.AntiEmulator;->c:51	API Call: java.lang.ProcessBuilder.start
Source: sdk.nicro.lu.ps.b;->c:88	API Call: java.lang.ProcessBuilder.start
Source: com.lody.virtual.helper.utils.FileUtils;->chmod:36	API Call: java.lang.Runtime.exec
Source: com.lody.virtual.helper.utils.FileUtils;->createSymlink:64	API Call: java.lang.Runtime.exec
Source: com.omg.event.utils.CmdInvoke;->invoke:37	API Call: java.lang.Runtime.exec
Source: com.omg.event.utils.CmdInvoke;->invokeFor:55	API Call: java.lang.Runtime.exec
Source: com.omg.event.utils.CmdInvoke;->invokeFor:61	API Call: java.lang.Runtime.exec
Source: com.omg.event.utils.RootContext$ScriptRunner;->run:15	API Call: java.lang.Runtime.exec
Source: com.omg.event.utils.RootContext$ScriptRunner;->run:38	API Call: java.lang.Runtime.exec ("su")
Source: com.omg.event.utils.RootContext;->init:28	API Call: java.lang.Runtime.exec

Kills/terminates processes

Show sources

Source: com.lody.virtual.server.am.VActivityManagerService;->attachClient:21	API Call: android.os.Process.killProcess
Source: com.lody.virtual.server.am.VActivityManagerService;->attachClient:24	API Call: android.os.Process.killProcess
Source: com.lody.virtual.server.am.VActivityManagerService;->attachClient:26	API Call: android.os.Process.killProcess
Source: com.lody.virtual.server.am.VActivityManagerService;->killAllApps:365	API Call: android.os.Process.killProcess
Source: com.lody.virtual.server.am.VActivityManagerService;->killAppByPkg:375	API Call: android.os.Process.killProcess
Source: com.lody.virtual.server.am.VActivityManagerService;->killApplicationProcess:379	API Call: android.os.Process.killProcess
Source: com.lody.virtual.server.am.VActivityManagerService;->stopUser:515	API Call: android.os.Process.killProcess
Source: com.omg.tool.builds.ExceptionUtils$2$1;->run:3	API Call: android.os.Process.killProcess
Source: com.lody.virtual.client.VClientImpl;->bindApplicationNoCheck:22	API Call: android.os.Process.killProcess
Source: com.lody.virtual.client.env.VirtualRuntime;->crash:8	API Call: android.os.Process.killProcess
Source: com.omg.event.webjs.JsPlayer$2;->kill:8	API Call: android.os.Process.killProcess

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.AUTHENTICATE_ACCOUNTS
Source: submitted apk	Request permission: android.permission.BLUETOOTH
Source: submitted apk	Request permission: android.permission.BLUETOOTH_ADMIN
Source: submitted apk	Request permission: android.permission.CAMERA
Source: submitted apk	Request permission: android.permission.CHANGE_NETWORK_STATE
Source: submitted apk	Request permission: android.permission.CHANGE_WIFI_STATE
Source: submitted apk	Request permission: android.permission.GET_TASKS
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.MANAGE_ACCOUNTS
Source: submitted apk	Request permission: android.permission.MODIFY_AUDIO_SETTINGS
Source: submitted apk	Request permission: android.permission.MOUNT_UNMOUNT_FILESYSTEMS
Source: submitted apk	Request permission: android.permission.PERSISTENT_ACTIVITY
Source: submitted apk	Request permission: android.permission.READ_LOGS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.REORDER_TASKS
Source: submitted apk	Request permission: android.permission.SYSTEM_ALERT_WINDOW
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_CONTACTS
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE
Source: submitted apk	Request permission: android.permission.WRITE_SETTINGS
Source: submitted apk	Request permission: android.permission.WRITE_SYNC_SETTINGS

Classification label

Show sources

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.and@0/254@1/0

Creates SQLiteDatabase table

Show sources

Source: com.omgSdk.a.a;->onUpgrade:131	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: com.omgSdk.a.a;->onCreate:110	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: b.a.az;->c:38	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: b.a.az;->a:13	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: b.a.az;->b:30	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: b.a.cu;->a:13	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: b.a.cu;->b:26	API Call: android.database.sqlite.SQLiteDatabase.execSQL
Source: b.a.cu;->c:29	API Call: android.database.sqlite.SQLiteDatabase.execSQL

Loads native libraries

Show sources

Source: com.taobao.android.dex.interpret.ARTUtils;->init:8	API Call: java.lang.System.loadLibrary ("dexinterpret")
Source: com.taobao.android.runtime.DalvikUtils;->init:30	API Call: java.lang.System.loadLibrary ("dalvikhack")

Reads shares settings

Show sources

Source: b.a.ac;->a:85	API Call: android.content.SharedPreferences.getString
Source: b.a.ad;->g:59	API Call: android.content.SharedPreferences.getString
Source: b.a.ad;->a:63	API Call: android.content.SharedPreferences.getString
Source: b.a.ad;->c:141	API Call: android.content.SharedPreferences.getString
Source: b.a.ad;->c:162	API Call: android.content.SharedPreferences.getString
Source: b.a.ad;->e:198	API Call: android.content.SharedPreferences.getString
Source: b.a.b;->a:11	API Call: android.content.SharedPreferences.getString
Source: b.a.b;->a:34	API Call: android.content.SharedPreferences.getString
Source: b.a.b;->b:43	API Call: android.content.SharedPreferences.getString
Source: b.a.bb;->a:59	API Call: android.content.SharedPreferences.getString
Source: b.a.bb;->a:61	API Call: android.content.SharedPreferences.getString
Source: b.a.bb;->b:65	API Call: android.content.SharedPreferences.getString
Source: b.a.bb;->c:69	API Call: android.content.SharedPreferences.getString
Source: b.a.co;->h:45	API Call: android.content.SharedPreferences.getBoolean
Source: b.a.cx;->b:146	API Call: android.content.SharedPreferences.getString
Source: b.a.cx;->b:181	API Call: android.content.SharedPreferences.getString
Source: b.a.e$a;->b:26	API Call: android.content.SharedPreferences.getString
Source: b.a.l;->a:8	API Call: android.content.SharedPreferences.getString
Source: b.a.n;->a:99	API Call: android.content.SharedPreferences.getString
Source: b.a.q;->a:158	API Call: android.content.SharedPreferences.getString
Source: b.a.q;->a:254	API Call: android.content.SharedPreferences.getString
Source: b.a.t;->a:36	API Call: android.content.SharedPreferences.getString
Source: com.omgSdk.andoclib.h;->b:38	API Call: android.content.SharedPreferences.getBoolean
Source: com.omgSdk.andoclib.h;->c:47	API Call: android.content.SharedPreferences.getString
Source: com.omg.base.SdkBasic$ThirdBaseSdkBasic;->get:4	API Call: android.content.SharedPreferences.getString
Source: com.omg.tool.data.DataEvent$LockDataEvent$LockShare;->getEventList:76	API Call: android.content.SharedPreferences.getString
Source: com.core.model.k;->b:23	API Call: android.content.SharedPreferences.getBoolean
Source: com.core.model.k;->c:27	API Call: android.content.SharedPreferences.getString
Source: com.omg.plugin.PluginList$SharedPreferencesPluginList;->get:16	API Call: android.content.SharedPreferences.getString
Source: com.taobao.android.runtime.AndroidRuntime;->init:46	API Call: android.content.SharedPreferences.getBoolean
Source: com.taobao.android.runtime.AndroidRuntime;->init:56	API Call: android.content.SharedPreferences.getString
Source: com.taobao.android.runtime.AndroidRuntime;->init:59	API Call: android.content.SharedPreferences.getString

Registers a Sensor listener (to get data about accelerometer, gyrometer etc.)

