Analysis Report nUcFpnJ7qZ

Overview

General Information

Joe Sandbox Version:	26.0.0
Analysis ID:	830721
Start date:	03.04.2019
Start time:	15:43:08
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	nUcFpnJ7qZ
Cookbook file name:	defaultandroidfilecookbook.jbs
Analysis system description:	Android 7.1 Nougat
APK Instrumentation enabled:	true
Detection:	MAL
Classification:	mal92.rans.adwa.spyw.evad.and@0/251@1/0
Warnings:	Show All Not all executed log events are in report (maximum 10 identical API calls) Not all non-executed APIs are in report Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing dynamic data code.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	92	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Mitre Att&ck Matrix

Signature Overview

Click to jump to signature section

Location Tracking:

Queries the phones location (GPS)

Show sources

Source: net.vkurhandler.bf;->a:27	API Call: android.location.Location.getLatitude
Source: net.vkurhandler.bf;->a:30	API Call: android.location.Location.getLongitude
Source: net.vkurhandler.Mobile;->b:129	API Call: android.telephony.TelephonyManager.getCellLocation

Privilege Escalation:

Forces setting a new device unlock password

Show sources

Source: net.vkurhandler.ParentControlActivity;->a:10	API Call: android.app.admin.DevicePolicyManager.resetPassword
Source: net.vkurhandler.SettingsActivity;->a:119	API Call: android.app.admin.DevicePolicyManager.resetPassword
Source: net.vkurhandler.ah;->b:1985	API Call: android.app.admin.DevicePolicyManager.resetPassword

Starts an activity on device admin enabled

Show sources

Source: net.vkurhandler.RDeviceAdminReceiver;->onDisableRequested:17

API Call: android.content.Context.startActivity (not executed)

Starts/registers a service/receiver on device admin enabled

Show sources

Source: net.vkurhandler.RDeviceAdminReceiver;->onDisableRequested:19

API Call: android.content.Context.startService (not executed)

Checks if the device administrator is active

Show sources

Source: net.vkurhandler.ParentControlActivity;->onClickParentControlSetPhoneLockPassword:24	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.SettingsActivity;->a:61	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.SettingsActivity;->onClickDoPhotoOnFailedUnlock:748	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.SettingsActivity;->onClickParentControlSetPhoneLockPassword:780	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.SettingsActivity;->toogleAdmin:937	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.ah;->a:127	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.ah;->a:1770	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.ah;->b:1981	API Call: android.app.admin.DevicePolicyManager.isAdminActive
Source: net.vkurhandler.fd;->onClick:13	API Call: android.app.admin.DevicePolicyManager.isAdminActive

Requests root access

Show sources

Source: net.vkurhandler.ec;->a:39	API Call: java.lang.Runtime.exec ("su")
Source: net.vkurhandler.ec;->a:42	API Call: java.lang.Runtime.exec ("su")
Source: net.vkurhandler.ec;->b:68	API Call: java.lang.Runtime.exec ("su")
Source: net.vkurhandler.ed;->run:4	API Call: java.lang.Runtime.exec ("su")

Tries to add a new device administrator

Show sources

Source: net.vkurhandler.SettingsActivity;->toogleAdmin:945	API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN
Source: net.vkurhandler.cl;->onClick:4	API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN
Source: net.vkurhandler.ff;->onClick:4	API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN
Source: net.vkurhandler.fi;->onClick:4	API Call: android.content.Intent.<init> android.app.action.ADD_DEVICE_ADMIN

Spreading:

Has permission to change the WIFI configuration including connecting and disconnecting

Show sources

Source: submitted apk

Request permission: android.permission.CHANGE_WIFI_STATE

Scans the access points for available WIFI networks

Show sources

Source: net.vkurhandler.ah;->a:1633

API Call: android.net.wifi.WifiManager.startScan

Accesses external storage location

Show sources

Source: net.vkurhandler.DirectoryPicker;->onCreate:40	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.MediaMountReceiver;->onReceive:3	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.bl;->b:9	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.bm;->onEvent:23	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.bu;->a:1	API Call: android.os.Environment.getExternalStorageState
Source: net.vkurhandler.bu;->b:5	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.bu;->c:13	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.cx;->b:8	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.cx;->b:27	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.dw;->run:64	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.dy;->run:46	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->a:256	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->a:312	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->c:457	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->d:472	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->g:603	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->g:624	API Call: android.os.Environment.getExternalStorageState
Source: net.vkurhandler.gn;->g:632	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->g:645	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->g:659	API Call: android.os.Environment.getExternalStorageDirectory
Source: net.vkurhandler.gn;->g:675	API Call: android.os.Environment.getExternalStorageDirectory

Networking:

Checks an internet connection is available

Show sources

Source: net.vkurhandler.gn;->i:777	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: net.vkurhandler.gn;->i:778	API Call: android.net.NetworkInfo.isConnected
Source: net.vkurhandler.gn;->a:326	API Call: android.net.ConnectivityManager.getNetworkInfo
Source: net.vkurhandler.gn;->a:327	API Call: android.net.NetworkInfo.isConnected
Source: net.vkurhandler.ah;->a:1631	API Call: android.net.wifi.WifiManager.isWifiEnabled
Source: net.vkurhandler.ai;->onReceive:12	API Call: android.net.wifi.WifiManager.getConnectionInfo
Source: net.vkurhandler.gn;->j:784	API Call: android.net.ConnectivityManager.getActiveNetworkInfo
Source: net.vkurhandler.gn;->j:785	API Call: android.net.NetworkInfo.isConnected

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188
Source: unknown	TCP traffic detected without corresponding DNS query: 74.125.133.188

Enables or disables WIFI

Show sources

Source: net.vkurhandler.DispatchService;->a:9	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: net.vkurhandler.DispatchService;->b:167	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: net.vkurhandler.ah;->a:401	API Call: android.net.wifi.WifiManager.setWifiEnabled
Source: net.vkurhandler.ah;->a:408	API Call: android.net.wifi.WifiManager.setWifiEnabled

HTTP GET or POST without a user agent

Show sources

Source: global traffic	HTTP traffic detected: GET /backend/new/rp.php HTTP/1.1Host: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 202Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzipData Raw: 70 61 72 61 6d 73 3d 25 37 42 25 32 32 6d 6f 64 75 6c 65 25 32 32 25 33 41 25 32 32 70 72 65 66 65 72 65 6e 63 65 25 32 32 25 32 43 25 32 32 61 63 74 69 6f 6e 25 32 32 25 33 41 25 32 32 6c 6f 61 64 25 32 32 25 32 43 25 32 32 64 65 76 69 63 65 5f 69 64 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 61 70 70 5f 6e 61 6d 65 25 32 32 25 33 41 25 32 32 53 79 73 74 65 6d 2b 55 70 64 61 74 65 72 25 32 32 25 32 43 25 32 32 70 6b 67 5f 6e 61 6d 65 25 32 32 25 33 41 25 32 32 6e 65 74 2e 76 6b 75 72 68 61 6e 64 6c 65 72 25 32 32 25 32 43 25 32 32 64 6f 6d 61 69 6e 5f 69 64 25 32 32 25 33 41 30 25 37 44 Data Ascii: params=%7B%22module%22%3A%22preference%22%2C%22action%22%3A%22load%22%2C%22device_id%22%3A%22%22%2C%22app_name%22%3A%22System+Updater%22%2C%22pkg_name%22%3A%22net.vkurhandler%22%2C%22domain_id%22%3A0%7D
Source: global traffic	HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 71Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzipData Raw: 70 61 72 61 6d 73 3d 25 37 42 25 32 32 6d 6f 64 75 6c 65 25 32 32 25 33 41 25 32 32 63 6c 69 65 6e 74 25 32 32 25 32 43 25 32 32 61 63 74 69 6f 6e 25 32 32 25 33 41 25 32 32 67 65 74 5f 6c 69 63 25 32 32 25 37 44 Data Ascii: params=%7B%22module%22%3A%22client%22%2C%22action%22%3A%22get_lic%22%7D
Source: global traffic	HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 840Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 71Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzipData Raw: 70 61 72 61 6d 73 3d 25 37 42 25 32 32 6d 6f 64 75 6c 65 25 32 32 25 33 41 25 32 32 63 6c 69 65 6e 74 25 32 32 25 32 43 25 32 32 61 63 74 69 6f 6e 25 32 32 25 33 41 25 32 32 67 65 74 5f 6c 69 63 25 32 32 25 37 44 Data Ascii: params=%7B%22module%22%3A%22client%22%2C%22action%22%3A%22get_lic%22%7D
Source: global traffic	HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 840Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 511Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzip

Opens an internet connection

Show sources

Source: net.vkurhandler.gk;->run:32	API Call: java.net.Socket.connect (not executed)
Source: net.vkurhandler.gn;->a:21	API Call: java.net.URL.openConnection (not executed)

Scans for WIFI networks

Show sources

Source: net.vkurhandler.ah;->a:1633	API Call: android.net.wifi.WifiManager.startScan
Source: net.vkurhandler.ai;->onReceive:11	API Call: android.net.wifi.WifiManager.getScanResults

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET /backend/new/rp.php HTTP/1.1Host: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzip

Found strings which match to known social media urls

Show sources

Source: resources.arsc	String found in binary or memory: Facebook equals www.facebook.com (Facebook)
Source: resources.arsc	String found in binary or memory: Facebook,L equals www.facebook.com (Facebook)
Source: classes.dex	String found in binary or memory: +/data/data/com.vkontakte.android/databases/ equals www.vkontakte.ru (VKontakte)
Source: classes.dex	String found in binary or memory: /data/data/3/data/data/com.facebook.orca/databases/contacts_db26/data/data/com.facebook.orca/databases/contacts_db2.cp2/data/data/com.facebook.orca/databases/threads_db25/data/data/com.facebook.orca/databases/threads_db2.cp0/data/data/com.gemtechnologies.gem4me/databases/1/data/data/com.gemtechnologies.gem4me/databases/6/data/data/com.gemtechnologies.gem4me/databases/gem_db+/data/data/com.imo.android.imoim/databases/,/data/data/com.imo.android.imoim/databases/7/data/data/com.imo.android.imoim/databases/accountdb.db8/data/data/com.imo.android.imoim/databases/imofriends.db+/data/data/com.instagram.android/databases/,/data/data/com.instagram.android/databases/*4/data/data/com.instagram.android/databases/direct.db,/data/data/com.skype.raider/files/%s/main.db,/data/data/com.skype.raider/files/shared.xml'/data/data/com.skype.raider/files/sk.cp2/data/data/com.viber.voip/databases/viber_messagesB/data/data/com.viber.voip/files/preferences/reg_viber_country_code?/data/data/com.viber.voip/files/preferences/reg_viber_p
Source: classes.dex	String found in binary or memory: /data/data/3/data/data/com.facebook.orca/databases/contacts_db26/data/data/com.facebook.orca/databases/contacts_db2.cp2/data/data/com.facebook.orca/databases/threads_db25/data/data/com.facebook.orca/databases/threads_db2.cp0/data/data/com.gemtechnologies.gem4me/databases/1/data/data/com.gemtechnologies.gem4me/databases/6/data/data/com.gemtechnologies.gem4me/databases/gem_db+/data/data/com.imo.android.imoim/databases/,/data/data/com.imo.android.imoim/databases/7/data/data/com.imo.android.imoim/databases/accountdb.db8/data/data/com.imo.android.imoim/databases/imofriends.db+/data/data/com.instagram.android/databases/,/data/data/com.instagram.android/databases/*4/data/data/com.instagram.android/databases/direct.db,/data/data/com.skype.raider/files/%s/main.db,/data/data/com.skype.raider/files/shared.xml'/data/data/com.skype.raider/files/sk.cp2/data/data/com.viber.voip/databases/viber_messagesB/data/data/com.viber.voip/files/preferences/reg_viber_country_code?/data/data/com.viber.voip/files/preferences/reg_viber_p
Source: android	String found in binary or memory: /data/data/com.facebook.orca/databases/contacts_db2 equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: /data/data/com.facebook.orca/databases/contacts_db2.cp equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: /data/data/com.facebook.orca/databases/threads_db2 equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: /data/data/com.facebook.orca/databases/threads_db2.cp equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: /data/data/com.vkontakte.android/databases/ equals www.vkontakte.ru (VKontakte)
Source: android	String found in binary or memory: /data/data/com.vkontakte.android/databases/vk.db equals www.vkontakte.ru (VKontakte)
Source: android	String found in binary or memory: /data/data/com.vkontakte.android/databases/vkim.sqlite equals www.vkontakte.ru (VKontakte)
Source: android	String found in binary or memory: /data/data/com.vkontakte.android/shared_prefs/null.xml equals www.vkontakte.ru (VKontakte)
Source: classes.dex	String found in binary or memory: 0/data/data/com.vkontakte.android/databases/vk.db equals www.vkontakte.ru (VKontakte)
Source: classes.dex	String found in binary or memory: 2/data/data/com.facebook.orca/databases/threads_db2 equals www.facebook.com (Facebook)
Source: classes.dex	String found in binary or memory: 3/data/data/com.facebook.orca/databases/contacts_db2 equals www.facebook.com (Facebook)
Source: classes.dex	String found in binary or memory: 5/data/data/com.facebook.orca/databases/threads_db2.cp equals www.facebook.com (Facebook)
Source: classes.dex	String found in binary or memory: 6/data/data/com.facebook.orca/databases/contacts_db2.cp equals www.facebook.com (Facebook)
Source: classes.dex	String found in binary or memory: 6/data/data/com.vkontakte.android/databases/vkim.sqlite equals www.vkontakte.ru (VKontakte)
Source: classes.dex	String found in binary or memory: 6/data/data/com.vkontakte.android/shared_prefs/null.xml equals www.vkontakte.ru (VKontakte)
Source: resources.arsc	String found in binary or memory: ;;Messenger archivation filter (Viber/WhatsApp/Facebook/Kate) equals www.facebook.com (Facebook)
Source: resources.arsc	String found in binary or memory: Facebook equals www.facebook.com (Facebook)
Source: resources.arsc	String found in binary or memory: Facebook messages equals www.facebook.com (Facebook)
Source: resources.arsc	String found in binary or memory: Facebook messages##The numbers added to the phone book equals www.facebook.com (Facebook)
Source: android	String found in binary or memory: Messenger archivation filter (Viber/WhatsApp/Facebook/Kate) equals www.facebook.com (Facebook)
Source: resources.arsc	String found in binary or memory: To prohibit the installation of malware detectors, optimizers, cleaners and other applications that affect on the stable work of the app;;Messenger archivation filter (Viber/WhatsApp/Facebook/Kate) equals www.facebook.com (Facebook)
Source: classes.dex	String found in binary or memory: VKontakte messages (Root) equals www.vkontakte.ru (VKontakte)
Source: resources.arsc	String found in binary or memory: VKontakte messages equals www.vkontakte.ru (VKontakte)
Source: resources.arsc	String found in binary or memory: com.facebook.orca equals www.facebook.com (Facebook)
Source: resources.arsc	String found in binary or memory: com.vkontakte.android equals www.vkontakte.ru (VKontakte)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: reptilicus.net