Show sources

Source: com.omgSdk.andoclib.g;->a:25	API Call: android.hardware.SensorManager.registerListener
Source: com.omgSdk.andoclib.g;->a:32	API Call: android.hardware.SensorManager.registerListener

Data Obfuscation:

Obfuscates method names

Show sources

Source: wdeQEksXgm

Total valid method names: 62%

Uses reflection

Show sources

Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: null
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: public static synchronized android.bluetooth.BluetoothAdapter android.bluetooth.BluetoothAdapter.getDefaultAdapter()
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: android.bluetooth.BluetoothAdapter@3f034e42
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: public java.lang.String android.bluetooth.BluetoothAdapter.getName()
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: com.wag.CongratulationLC@a89c243
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: public abstract java.lang.Object android.content.Context.getSystemService(java.lang.String)
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: android.hardware.SystemSensorManager@399f11f9
Source: com.inasmuch.trample.Fly;->mountainous:58	API Call: Real call: public android.hardware.Sensor android.hardware.SensorManager.getDefaultSensor(int)
Source: com.cultivate.fairly.Incredible;->awful:21	API Call: Real call: public static java.lang.String android.app.ActivityThread.currentProcessName()
Source: sdk.nicro.lu.q$a;->a:3	API Call: Real call: private java.lang.ClassLoader java.lang.ClassLoader.parent
Source: com.omgSdk.outport.GetParamsUtil;->p:258	API Call: Real call: null
Source: com.omgSdk.outport.GetParamsUtil;->p:258	API Call: Real call: public static java.lang.String android.os.SystemProperties.get(java.lang.String)
Source: com.omgSdk.outport.GetParamsUtil;->m:212	API Call: Real call: android.os.Build@26af99b7
Source: com.omgSdk.outport.GetParamsUtil;->m:212	API Call: Real call: private static java.lang.String android.os.Build.getString(java.lang.String)
Source: com.sdk.entry.LoadVSdk;->getCurrentProcessName:8	API Call: Real call: null
Source: com.sdk.entry.LoadVSdk;->getCurrentProcessName:8	API Call: Real call: public static java.lang.String android.app.ActivityThread.currentProcessName()
Source: com.sdk.entry.LoadVSdk;->loaderPath:41	API Call: Real call: android.content.res.AssetManager@51fd308
Source: com.sdk.entry.LoadVSdk;->loaderPath:41	API Call: Real call: public final int android.content.res.AssetManager.addAssetPath(java.lang.String)
Source: a.a.a.b;->a:4	API Call: java.lang.reflect.Method.invoke
Source: a.a.a.b;->a:7	API Call: java.lang.reflect.Method.invoke
Source: b.a.ad;->a:97	API Call: java.lang.reflect.Method.invoke
Source: b.a.ad;->a:100	API Call: java.lang.reflect.Method.invoke
Source: b.a.at;->a:94	API Call: java.lang.reflect.Method.invoke
Source: b.a.m;->a:32	API Call: java.lang.reflect.Method.invoke
Source: b.a.n;->a:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.account.AccountManagerStub$addSharedAccountAsUser;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.account.AccountManagerStub$copyAccountToUser;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.account.AccountManagerStub$getSharedAccountsAsUser;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.account.AccountManagerStub$removeSharedAccountAsUser;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.account.AccountManagerStub$renameSharedAccountAsUser;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.account.AccountManagerStub$updateAppPermission;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.ActivityManagerStub$3;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.ActivityManagerStub$4;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$AddPackageDependency;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$BindService;->call:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$BindService;->call:19	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$BroadcastIntent;->call:79	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$CheckGrantUriPermission;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$CheckPermission;->call:9	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$CrashApplication;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetContentProvider;->call:13	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetContentProvider;->call:31	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetIntentSender;->call:45	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetPackageAskScreenCompat;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetPersistedUriPermissions;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetRunningAppProcesses;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GetTasks;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$GrantUriPermissionFromOwner;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$HandleIncomingUser;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$KillApplicationProcess;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$PublishContentProviders;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$PublishService;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$RegisterReceiver;->call:21	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$ServiceDoneExecuting;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$SetPackageAskScreenCompat;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$SetTaskDescription;->call:19	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StartActivity;->call:29	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StartActivity;->call:70	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StartActivity;->call:102	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StartService;->call:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StartService;->call:25	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StopService;->call:19	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StopServiceToken;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$StopServiceToken;->call:9	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$UnbindService;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$UnstableProviderDied;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$UpdateDeviceOwner;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.andoclib.Admob;->loadMiddlePlugin:184	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.andoclib.Admob;->loadMiddlePlugin:232	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.andoclib.Admob;->onDestroy:259	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.andoclib.c;->a:7	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.client.hook.base.BinderInvocationStub;->asInterface:14	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.base.MethodBox;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.base.MethodBox;->callSafe:10	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.base.MethodInvocationStub$HookInvocationHandler;->invoke:50	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.base.MethodProxy;->call:40	API Call: java.lang.reflect.Method.invoke
Source: com.omg.base.ComponentQuery$ApkParser;->parser:11	API Call: java.lang.reflect.Method.invoke
Source: com.omg.base.ComponentQuery$NewApkParser;->parser:5	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.commen.c;->a:3	API Call: java.lang.reflect.Field.get
Source: com.omgSdk.commen.c;->a:9	API Call: java.lang.reflect.Field.get
Source: com.omgSdk.commen.c;->a:16	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.commen.c;->b:48	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.commen.d;->a:99	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.commen.d;->a:126	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.compat.StorageManagerCompat;->getAllPoints:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.compat.StorageManagerCompat;->getMountedPoints:15	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.compat.StorageManagerCompat;->getMountedPoints:19	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.compat.StorageManagerCompat;->isMounted:29	API Call: java.lang.reflect.Method.invoke
Source: com.sdk.entry.LoadVSdk;->instance:22	API Call: java.lang.reflect.Method.invoke
Source: com.sdk.entry.LoadVSdk;->loadOnCreate:75	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.EventInjectService$3;->invoke:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.input.MethodProxies$StartInputOrWindowGainedFocus;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.ipc.LocalProxyUtils$1;->invoke:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.libcore.MethodProxies$Stat;->afterCall:12	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.client.hook.proxies.location.MockLocationHelper;->setGpsStatus:182	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.location.MockLocationHelper;->setGpsStatus:196	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.location.BinderHookHandler;->invoke:7	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.SdkLauncher$3;->a:8	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.g;->a:50	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.q$b;->a:3	API Call: java.lang.reflect.Method.invoke
Source: mirror.RefMethod;-><init>:12	API Call: java.lang.reflect.Field.get
Source: mirror.RefMethod;->call:38	API Call: java.lang.reflect.Method.invoke
Source: mirror.RefMethod;->callWithException:45	API Call: java.lang.reflect.Method.invoke
Source: mirror.RefObject;->get:7	API Call: java.lang.reflect.Field.get
Source: mirror.RefStaticMethod;-><init>:12	API Call: java.lang.reflect.Field.get
Source: mirror.RefStaticMethod;->call:73	API Call: java.lang.reflect.Method.invoke
Source: mirror.RefStaticMethod;->callWithException:76	API Call: java.lang.reflect.Method.invoke
Source: mirror.RefStaticObject;->get:7	API Call: java.lang.reflect.Field.get
Source: com.core.model.MApplication$3$1$1;->invoke:17	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.MApplication$3$1$1;->invoke:23	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.MApplication$3$1$1;->invoke:26	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.a;->a:8	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.a;->a:12	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.c$1$1;->invoke:27	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.c$1$1;->invoke:36	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.e$2;->invoke:9	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.f$1;->invoke:7	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.f;->a:8	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.f;->a:12	API Call: java.lang.reflect.Field.get
Source: com.core.model.g;->a:24	API Call: java.lang.reflect.Field.get
Source: com.core.model.g;->a:29	API Call: java.lang.reflect.Field.get
Source: com.core.model.g;->a:36	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.g;->b:47	API Call: java.lang.reflect.Field.get
Source: com.core.model.g;->b:52	API Call: java.lang.reflect.Field.get
Source: com.core.model.g;->b:59	API Call: java.lang.reflect.Method.invoke
Source: com.core.model.i$a;->a:5	API Call: java.lang.reflect.Field.get
Source: com.core.model.j;->a:3	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$AreNotificationsEnabledForPackage;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$CancelAllNotifications;->call:9	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$CancelNotificationWithTag;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$CancelNotificationWithTag;->call:14	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$EnqueueNotification;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$EnqueueNotification;->call:19	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$EnqueueNotificationWithTag;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$EnqueueNotificationWithTag;->call:23	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.notification.MethodProxies$SetNotificationsEnabledForPackage;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.outport.CoreLeader;->a:5	API Call: java.lang.reflect.Field.get
Source: com.omgSdk.outport.CoreLeader;->a:10	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.outport.CoreLeader;->invoke:49	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.outport.CoreLeader;->invoke:60	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.outport.SdkInvoker;->a:7	API Call: java.lang.reflect.Method.invoke
Source: com.omgSdk.outport.SdkInvoker;->a:13	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$CheckSignatures;->call:16	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$ClearPackagePersistentPreferredActivities;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$ClearPackagePreferredActivities;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$DeleteApplicationCacheFiles;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetActivityInfo;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetActivityInfo;->call:10	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetApplicationBlockedSettingAsUser;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetApplicationEnabledSetting;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetApplicationInfo;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetApplicationInfo;->call:9	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetComponentEnabledSetting;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPackageGids;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPackageInfo;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPackageInstaller;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPackageUid;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPermissionFlags;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPermissions;->call:2	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetPreferredActivities;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetProviderInfo;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetProviderInfo;->call:10	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetReceiverInfo;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetReceiverInfo;->call:9	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetServiceInfo;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$IsPackageAvailable;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$QueryIntentActivities;->call:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$QueryIntentContentProviders;->call:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$QueryIntentReceivers;->call:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$QueryIntentServices;->call:7	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$RemovePackageFromPreferred;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$ResolveContentProvider;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$ResolveIntent;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$ResolveService;->call:6	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$RevokeRuntimePermission;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$SetApplicationBlockedSettingAsUser;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$SetApplicationEnabledSetting;->call:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$SetPackageStoppedState;->call:3	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.ps.b$a;->a:15	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.ps.f$c;->a:27	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.ps.f$d$1;->getTheme:27	API Call: java.lang.reflect.Method.invoke
Source: sdk.nicro.lu.ps.f$d;->b:78	API Call: java.lang.reflect.Method.invoke
Source: com.taobao.android.runtime.ReflectionUtils;->getField:4	API Call: java.lang.reflect.Field.get
Source: com.taobao.android.runtime.RuntimeUtils;->isYunOS:28	API Call: java.lang.reflect.Method.invoke
Source: com.taobao.android.runtime.RuntimeUtils;->isYunOS:30	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.search.SearchManagerStub$GetSearchableInfo;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.secondary.ProxyServiceFactory$1$1$1;->invoke:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.secondary.ProxyServiceFactory$2$1$1;->invoke:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.secondary.ProxyServiceFactory$3$1$1;->invoke:3	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.secondary.StubBinder;->queryLocalInterface:29	API Call: java.lang.reflect.Method.invoke
Source: com.omg.base.network.serializer.MessageCodec;->c:80	API Call: java.lang.reflect.Field.get
Source: com.omg.base.network.serializer.MessageCodec;->deserializeObject:152	API Call: java.lang.reflect.Field.get
Source: com.omg.base.network.serializer.MessageCodec;->serializeObject:246	API Call: java.lang.reflect.Field.get
Source: com.omg.base.network.serializer.MessageCodec;->serializeObject:253	API Call: java.lang.reflect.Field.get
Source: com.omg.base.network.serializer.MessageCodec;->serializeObject:286	API Call: java.lang.reflect.Field.get
Source: com.omg.base.network.serializer.MessageCodec;->serializeObject:302	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.client.hook.proxies.window.session.BaseMethodProxy;->call:4	API Call: java.lang.reflect.Method.invoke
Source: com.omg.tool.ClassCopier;->a:32	API Call: java.lang.reflect.Field.get
Source: com.omg.tool.Reflect$Method;->invoke:3	API Call: java.lang.reflect.Method.invoke
Source: com.omg.tool.Reflect$Method;->invoke:6	API Call: java.lang.reflect.Method.invoke
Source: com.omg.tool.ReflectHelper;->getValue:25	API Call: java.lang.reflect.Field.get
Source: com.omg.tool.ReflectHelper;->invoke:32	API Call: java.lang.reflect.Method.invoke
Source: com.omg.tool.Type$FieldProperty;->getValue:14	API Call: java.lang.reflect.Field.get
Source: com.omg.tool.Type$MethodProperty;->getValue:26	API Call: java.lang.reflect.Method.invoke
Source: com.omg.tool.Type$MethodProperty;->setValue:28	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.utils.Reflect;->on:73	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.utils.Reflect;->on:75	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.helper.utils.Reflect;->field:188	API Call: java.lang.reflect.Field.get
Source: com.omg.event.utils.NativeInvoke;->invokeMethodByFactory:48	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.NativeInvoke;->invokeMethodByFactory:53	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->get:4	API Call: java.lang.reflect.Field.get
Source: com.omg.event.utils.ReflacUtlis;->get:11	API Call: java.lang.reflect.Field.get
Source: com.omg.event.utils.ReflacUtlis;->invokeMeth:26	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMeth:27	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMeth:33	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMeth:34	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMeth:40	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMeth:41	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMethFor:47	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMethFor:48	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMethFor:54	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.ReflacUtlis;->invokeMethFor:55	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.Reflect;->on:73	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.Reflect;->on:75	API Call: java.lang.reflect.Method.invoke
Source: com.omg.event.utils.Reflect;->field:188	API Call: java.lang.reflect.Field.get
Source: com.omg.event.utils.ViewHelp;->getAllRootViewsObject:107	API Call: java.lang.reflect.Field.get
Source: com.omg.event.utils.ViewHelp;->getAllRootViewsObject:112	API Call: java.lang.reflect.Field.get
Source: com.omg.event.utils.ViewHelp;->getAllRootViewsObject:119	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.DelegateApplication64Bit;->expandFieldArray:3	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.DelegateApplication64Bit;->expandFieldList:11	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.DelegateApplication64Bit;->makeDexElements:56	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.DelegateApplication64Bit;->attachBaseContext:66	API Call: java.lang.reflect.Field.get
Source: com.lody.virtual.DelegateApplication64Bit;->attachBaseContext:83	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.DelegateApplication64Bit;->attachBaseContext:110	API Call: java.lang.reflect.Field.get
Source: .abq;->a:7	API Call: java.lang.reflect.Method.invoke
Source: .abq;->a:87	API Call: java.lang.reflect.Method.invoke
Source: .aco;->a:15	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.window.MethodProxies$BasePatchSession;->call:5	API Call: java.lang.reflect.Method.invoke
Source: com.lody.virtual.client.hook.proxies.window.MethodProxies$OverridePendingAppTransitionInPlace;->call:3	API Call: java.lang.reflect.Method.invoke