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: POST /backend/new/handler.php HTTP/1.1Content-Length: 202Content-Type: application/x-www-form-urlencodedHost: reptilicus.netConnection: Keep-AliveAccept-Encoding: gzipData Raw: 70 61 72 61 6d 73 3d 25 37 42 25 32 32 6d 6f 64 75 6c 65 25 32 32 25 33 41 25 32 32 70 72 65 66 65 72 65 6e 63 65 25 32 32 25 32 43 25 32 32 61 63 74 69 6f 6e 25 32 32 25 33 41 25 32 32 6c 6f 61 64 25 32 32 25 32 43 25 32 32 64 65 76 69 63 65 5f 69 64 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 61 70 70 5f 6e 61 6d 65 25 32 32 25 33 41 25 32 32 53 79 73 74 65 6d 2b 55 70 64 61 74 65 72 25 32 32 25 32 43 25 32 32 70 6b 67 5f 6e 61 6d 65 25 32 32 25 33 41 25 32 32 6e 65 74 2e 76 6b 75 72 68 61 6e 64 6c 65 72 25 32 32 25 32 43 25 32 32 64 6f 6d 61 69 6e 5f 69 64 25 32 32 25 33 41 30 25 37 44 Data Ascii: params=%7B%22module%22%3A%22preference%22%2C%22action%22%3A%22load%22%2C%22device_id%22%3A%22%22%2C%22app_name%22%3A%22System+Updater%22%2C%22pkg_name%22%3A%22net.vkurhandler%22%2C%22domain_id%22%3A0%7D

Urls found in memory or binary data

Show sources

Source: libacr.so	String found in binary or memory: http://gcc.gnu.org/bugs.html):
Source: android	String found in binary or memory: http://reptilicus.net/backend/new/rp.php
Source: android	String found in binary or memory: http://reptilicus.net/bn/g.php?
Source: activity_main.xml, AndroidManifest.xml	String found in binary or memory: http://schemas.android.com/apk/res/android
Source: libmp3lame.so	String found in binary or memory: http://www.mp3dev.org/
Source: libmp3lame.so	String found in binary or memory: http://www.mp3dev.org/32bits64bits
Source: classes.dex, android	String found in binary or memory: https://maps.google.com/maps?q=%s
Source: android	String found in binary or memory: https://phonecontrolapp.com/sonfidentiality/
Source: android	String found in binary or memory: https://reptilicus.net/konfidencialnost

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Has permission to record audio in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECORD_AUDIO

Has permission to take photos

Show sources

Source: submitted apk

Request permission: android.permission.CAMERA

Records audio/media

Show sources

Source: net.vkurhandler.bo;->d:195	API Call: com.nll.nativelibs.callrecording.a.startRecording
Source: com.nll.nativelibs.callrecording.a;->startRecording:50	API Call: android.media.AudioRecord.startRecording

Accesses the audio/media managers

Show sources

Source: net.vkurhandler.bo;-><init>:23	API Call: android.media.AudioRecord.<init>
Source: net.vkurhandler.bo;-><init>:53	API Call: com.nll.nativelibs.callrecording.a.<init>
Source: net.vkurhandler.bo;->f:244	API Call: com.nll.nativelibs.callrecording.a.<init>
Source: com.nll.nativelibs.callrecording.a;-><init>:3	API Call: android.media.AudioRecord.<init>

E-Banking Fraud:

Has functionalty to add an overlay to other apps

Show sources

Source: net.vkurhandler.AdminUnlockViewService;->c:20

API Call: WindowManager.addView

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

May check for popular installed apps

Show sources

Source: Lnet/vkurhandler/ah;->b(Landroid/content/Context;Ljava/util/List;)Ljava/lang/String;	Method string: "[{"app_name":"YouTube","pkg_name":"com.google.android.youtube"},{"app_name":"RSS Reader","pkg_name":"com.example.android.rssreader"},{"app_name":"Google App","pkg_name":"com.google.android.googlequicksearchbox"},{"app_name":"Calibration","pkg_name":"org.zeroxlab.util.tscal"},{"app_name":"Files","pkg_name":"com.android.documentsui"},{"app_name":"Contacts","pkg_name":"com.android.contacts"},{"app_name":"Gmail","pkg_name":"com.google.android.gm"},{"app_name":"Calendar","pkg_name":"com.android.calendar"},{"app_name":"NotePad","pkg_name":"com.example.android.notepad"},{"app_name":"Chrome","pkg_name":"com.android.chrome"},{"app_name":"Phone","pkg_name":"com.android.dialer"},{"app_name":"Gallery","pkg_name":"com.android.gallery3d"},{"app_name":"System Updater","pkg_name":"net.vkurhandler"},{"app_name":"Terminal Emulator","pkg_name":"jackpal.androidterm"},{"app_name":"Settings","pkg_name":"com.android.settings"},{"app_name":"Taskbar","pkg_name":"com.farmerbb.taskbar.androidx86"},{"app_name":"Music","pkg_name":"com.cy
Source: Lnet/vkurhandler/ds;->run()V	Method string: "/data/data/com.whatsapp/databases/*"
Source: Lnet/vkurhandler/dh;->run()V	Method string: "/data/data/com.imo.android.imoim/databases/*"
Source: Lnet/vkurhandler/dq;->run()V	Method string: "/data/data/com.viber.voip/databases/viber_messages"
Source: Lnet/vkurhandler/df;->run()V	Method string: "/data/data/com.facebook.orca/databases/threads_db2"
Source: Lnet/vkurhandler/di;->run()V	Method string: "/data/data/com.instagram.android/databases/*"