Persistence and Installation Behavior:

Drops a new APK file

Show sources

Source: Android App

File dump: /data/data/air.nu.strafwerk.takecontrol/cache/07f457cd737b20bb7c8673ca1c8f0470.apk

Jump to dropped file

Installs an application shortcut on the screen

Show sources

Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$BroadcastIntent;->handleInstallShortcutIntent:25	API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT
Source: com.lody.virtual.client.hook.proxies.am.MethodProxies$BroadcastIntent;->handleUninstallShortcutIntent:70	API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT
Source: com.lody.virtual.client.core.VirtualCore;->createShortcut:83	API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT
Source: com.lody.virtual.client.core.VirtualCore;->removeShortcut:267	API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT
Source: com.omg.android.tool.AndroidTool;->createShortcut:16	API Call: android.content.Intent.putExtra android.intent.extra.shortcut.INTENT

Sets an intent to the APK data type (used to install other APKs)

Show sources

Source: com.omg.android.tool.AppInstaller;->b:12

API Call: android.content.Intent.setDataAndType(n/a,"application/vnd.android.package-archive")

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Installs a new wake lock (to get activate on phone screen on)

Show sources

Source: com.google.apps.tiktok.concurrent.AndroidFutures;->a:8	API Call: android.os.PowerManager.newWakeLock
Source: com.core.model.a;->d:58	API Call: android.os.PowerManager.newWakeLock

Hooking and other Techniques for Hiding and Protection:

Has permission to draw over other applications or user interfaces

Show sources

Source: submitted apk

Request permission: android.permission.SYSTEM_ALERT_WINDOW

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Has permission to use bluetooth to discover and pair with other devices

Show sources

Source: submitted apk

Request permission: android.permission.BLUETOOTH_ADMIN

Queries list of running processes/tasks

Show sources

Source: com.lody.virtual.server.am.ActivityStack;->getRunningTaskIds:82	API Call: android.app.ActivityManager.getRunningTasks
Source: com.lody.virtual.server.am.VActivityManagerService;->getProcessName:67	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.lody.virtual.client.core.VirtualCore;->isEngineLaunched:201	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.sdk.export.APIExporter$1;->getRunningProcess:3	API Call: android.app.ActivityManager.getRunningAppProcesses
Source: com.sdk.export.APIExporter$1;->getRunningTasks:5	API Call: android.app.ActivityManager.getRunningTasks
Source: com.sdk.export.APIExporter$1;->getTopTask:7	API Call: android.app.ActivityManager.getRunningTasks
Source: com.omg.android.tool.AppRunningChecker$ActivityAppRunningChecker;->getRunningApp:8	API Call: android.app.ActivityManager.getRunningTasks
Source: com.omg.android.tool.ProcessHelper;->isProcessRunning:28	API Call: android.app.ActivityManager.getRunningAppProcesses

Queries package code path (often used for patching other applications)

Show sources

Source: sdk.nicro.lu.s$a;->c:92

API Call: android.content.Context.getPackageCodePath

Uses Crypto APIs

Show sources

Source: com.omg.tool.DesHelper;->decrypt:13	API Call: javax.crypto.Cipher.getInstance
Source: com.omg.tool.DesHelper;->decrypt:15	API Call: javax.crypto.Cipher.doFinal
Source: sdk.nicro.lu.d;->a:4	API Call: java.security.MessageDigest.getInstance
Source: sdk.nicro.lu.d;->a:5	API Call: java.security.MessageDigest.digest
Source: sdk.nicro.lu.c;->b:17	API Call: javax.crypto.Cipher.getInstance
Source: sdk.nicro.lu.c;->b:19	API Call: javax.crypto.Cipher.doFinal
Source: com.sdk.entry.LoadVSdk;->md5ProcessName:48	API Call: java.security.MessageDigest.getInstance
Source: com.sdk.entry.LoadVSdk;->md5ProcessName:50	API Call: java.security.MessageDigest.update
Source: com.sdk.entry.LoadVSdk;->md5ProcessName:52	API Call: java.security.MessageDigest.digest
Source: a.a.a.c;->a:58	API Call: java.security.MessageDigest.getInstance
Source: a.a.a.c;->a:60	API Call: java.security.MessageDigest.update
Source: a.a.a.c;->a:61	API Call: java.security.MessageDigest.digest
Source: b.a.ar;->a:39	API Call: javax.crypto.Cipher.getInstance
Source: b.a.ar;->a:44	API Call: javax.crypto.Cipher.init
Source: b.a.ar;->a:45	API Call: javax.crypto.Cipher.doFinal
Source: b.a.ar;->b:54	API Call: java.security.MessageDigest.getInstance
Source: b.a.ar;->b:56	API Call: java.security.MessageDigest.update
Source: b.a.ar;->b:57	API Call: java.security.MessageDigest.digest
Source: b.a.ar;->b:60	API Call: javax.crypto.Cipher.getInstance
Source: b.a.ar;->b:65	API Call: javax.crypto.Cipher.init
Source: b.a.ar;->b:66	API Call: javax.crypto.Cipher.doFinal
Source: b.a.ar;->c:69	API Call: java.security.MessageDigest.getInstance
Source: b.a.ar;->c:70	API Call: java.security.MessageDigest.update
Source: b.a.ar;->c:71	API Call: java.security.MessageDigest.digest
Source: b.a.at;->r:280	API Call: java.security.MessageDigest.getInstance
Source: b.a.at;->r:282	API Call: java.security.MessageDigest.digest
Source: b.a.au;->a:19	API Call: java.security.MessageDigest.getInstance
Source: b.a.au;->a:21	API Call: java.security.MessageDigest.update
Source: b.a.au;->a:22	API Call: java.security.MessageDigest.digest
Source: b.a.au;->b:54	API Call: java.security.MessageDigest.getInstance
Source: b.a.au;->b:56	API Call: java.security.MessageDigest.update
Source: b.a.au;->b:57	API Call: java.security.MessageDigest.digest
Source: a.a.b.b;->b:96	API Call: java.security.MessageDigest.getInstance
Source: a.a.b.b;->b:100	API Call: java.security.MessageDigest.digest
Source: a.a.b.b;->b:103	API Call: java.security.MessageDigest.update
Source: sdk.nicro.lu.c;->a:9	API Call: javax.crypto.Cipher.getInstance
Source: sdk.nicro.lu.c;->a:10	API Call: javax.crypto.Cipher.init
Source: sdk.nicro.lu.c;->a:11	API Call: javax.crypto.Cipher.doFinal
Source: sdk.nicro.lu.c;->b:18	API Call: javax.crypto.Cipher.init
Source: com.core.model.MApplication$2;->a:231	API Call: javax.crypto.Cipher.getInstance
Source: com.core.model.MApplication$2;->a:232	API Call: javax.crypto.Cipher.init
Source: com.core.model.MApplication$2;->a:233	API Call: javax.crypto.Cipher.doFinal
Source: com.lody.virtual.client.stub.VASettings;->decrypt:16	API Call: javax.crypto.Cipher.getInstance
Source: com.lody.virtual.client.stub.VASettings;->decrypt:17	API Call: javax.crypto.Cipher.init
Source: com.lody.virtual.client.stub.VASettings;->decrypt:18	API Call: javax.crypto.Cipher.doFinal
Source: com.omg.tool.DesHelper;->decrypt:14	API Call: javax.crypto.Cipher.init
Source: com.omg.tool.DesHelper;->encrypt:22	API Call: javax.crypto.Cipher.getInstance
Source: com.omg.tool.DesHelper;->encrypt:23	API Call: javax.crypto.Cipher.init
Source: com.omg.tool.DesHelper;->encrypt:24	API Call: javax.crypto.Cipher.doFinal
Source: com.omg.tool.MD5Util;->md5:3	API Call: java.security.MessageDigest.getInstance
Source: com.omg.tool.MD5Util;->md5:4	API Call: java.security.MessageDigest.update
Source: com.omg.tool.MD5Util;->md5:5	API Call: java.security.MessageDigest.digest
Source: com.lody.virtual.helper.utils.MD5Utils;-><clinit>:2	API Call: java.security.MessageDigest.getInstance
Source: com.lody.virtual.helper.utils.MD5Utils;->getFileMD5String:22	API Call: java.security.MessageDigest.update
Source: com.lody.virtual.helper.utils.MD5Utils;->getFileMD5String:25	API Call: java.security.MessageDigest.digest
Source: com.lody.virtual.helper.utils.MD5Utils;->getFileMD5String:29	API Call: java.security.MessageDigest.update
Source: com.lody.virtual.helper.utils.MD5Utils;->getFileMD5String:32	API Call: java.security.MessageDigest.digest
Source: com.omg.event.utils.Digest;->md5:5	API Call: java.security.MessageDigest.getInstance
Source: com.omg.event.utils.Digest;->md5:6	API Call: java.security.MessageDigest.digest