May query for the most recent running application (usually for UI overlaying)

Show sources

Source: net.vkurhandler.gn;->a	getRunningTasks and getPackageName invocations in same method: net.vkurhandler.gn;->a:78, net.vkurhandler.gn;->a:81
Source: net.vkurhandler.gn;->a	getRunningTasks and getPackageName invocations in same method: net.vkurhandler.gn;->a:78, net.vkurhandler.gn;->a:81

Spam, unwanted Advertisements and Ransom Demands:

Detected Adware Reptilicus

Show sources

Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "reptilicus"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "reptilicus/data/"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "http://reptilicus.net/bn/g.php?"

Tries to disable the administrator user

Show sources

Source: net.vkurhandler.SettingsActivity;->toogleAdmin:940	API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin
Source: net.vkurhandler.ah;->a:1771	API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin
Source: net.vkurhandler.fd;->onClick:18	API Call: android.app.admin.DevicePolicyManager.removeActiveAdmin

Has permission to perform phone calls in the background

Show sources

Source: submitted apk

Request permission: android.permission.CALL_PHONE

Has permission to send SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.SEND_SMS

Has permission to write to the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.WRITE_SMS

Has permission to write to the default browser history

Show sources

Source: submitted apk

Request permission: com.android.browser.permission.WRITE_HISTORY_BOOKMARKS

Has permissions to monitor, redirect and/or block calls

Show sources

Source: submitted apk

Request permission: android.permission.PROCESS_OUTGOING_CALLS

May block phone calls / Accesses private ITelephony interface

Show sources

Source: net.vkurhandler.Mobile;->a:19	API Call: java.lang.Class.getDeclaredMethod("getITelephony")
Source: net.vkurhandler.Mobile;->a:43	API Call: java.lang.Class.getDeclaredMethod("getITelephony")

May check for popular installed apps

Show sources

Source: Lnet/vkurhandler/ah;->b(Landroid/content/Context;Ljava/util/List;)Ljava/lang/String;	Method string: "[{"app_name":"YouTube","pkg_name":"com.google.android.youtube"},{"app_name":"RSS Reader","pkg_name":"com.example.android.rssreader"},{"app_name":"Google App","pkg_name":"com.google.android.googlequicksearchbox"},{"app_name":"Calibration","pkg_name":"org.zeroxlab.util.tscal"},{"app_name":"Files","pkg_name":"com.android.documentsui"},{"app_name":"Contacts","pkg_name":"com.android.contacts"},{"app_name":"Gmail","pkg_name":"com.google.android.gm"},{"app_name":"Calendar","pkg_name":"com.android.calendar"},{"app_name":"NotePad","pkg_name":"com.example.android.notepad"},{"app_name":"Chrome","pkg_name":"com.android.chrome"},{"app_name":"Phone","pkg_name":"com.android.dialer"},{"app_name":"Gallery","pkg_name":"com.android.gallery3d"},{"app_name":"System Updater","pkg_name":"net.vkurhandler"},{"app_name":"Terminal Emulator","pkg_name":"jackpal.androidterm"},{"app_name":"Settings","pkg_name":"com.android.settings"},{"app_name":"Taskbar","pkg_name":"com.farmerbb.taskbar.androidx86"},{"app_name":"Music","pkg_name":"com.cy
Source: Lnet/vkurhandler/ds;->run()V	Method string: "/data/data/com.whatsapp/databases/*"
Source: Lnet/vkurhandler/dh;->run()V	Method string: "/data/data/com.imo.android.imoim/databases/*"
Source: Lnet/vkurhandler/dq;->run()V	Method string: "/data/data/com.viber.voip/databases/viber_messages"
Source: Lnet/vkurhandler/df;->run()V	Method string: "/data/data/com.facebook.orca/databases/threads_db2"
Source: Lnet/vkurhandler/di;->run()V	Method string: "/data/data/com.instagram.android/databases/*"

May use Google Cloud Messaging (GCM) or Google's Cloud to Device Messaging (C2DM) services

Show sources

Source: submitted apk

Request permission: net.vkurhandler.permission.C2D_MESSAGE

Sends SMS using SmsManager

Show sources

Source: net.vkurhandler.gn;->b:376

API Call: android.telephony.SmsManager.sendTextMessage

Operating System Destruction:

Deletes other packages

Show sources

Source: net.vkurhandler.fd;->onClick:30

API Call: net.vkurhandler.SettingsActivity.startActivity

May wipe phone data

Show sources

Source: net.vkurhandler.ak;->run:5

API Call: android.app.admin.DevicePolicyManager.wipeData

Has permission to delete other packages

Show sources

Source: submitted apk

Request permission: android.permission.DELETE_PACKAGES

Lists and deletes files in the same context

Show sources

Source: net.vkurhandler.gn;->a:323	API Calls in same method context: File.listFiles,File.delete
Source: net.vkurhandler.bm;->onEvent:44	API Calls in same method context: File.listFiles,File.delete
Source: org.sqlite.database.sqlite.SQLiteDatabase;->deleteDatabase:63	API Calls in same method context: File.listFiles,File.delete
Source: net.vkurhandler.gn;->d:484	API Calls in same method context: File.listFiles,File.delete
Source: net.vkurhandler.gn;->b:374	API Calls in same method context: File.listFiles,File.delete

Change of System Appearance:

May access the Android keyguard (lock screen)

Show sources

Source: AndroidManifest.xml

String found in binary or memory: android.hardware.camera.front#android.permission.ACCESS_SUPERUSER,android.permission.MOUNT_UNMOUNT_FILESYSTEMS)android.permission.WRITE_INTERNAL_STORAGE#android.permission.DISABLE_KEYGUARD#android.permission.INSTALL_PACKAGES"android.permission.DELETE_PACKAGES&android.permission.SYSTEM_ALERT_WINDOW-android.permission.BIND_ACCESSIBILITY_SERVICE&android.permission.PACKAGE_USAGE_STATS

System Summary:

Executes native commands

Show sources

Source: net.vkurhandler.ec;->a:39	API Call: java.lang.Runtime.exec ("su")
Source: net.vkurhandler.ec;->a:42	API Call: java.lang.Runtime.exec ("su")
Source: net.vkurhandler.ec;->b:68	API Call: java.lang.Runtime.exec ("su")
Source: net.vkurhandler.ed;->run:4	API Call: java.lang.Runtime.exec ("su")
Source: com.nll.nativelibs.callrecording.d;->d:12	API Call: java.lang.Runtime.exec

Requests permissions only permitted to signed APKs

Show sources

Source: submitted apk	Request permission: android.permission.CHANGE_COMPONENT_ENABLED_STATE
Source: submitted apk	Request permission: android.permission.DEVICE_POWER
Source: submitted apk	Request permission: android.permission.PACKAGE_USAGE_STATS

Requests permissions only permitted to signed APKs or APKs which are within the system image

Show sources

Source: submitted apk	Request permission: android.permission.DELETE_PACKAGES
Source: submitted apk	Request permission: android.permission.INSTALL_PACKAGES
Source: submitted apk	Request permission: android.permission.WRITE_SECURE_SETTINGS

Requests potentially dangerous permissions

Show sources

Source: submitted apk	Request permission: android.permission.ACCESS_FINE_LOCATION
Source: submitted apk	Request permission: android.permission.CALL_PHONE
Source: submitted apk	Request permission: android.permission.CAMERA
Source: submitted apk	Request permission: android.permission.CHANGE_NETWORK_STATE
Source: submitted apk	Request permission: android.permission.CHANGE_WIFI_STATE
Source: submitted apk	Request permission: android.permission.GET_TASKS
Source: submitted apk	Request permission: android.permission.INTERNET
Source: submitted apk	Request permission: android.permission.MODIFY_AUDIO_SETTINGS
Source: submitted apk	Request permission: android.permission.MODIFY_PHONE_STATE
Source: submitted apk	Request permission: android.permission.MOUNT_FORMAT_FILESYSTEMS
Source: submitted apk	Request permission: android.permission.MOUNT_UNMOUNT_FILESYSTEMS
Source: submitted apk	Request permission: android.permission.PROCESS_OUTGOING_CALLS
Source: submitted apk	Request permission: android.permission.READ_CONTACTS
Source: submitted apk	Request permission: android.permission.READ_PHONE_STATE
Source: submitted apk	Request permission: android.permission.READ_SMS
Source: submitted apk	Request permission: android.permission.RECEIVE_SMS
Source: submitted apk	Request permission: android.permission.RECORD_AUDIO
Source: submitted apk	Request permission: android.permission.SEND_SMS
Source: submitted apk	Request permission: android.permission.SYSTEM_ALERT_WINDOW
Source: submitted apk	Request permission: android.permission.WAKE_LOCK
Source: submitted apk	Request permission: android.permission.WRITE_EXTERNAL_STORAGE
Source: submitted apk	Request permission: android.permission.WRITE_SETTINGS
Source: submitted apk	Request permission: android.permission.WRITE_SMS
Source: submitted apk	Request permission: com.android.browser.permission.READ_HISTORY_BOOKMARKS
Source: submitted apk	Request permission: com.android.browser.permission.WRITE_HISTORY_BOOKMARKS

Classification label

Show sources

Source: classification engine

Classification label: mal92.rans.adwa.spyw.evad.and@0/251@1/0

Loads native libraries

Show sources

Source: net.vkurhandler.bo;-><clinit>:3	API Call: java.lang.System.loadLibrary ("mp3lame")
Source: com.nll.nativelibs.callrecording.Native;-><clinit>:2	API Call: java.lang.System.loadLibrary ("acr")