Malware Analysis System Evasion:

Might try to detect if ADB is running

Show sources

Source: Lsdk/nicro/lu/ps/b;->a(Landroid/content/Context;Lorg/json/JSONObject;)V	Method string: adb_enabled
Source: Lcom/omgSdk/outport/GetParamsUtil;->h()Z	Method string: adb_enabled

Tries to check if this is a real phone (bluethoot adapter)

Show sources

Source: com.inasmuch.trample.Fly;->mountainous:58

API Call: Reflective call: android.bluetooth.BluetoothAdapter@3f034e42

Tries to check if this is a real phone (default sensor)

Show sources

Source: com.inasmuch.trample.Fly;->mountainous:58

API Call: Reflective call: android.hardware.SystemSensorManager@399f11f9

Tries to detect Cuckoo Sandbox via stack trace enumeration

Show sources

Source: Lsdk/nicro/lu/ps/b;->e()Z

Method string: "cuckoo"

Tries to detect Cydia Substrate code modification platform

Show sources

Source: Lcom/omgSdk/outport/GetParamsUtil;->y()Z	Method string: com.saurik.substrate
Source: Lcom/omgSdk/outport/AntiEmulator;->d()Z	Method string: com.saurik.substrate
Source: Lsdk/nicro/lu/ps/b;->d()Z	Method string: com.saurik.substrate
Source: Lsdk/nicro/lu/ps/b;->e()Z	Method string: com.saurik.substrate.MS$2
Source: Lcom/omgSdk/outport/AntiEmulator;->e()Z	Method string: com.saurik.substrate.MS$2
Source: Lcom/omgSdk/outport/GetParamsUtil;->z()Z	Method string: com.saurik.substrate.MS$2
Source: Lcom/omgSdk/outport/GetParamsUtil;->x()Z	Method string: com.saurik.substrate
Source: Lcom/omgSdk/outport/AntiEmulator;->a(Landroid/content/Context;)Z	Method string: com.saurik.substrate
Source: Lsdk/nicro/lu/ps/b;->d(Landroid/content/Context;)Z	Method string: com.saurik.substrate

Tries to detect Droidbox via stack trace enumeration

Show sources

Source: Lsdk/nicro/lu/ps/b;->e()Z

Method string: "droidbox"

Tries to detect XPosed instrumentation framework

Show sources

Source: Lcom/omgSdk/outport/GetParamsUtil;->y()Z	Method string: XposedBridge.jar
Source: Lcom/omgSdk/outport/AntiEmulator;->d()Z	Method string: XposedBridge.jar
Source: Lsdk/nicro/lu/ps/b;->d()Z	Method string: XposedBridge.jar
Source: Lsdk/nicro/lu/ps/b;->e()Z	Method string: de.robv.android.xposed.XposedBridge
Source: Lcom/omgSdk/outport/AntiEmulator;->e()Z	Method string: de.robv.android.xposed.XposedBridge
Source: Lcom/omgSdk/outport/GetParamsUtil;->z()Z	Method string: de.robv.android.xposed.XposedBridge
Source: Lcom/omgSdk/outport/GetParamsUtil;->x()Z	Method string: de.robv.android.xposed.installer
Source: Lcom/omgSdk/outport/AntiEmulator;->a(Landroid/content/Context;)Z	Method string: de.robv.android.xposed.installer
Source: Lsdk/nicro/lu/ps/b;->d(Landroid/content/Context;)Z	Method string: de.robv.android.xposed.installer

Accesses /proc

Show sources

Source: Lcom/inasmuch/trample/Fly;->deceive()Ljava/lang/String;	Method string: "/proc/cpuinfo"
Source: Lcom/omgSdk/outport/GetParamsUtil;->w()Ljava/lang/String;	Method string: "/proc/cpuinfo"
Source: Lcom/omgSdk/outport/AntiEmulator;->d()Z	Method string: "/proc/"
Source: Lsdk/nicro/lu/ps/b;->d()Z	Method string: "/proc/"
Source: Lcom/omgSdk/outport/AntiEmulator;->c()Ljava/lang/String;	Method string: "/proc/cpuinfo"
Source: Lsdk/nicro/lu/ps/b;->c()Ljava/lang/String;	Method string: "/proc/cpuinfo"
Source: Lb/a/at;->a()Ljava/lang/String;	Method string: "/proc/cpuinfo"
Source: Lsdk/nicro/lu/s$a;->v()I	Method string: "/proc/meminfo"

Accesses android OS build fields

Show sources

Source: com.convenience.amplify.Faithful;->chairman:2	Field Access: android.os.Build.MANUFACTURER
Source: com.convenience.amplify.Faithful;->chairman:7	Field Access: android.os.Build.MODEL
Source: com.omg.base.terminal.OmgTerminalinfo;->init:64	Field Access: android.os.Build.PRODUCT
Source: com.omg.base.terminal.OmgTerminalinfo;->init:67	Field Access: android.os.Build.MODEL
Source: com.omg.base.terminal.OmgPhoneInfo;->init:52	Field Access: android.os.Build.MANUFACTURER
Source: com.omg.base.terminal.OmgPhoneInfo;->init:55	Field Access: android.os.Build.MODEL
Source: com.omg.base.terminal.OmgPhoneInfo;->init:63	Field Access: android.os.Build.BRAND
Source: sdk.nicro.lu.s$b;-><init>:7	Field Access: android.os.Build.MODEL
Source: com.omgSdk.outport.GetParamsUtil;->f:121	Field Access: android.os.Build.TAGS
Source: a.a.a.c;->a:7	Field Access: android.os.Build.MANUFACTURER
Source: a.a.a.c;->a:14	Field Access: android.os.Build.MODEL
Source: a.a.a.c;->a:21	Field Access: android.os.Build.BOARD
Source: a.a.a.c;->a:28	Field Access: android.os.Build.BRAND
Source: a.a.a.c;->a:35	Field Access: android.os.Build.DEVICE
Source: a.a.a.c;->a:49	Field Access: android.os.Build.PRODUCT
Source: b.a.q;->a:292	Field Access: android.os.Build$VERSION.RELEASE
Source: b.a.q;->a:313	Field Access: android.os.Build.MODEL
Source: b.a.q;->a:316	Field Access: android.os.Build.BOARD
Source: b.a.q;->a:319	Field Access: android.os.Build.BRAND
Source: b.a.q;->a:324	Field Access: android.os.Build.MANUFACTURER
Source: b.a.q;->a:327	Field Access: android.os.Build.ID
Source: b.a.q;->a:330	Field Access: android.os.Build.DEVICE
Source: b.a.w;->a:22	Field Access: android.os.Build.MODEL
Source: b.a.w;->a:26	Field Access: android.os.Build$VERSION.RELEASE
Source: com.omg.base.phone.factoryimpl.PhoneController;->a:7	Field Access: android.os.Build.MODEL
Source: com.omg.base.phone.factoryimpl.PhoneController;->a:10	Field Access: android.os.Build.BOARD
Source: com.omg.base.phone.factoryimpl.PhoneController;->a:13	Field Access: android.os.Build.DEVICE
Source: com.omg.base.phone.factoryimpl.PhoneController;->a:16	Field Access: android.os.Build.MANUFACTURER
Source: com.omg.base.phone.factoryimpl.PhoneController;->a:19	Field Access: android.os.Build.PRODUCT
Source: com.lody.virtual.client.hook.proxies.location.LocationManagerStub;->onBindMethods:41	Field Access: android.os.Build$VERSION.RELEASE
Source: sdk.nicro.lu.b;->a:3	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.l;->a:12	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.l;->a:14	Field Access: android.os.Build.MANUFACTURER
Source: sdk.nicro.lu.l;->a:16	Field Access: android.os.Build.PRODUCT
Source: sdk.nicro.lu.p$2;->a:4	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.p;->a:3	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.s$a;-><init>:2	Field Access: android.os.Build.PRODUCT
Source: sdk.nicro.lu.s$a;-><init>:4	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.s$a;-><init>:9	Field Access: android.os.Build$VERSION.RELEASE
Source: sdk.nicro.lu.s$c;-><init>:7	Field Access: android.os.Build.MODEL
Source: com.lody.virtual.client.hook.proxies.notification.NotificationManagerStub;->onBindMethods:43	Field Access: android.os.Build.BRAND
Source: com.lody.virtual.client.hook.proxies.notification.NotificationManagerStub;->onBindMethods:46	Field Access: android.os.Build.MANUFACTURER
Source: com.omg.plugin.PluginContext$DexClassLoaderPluginContext;->loadPluginPackage:16	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.ps.b;->a:24	Field Access: android.os.Build.TYPE
Source: sdk.nicro.lu.ps.e;->a:23	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.ps.e;->a:25	Field Access: android.os.Build.PRODUCT
Source: sdk.nicro.lu.ps.e;->a:27	Field Access: android.os.Build$VERSION.RELEASE
Source: sdk.nicro.lu.ps.f$b;->b:5	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.ps.f$b;->b:20	Field Access: android.os.Build.MANUFACTURER
Source: sdk.nicro.lu.ps.f$d;->c:5	Field Access: android.os.Build.MODEL
Source: sdk.nicro.lu.ps.f$d;->c:20	Field Access: android.os.Build.MANUFACTURER
Source: com.taobao.android.runtime.AndroidRuntime;->trace:16	Field Access: android.os.Build.MODEL
Source: com.taobao.android.runtime.AndroidRuntime;->trace:20	Field Access: android.os.Build$VERSION.RELEASE
Source: com.taobao.android.runtime.AndroidRuntime;->init:79	Field Access: android.os.Build.BRAND
Source: com.omg.tool.FileCreator;->getDir:3	Field Access: android.os.Build.DEVICE
Source: com.omg.tool.FileCreator;->getDir:5	Field Access: android.os.Build.PRODUCT
Source: com.omg.tool.FileCreator;->getDir:7	Field Access: android.os.Build$VERSION.RELEASE

Queries several sensitive phone informations

Show sources

Source: Lb/a/q;->a([I)Lorg/json/JSONObject;	Method string: "os"
Source: Lcom/lody/virtual/server/am/ActivityStack;->getCallingPackage(ILandroid/os/IBinder;)Ljava/lang/String;	Method string: "android"
Source: Lb/a/q;->a([I)Lorg/json/JSONObject;	Method string: "cpu"
Source: Lcom/omg/base/network/objects/TerminalInfo;->fromJson(Ljava/lang/String;)V	Method string: "imsi"
Source: Lcom/omg/base/network/serializer/MessageCodec;->c(Ljava/lang/Class;)Z	Method string: "type"
Source: Lb/a/ak;-><clinit>()V	Method string: "version"
Source: Lcom/omg/base/phone/factoryimpl/PhoneController;->a(Landroid/content/Context;)V	Method string: "manufacturer"
Source: Lcom/lody/virtual/client/hook/proxies/telephony/TelephonyStub;-><init>()V	Method string: "phone"
Source: Lsdk/nicro/lu/s$c;->a()Ljava/lang/String;	Method string: "appid"
Source: Lb/a/f;-><init>(Landroid/content/Context;)V	Method string: "imei"
Source: Lcom/omg/base/phone/factoryimpl/PhoneController;->a(Landroid/content/Context;)V	Method string: "model"
Source: Lsdk/nicro/lu/t$a;->d(Ljava/lang/String;)V	Method string: "sdk"

Queries the unique operating system id (ANDROID_ID)

Show sources

Source: b.a.at;->A:6	API Call: android.provider.Settings$Secure.getString
Source: b.a.at;->A:15	API Call: android.provider.Settings$Secure.getString
Source: b.a.at;->A:27	API Call: android.provider.Settings$Secure.getString
Source: b.a.at;->w:320	API Call: android.provider.Settings$Secure.getString
Source: b.a.at;->z:347	API Call: android.provider.Settings$Secure.getString
Source: b.a.at;->z:358	API Call: android.provider.Settings$Secure.getString
Source: b.a.at;->z:368	API Call: android.provider.Settings$Secure.getString
Source: b.a.cz;->a:6	API Call: android.provider.Settings$Secure.getString