Reads shares settings

Show sources

Source: net.vkurhandler.Mobile;->h:144	API Call: "device_id":
Source: net.vkurhandler.dc;->b:59	API Call: "last_work_host": reptilicus.net
Source: net.vkurhandler.Sms2Receiver;->onReceive:17	API Call: "sms_code_word": netstat
Source: net.vkurhandler.Sms2Receiver;->onReceive:39	API Call: "call_password": 3454
Source: net.vkurhandler.CallReceiver;->b:217	API Call: "call_password": 3454
Source: net.vkurhandler.AddInterceptionAudioPathActivity;->b:23	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.AddInterceptionPhotoPathActivity;->b:23	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.AddRemovePackageReceiver;->onReceive:45	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.AudiorecordEnvironmentSchedule;->a:16	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.AudiorecordEnvironmentSchedule;->onReceive:226	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.AudiorecordEnvironmentScheduleActivity;->onCreate:310	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.CallReceiver;->a:88	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.CallReceiver;->a:172	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.CallRecordActivity;->a:22	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.CallRecordActivity;->a:28	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.CallRecordActivity;->a:34	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.CallRecordActivity;->a:40	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.CallRecordActivity;->a:46	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.DispatchSchedule;->a:5	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchSchedule;->a:7	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchSchedule;->a:9	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchSchedule;->a:16	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.DispatchService;->a:39	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->a:42	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->a:45	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->a:78	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->d:223	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->onHandleIntent:418	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->onHandleIntent:420	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.DispatchService;->onHandleIntent:422	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.DispatchService;->onHandleIntent:424	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.EnterActivity;->a:30	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.KeysInterceptor;->a:9	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.KeysInterceptor;->a:12	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MainActivity;->a:5	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MediaMountReceiver;->onReceive:25	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MediaMountReceiver;->onReceive:32	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MessengerFilterActivity;->a:9	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.MessengerFilterActivity;->a:46	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.MyApp;->y:140	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MyApp;->c:187	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.MyApp;->c:194	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.MyApp;->c:201	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.MyApp;->c:205	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MyApp;->c:210	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MyApp;->c:221	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MyApp;->c:231	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MyApp;->c:236	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.MyApp;->c:258	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ParentControlBlockAppActivity;->a:100	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.RDeviceAdminReceiver;->onPasswordFailed:34	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.RDeviceAdminReceiver;->onPasswordFailed:39	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ScreenMakerAppFilter;->a:5	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ScreenMakerAppFilter;->onCreate:140	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->a:24	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.SettingsActivity;->i:266	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:294	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:299	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:310	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:344	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.SettingsActivity;->i:398	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.SettingsActivity;->i:404	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.SettingsActivity;->i:410	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.SettingsActivity;->i:429	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:438	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:447	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:456	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:465	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:474	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:483	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:491	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:503	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:512	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->i:521	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->onCreate:874	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->onCreate:878	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->onCreate:883	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsActivity;->onCreate:891	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:32	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:55	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:64	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:73	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:82	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:91	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:100	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.SettingsExpertActivity;->a:118	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:127	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsExpertActivity;->a:136	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:54	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:63	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:72	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:81	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:90	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:99	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:108	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:117	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:126	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:135	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:144	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:153	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:162	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:171	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:180	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:189	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:198	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:207	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:216	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:225	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:234	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:241	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:250	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:259	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SettingsRootActivity;->a:264	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SimChangeNotifier;->onReceive:11	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SimChangeNotifier;->onReceive:25	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.SimChangeNotifier;->onReceive:27	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.Sms2Receiver;->onReceive:65	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.UserPresent;->onReceive:9	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.UserPresent;->onReceive:13	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.WatchDogReceiver;->onReceive:11	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.WatchDogReceiver;->onReceive:17	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.a;->a:23	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ad;->b:18	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:897	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:930	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:965	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:998	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:1150	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1198	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1496	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1511	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1526	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1536	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:1563	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1574	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.ah;->a:1587	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ah;->a:1621	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.al;->onChange:134	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.aw;->a:22	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.bf;->b:98	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.bf;->b:115	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.bh;->a:32	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.bt;->a:38	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ci;->run:76	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.cx;->b:20	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.dd;->run:18	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.df;->f:54	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.df;->g:57	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dg;->f:47	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dg;->g:50	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dg;->run:117	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dg;->run:153	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dg;->run:188	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->f:136	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->f:139	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->f:142	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->g:145	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->run:216	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->run:258	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dh;->run:293	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.di;->f:93	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.di;->g:96	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dj;->b:9	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.dl;->f:111	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dl;->g:114	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dm;->f:113	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dm;->g:116	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.do;->f:188	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.do;->f:191	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.do;->f:194	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.do;->g:197	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.do;->run:278	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dp;->f:77	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dp;->g:80	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dq;->f:129	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dq;->f:132	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dq;->g:135	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dq;->run:235	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dr;->f:149	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.dr;->g:152	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ds;->f:213	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ds;->f:216	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ds;->f:219	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ds;->g:222	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ds;->run:319	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.ds;->run:357	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.du;->onClick:7	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.eg;->b:20	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.eg;->b:29	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.eg;->b:34	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.en;->onReceive:19	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.en;->onReceive:23	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.fy;->run:20	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.fy;->run:35	API Call: android.content.SharedPreferences.getString
Source: net.vkurhandler.fz;->onChange:47	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.h;->run:6	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.h;->run:18	API Call: android.content.SharedPreferences.getBoolean
Source: net.vkurhandler.n;->b:12	API Call: android.content.SharedPreferences.getString
Source: com.nll.nativelibs.callrecording.a;-><init>:15	API Call: android.content.SharedPreferences.getString