Tries to query CPU info

Show sources

Source: com.inasmuch.trample.Fly;->deceive:19	API Call: java.lang.ProcessBuilder.start
Source: com.omgSdk.outport.GetParamsUtil;->w:6	API Call: java.lang.ProcessBuilder.start
Source: com.omgSdk.outport.AntiEmulator;->c:51	API Call: java.lang.ProcessBuilder.start
Source: sdk.nicro.lu.ps.b;->c:88	API Call: java.lang.ProcessBuilder.start

Anti Debugging:

Checks if app is currently debugged

Show sources

Source: Lsdk/nicro/lu/ps/b;->a(Landroid/content/Context;Lorg/json/JSONObject;)V	Method string: s_debug
Source: Lsdk/nicro/lu/ps/b;->a(Landroid/content/Context;Lorg/json/JSONObject;)V	Method string: ro.debuggable
Source: Lsdk/nicro/lu/ps/b;->a(Landroid/content/Context;Lorg/json/JSONObject;)V	Method string: s_appDebug

Creates a new jar file (likely to load a new code)

Show sources

Source: com.convenience.amplify.Faithful;->chairman:11

API Call: java.io.File.__construct /data/data/air.nu.strafwerk.takecontrol/cache/1178572636/9377583.jar

Tries to detect Bluestack emulator

Show sources

Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.setup"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.appsettings"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/app/com.bluestacks.help-1.apk"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.bstfolder"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/app/com.bluestacks.BstCommandProcessor-1.apk"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.spotlight"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/mnt/prebundledapps/bluestacks.prop.orig"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/bluestacks.prop"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.help"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/app/com.bluestacks.appmart-1.apk"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.home"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.BstCommandProcessor"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.appfinder"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.settings"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/app/com.bluestacks.searchapp-1.apk"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/app/com.bluestacks.s2p-1.apk"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.androVM.vmconfig"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/app/com.bluestacks.home-1.apk"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.s2p"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.accelerometerui"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.appmart"
Source: Lcom/omgSdk/outport/GetParamsUtil;->s()Z	Method string: "/data/data/com.bluestacks.searchapp"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.setup"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.appsettings"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/app/com.bluestacks.help-1.apk"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.bstfolder"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/app/com.bluestacks.BstCommandProcessor-1.apk"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.spotlight"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/mnt/prebundledapps/bluestacks.prop.orig"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/bluestacks.prop"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.help"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/app/com.bluestacks.appmart-1.apk"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.home"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.appfinder"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.BstCommandProcessor"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.settings"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/app/com.bluestacks.searchapp-1.apk"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/app/com.bluestacks.s2p-1.apk"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.androVM.vmconfig"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/app/com.bluestacks.home-1.apk"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.s2p"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.accelerometerui"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.appmart"
Source: Lcom/omgSdk/outport/AntiEmulator;-><clinit>()V	Method string: "/data/data/com.bluestacks.searchapp"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.setup"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.appsettings"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/app/com.bluestacks.help-1.apk"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.bstfolder"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/app/com.bluestacks.BstCommandProcessor-1.apk"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.spotlight"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/mnt/prebundledapps/bluestacks.prop.orig"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/bluestacks.prop"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.help"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/app/com.bluestacks.appmart-1.apk"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.home"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.appfinder"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.BstCommandProcessor"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.settings"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/app/com.bluestacks.searchapp-1.apk"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/app/com.bluestacks.s2p-1.apk"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.androVM.vmconfig"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/app/com.bluestacks.home-1.apk"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.s2p"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.accelerometerui"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.appmart"
Source: Lsdk/nicro/lu/ps/b;-><clinit>()V	Method string: "/data/data/com.bluestacks.searchapp"

HIPS / PFW / Operating System Protection Evasion:

Uses the DexClassLoader (often used for code injection)

Show sources

Source: com.full.naturally.Assist;->intention:33	API Call: dalvik.system.DexClassLoader.__construct("/data/data/air.nu.strafwerk.takecontrol/cache/1178572636/9377583.jar")
Source: com.full.naturally.Assist;->intention:36	API Call: dalvik.system.DexClassLoader.loadClass("com.sdk.entry.SdkEntry")
Source: com.omgSdk.andoclib.Admob;->loadMiddlePlugin:186	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omgSdk.andoclib.Admob;->loadMiddlePlugin:207	API Call: dalvik.system.DexClassLoader.loadClass (not executed)
Source: com.omgSdk.andoclib.Admob;->onDestroy:256	API Call: dalvik.system.DexClassLoader.loadClass (not executed)
Source: a.a.b.b;->a:126	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omgSdk.commen.d;->a:102	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omgSdk.commen.d;->a:119	API Call: dalvik.system.DexClassLoader.loadClass (not executed)
Source: com.sdk.entry.LoadVSdk;->loaderPath:44	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omg.plugin.PluginContext$DexClassLoaderPluginContext;->loadPluginPackage:54	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omg.plugin.PluginContext$DexClassLoaderPluginContext;->loadPluginPackage:85	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omg.plugin.PluginContext$ResourcesPluginContext;->a:46	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: sdk.nicro.lu.ps.f$b;->b:41	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: sdk.nicro.lu.ps.f$b;->b:67	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: sdk.nicro.lu.ps.f$d;->c:41	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: sdk.nicro.lu.ps.f$d;->c:57	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.taobao.android.runtime.ClassLoaderInjectorAboveApi14;->injectAboveEqualApiLevel14:30	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.taobao.android.runtime.ClassLoaderInjectorAliyunOs;->injectInAliyunOs:5	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.taobao.android.runtime.ClassLoaderInjectorBelowApiLevel14;->injectBelowApiLevel14:6	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omg.tool.Loader$AssetsClassLoader;->a:45	API Call: dalvik.system.DexClassLoader.<init> (not executed)
Source: com.omg.tool.Loader$ResourceClassLoader;->a:40	API Call: dalvik.system.DexClassLoader.<init> (not executed)

Language, Device and Operating System Detection:

Checks if phone is rooted (checks for Superuser.apk)

Show sources

Source: com.omgSdk.outport.GetParamsUtil;->f:134

API Call: java.io.File.__construct("/system/app/Superuser.apk")

Checks if phone is rooted (checks for su binary)

Show sources

Source: Lsdk/nicro/lu/s$a;->c()B

Method string: "/system/bin/", "su" and API call "File.exists" in same context

Checks if phone is rooted (checks for test-keys build tags)

Show sources

Source: com.omgSdk.outport.GetParamsUtil;->f:123

API Call: java.lang.String.contains("test-keys")

Queries the WIFI MAC address

Show sources

Source: b.a.at;->y:337

API Call: android.net.wifi.WifiInfo.getMacAddress

Queries the network MAC address

Show sources

Source: b.a.at;->b:108	API Call: java.net.NetworkInterface.getHardwareAddress
Source: sdk.nicro.lu.s$a;->u:202	API Call: java.net.NetworkInterface.getHardwareAddress
Source: com.omg.base.terminal.OmgPhoneInfo;->getMacAddress:15	API Call: java.net.NetworkInterface.getHardwareAddress

Queries the network operator name

Show sources

Source: b.a.at;->g:183

API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: com.omg.base.phone.factoryimpl.SingleSimController;->a:4	API Call: android.telephony.TelephonyManager.getSubscriberId
Source: com.omg.base.phone.factoryimpl.SingleSimController;->b:8	API Call: android.telephony.TelephonyManager.getDeviceId
Source: b.a.at;->B:41	API Call: android.telephony.TelephonyManager.getDeviceId
Source: b.a.at;->f:176	API Call: android.telephony.TelephonyManager.getSubscriberId
Source: b.a.at;->w:316	API Call: android.telephony.TelephonyManager.getDeviceId
Source: b.a.f;->a:9	API Call: android.telephony.TelephonyManager.getDeviceId
Source: sdk.nicro.lu.r;->c:15	API Call: android.telephony.TelephonyManager.getSubscriberId
Source: sdk.nicro.lu.s$a;-><init>:24	API Call: android.telephony.TelephonyManager.getSubscriberId
Source: sdk.nicro.lu.s$a;-><init>:26	API Call: android.telephony.TelephonyManager.getDeviceId
Source: com.omg.tool.net.NetProxyManager;->a:4	API Call: android.telephony.TelephonyManager.getSubscriberId

Stealing of Sensitive Information:

Sets itself as the default SMS application

Show sources

Source: Lcom/lody/virtual/client/env/SpecialComponentList;-><clinit>()V

Method string: "android.provider.Telephony.SMS_DELIVER"

Uses accessibility services (likely to control other applications)

Show sources

Source: com.omgSdk.andoclib.AutoAccessibilityService;->a:84	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.omgSdk.andoclib.AutoAccessibilityService;->a:92	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.omgSdk.andoclib.AutoAccessibilityService;->a:100	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.omgSdk.andoclib.AutoAccessibilityService;->a:245	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.omgSdk.andoclib.AutoAccessibilityService;->c:398	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.omgSdk.andoclib.AutoAccessibilityService;->c:403	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText
Source: com.omgSdk.andoclib.AutoAccessibilityService;->c:408	API Call: android.view.accessibility.AccessibilityNodeInfo.findAccessibilityNodeInfosByText

Checks if a SIM card is installed

Show sources

Source: sdk.nicro.lu.r;->b:10

API Call: android.telephony.TelephonyManager.getSimState

Has permission to read low-level log files (spy personal data)

Show sources

Source: submitted apk

Request permission: android.permission.READ_LOGS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk	Request permission: android.permission.AUTHENTICATE_ACCOUNTS
Source: submitted apk	Request permission: android.permission.GET_ACCOUNTS
Source: submitted apk	Request permission: android.permission.MANAGE_ACCOUNTS

Queries a list of installed applications

Show sources

Source: com.omgSdk.outport.AntiEmulator;->a:29	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: com.omgSdk.outport.GetParamsUtil;->x:22	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: com.omgSdk.outport.GetParamsUtil;->o:248	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: sdk.nicro.lu.ps.b;->d:138	API Call: android.content.pm.PackageManager.getInstalledApplications

Queries camera information

Show sources

Source: com.omgSdk.outport.GetParamsUtil;->k:177

API Call: android.hardware.Camera.getNumberOfCameras

Queries list of installed packages

Show sources

Source: com.omgSdk.andoclib.f;->d:225	API Call: android.content.pm.PackageManager.getInstalledPackages
Source: com.omgSdk.outport.BackgroundService;->b:168	API Call: android.content.pm.PackageManager.getInstalledPackages
Source: com.omgSdk.outport.SdkLauncher;->hasApp:52	API Call: android.content.pm.PackageManager.getInstalledPackages
Source: com.lody.virtual.client.hook.proxies.pm.MethodProxies$GetInstalledPackages;->call:15	API Call: android.content.pm.PackageManager.getInstalledPackages
Source: sdk.nicro.lu.ps.PluginServer;->d:261	API Call: android.content.pm.PackageManager.getInstalledPackages

Queries stored mail and application accounts (e.g. Gmail or Whatsup)

Show sources

Source: com.lody.virtual.server.accounts.VAccount;-><init>:3	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccount;-><init>:4	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAccount:52	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAccount:53	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->removeAccountInternal:187	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->removeAccountInternal:189	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->confirmCredentials:282	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->confirmCredentials:287	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAuthToken:334	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAuthToken:358	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAuthToken:361	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAuthToken:369	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAuthToken:372	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->getAuthToken:375	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->hasFeatures:423	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->hasFeatures:428	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->removeAccount:483	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->removeAccount:488	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->renameAccount:497	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VAccountManagerService;->renameAccount:500	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->updateCredentials:533	API Call: android.accounts.Account.type
Source: com.lody.virtual.server.accounts.VAccountManagerService;->updateCredentials:538	API Call: android.accounts.Account.name
Source: com.lody.virtual.server.accounts.VContentService;->isAccountExist:36	API Call: android.accounts.Account.type
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->getAcceptableAccountChoices:10	API Call: android.accounts.Account.type
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->getItemIndexToSelect:24	API Call: android.accounts.Account.name
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->getListOfDisplayableOptions:29	API Call: android.accounts.Account.name
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->onAccountSelected:49	API Call: android.accounts.Account.name
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->onAccountSelected:50	API Call: android.accounts.Account.type
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->onActivityResult:175	API Call: android.accounts.Account.name
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->onActivityResult:176	API Call: android.accounts.Account.type
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->onCreate:211	API Call: android.accounts.Account.name
Source: com.tmk.ywb.activity.ChooseTypeAndAccountActivity;->onSaveInstanceState:265	API Call: android.accounts.Account.name
Source: com.omgSdk.outport.GetParamsUtil;->l:184	API Call: android.accounts.AccountManager.getAccounts
Source: com.omgSdk.outport.GetParamsUtil;->l:189	API Call: android.accounts.Account.name
Source: com.omgSdk.outport.GetParamsUtil;->l:196	API Call: android.accounts.Account.type
Source: com.omgSdk.outport.GetParamsUtil;->l:200	API Call: android.accounts.Account.type

Remote Access Functionality:

Detected Trojan Nicro

Show sources

Source: Lcom/inasmuch/trample/Fly;->mountainous(Ljava/lang/Class;Ljava/lang/Object;Ljava/lang/String;[Ljava/lang/Class;[Ljava/lang/Object;)Ljava/lang/Object;

Method string: Nicro strings

Found suspicious command strings (may be related to BOT commands)

Show sources

Source: Lcom/lody/virtual/client/hook/proxies/phonesubinfo/PhoneSubInfoStub;->onBindMethods()V	Method string: "getimeiforsubscriber"
Source: Lcom/lody/virtual/client/env/SpecialComponentList;-><clinit>()V	Instruction: "sget-object v1, lcom/lody/virtual/client/env/specialcomponentlist;->spec_system_app_list:ljava/util/hashset;"
Source: Ladj;->prepareForDrop(Landroid/view/View;Landroid/view/View;II)V	Instruction: "iget-boolean v4, p0, ladj;->mshouldreverselayout:z"
Source: Lcom/lody/virtual/client/hook/proxies/phonesubinfo/PhoneSubInfoStub;->onBindMethods()V	Instruction: "const-string v1, "getimeiforsubscriber""

Has permission to mount or unmount file systems (removable storage)

Show sources

Source: submitted apk

Request permission: android.permission.MOUNT_UNMOUNT_FILESYSTEMS

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report wdeQEksXgm

Overview

General Information

Detection

Confidence

Classification

Mitre Att&ck Matrix

Signature Overview

Privilege Escalation:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

Operating System Destruction:

Change of System Appearance:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Screenshots

Thumbnails