Data Obfuscation:

Obfuscates method names

Show sources

Source: nUcFpnJ7qZ

Total valid method names: 25%

Uses reflection

Show sources

Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: com.a.a.a.a;->a:94	API Call: Real call: protected org.apache.http.HttpEntity org.apache.http.entity.HttpEntityWrapper.wrappedEntity
Source: net.vkurhandler.gn;->b:380	API Call: Real call: public static java.lang.String android.os.SystemProperties.get(java.lang.String)
Source: net.vkurhandler.Mobile;->a:21	API Call: java.lang.reflect.Method.invoke
Source: net.vkurhandler.Mobile;->a:46	API Call: java.lang.reflect.Method.invoke
Source: net.vkurhandler.Mobile;->a:53	API Call: java.lang.reflect.Method.invoke
Source: net.vkurhandler.Mobile;->a:63	API Call: java.lang.reflect.Field.get
Source: net.vkurhandler.Mobile;->a:72	API Call: java.lang.reflect.Method.invoke
Source: net.vkurhandler.Mobile;->h:156	API Call: java.lang.reflect.Method.invoke
Source: net.vkurhandler.gn;->c:426	API Call: java.lang.reflect.Method.invoke

Persistence and Installation Behavior:

Has permission to install other packages

Show sources

Source: submitted apk

Request permission: android.permission.INSTALL_PACKAGES

Boot Survival:

Has permission to execute code after phone reboot

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_BOOT_COMPLETED

Hooking and other Techniques for Hiding and Protection:

Removes its application launcher (likely to stay hidden)

Show sources

Source: net.vkurhandler.SettingsActivity;->hideUnhideApp:700	API Call: android.content.pm.PackageManager.setComponentEnabledSetting
Source: net.vkurhandler.ah;->a:462	API Call: android.content.pm.PackageManager.setComponentEnabledSetting
Source: net.vkurhandler.gn;->g:718	API Call: android.content.pm.PackageManager.setComponentEnabledSetting

Aborts a broadcast event (this is often done to hide phone events such as incoming SMS)

Show sources

Source: net.vkurhandler.CallReceiver;->b:192	API Call: net.vkurhandler.CallReceiver.abortBroadcast
Source: net.vkurhandler.Sms2Receiver;->onReceive:34	API Call: net.vkurhandler.Sms2Receiver.abortBroadcast
Source: net.vkurhandler.Sms2Receiver;->onReceive:45	API Call: net.vkurhandler.Sms2Receiver.abortBroadcast

Has permission to draw over other applications or user interfaces

Show sources

Source: submitted apk

Request permission: android.permission.SYSTEM_ALERT_WINDOW

Has permission to query the list of currently running applications

Show sources

Source: submitted apk

Request permission: android.permission.GET_TASKS

Has permissions to monitor, redirect and/or block calls

Show sources

Source: submitted apk

Request permission: android.permission.PROCESS_OUTGOING_CALLS

Queries list of running processes/tasks

Show sources

Source: net.vkurhandler.gn;->a:78

API Call: android.app.ActivityManager.getRunningTasks

Uses Crypto APIs

Show sources

Source: net.vkurhandler.gn;->a:101	API Call: java.security.MessageDigest.getInstance
Source: net.vkurhandler.gn;->a:103	API Call: java.security.MessageDigest.update
Source: net.vkurhandler.gn;->a:104	API Call: java.security.MessageDigest.digest

Malware Analysis System Evasion:

Accesses android OS build fields

Show sources

Source: net.vkurhandler.AddDeviceActivity;->addDevice:39	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.AddDeviceActivity;->addDevice:42	Field Access: android.os.Build.FINGERPRINT
Source: net.vkurhandler.ParentControlActivity;->a:11	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.RegistrationActivity;->onClickCreateAccount:71	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.RegistrationActivity;->onClickCreateAccount:74	Field Access: android.os.Build.FINGERPRINT
Source: net.vkurhandler.SettingsActivity;->a:120	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.ah;->b:1986	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.bd;->run:23	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.bd;->run:26	Field Access: android.os.Build.FINGERPRINT
Source: net.vkurhandler.bg;->c:72	Field Access: android.os.Build.MODEL
Source: net.vkurhandler.bg;->d:690	Field Access: android.os.Build.MODEL
Source: com.nll.nativelibs.callrecording.c;->a:2	Field Access: android.os.Build$VERSION.RELEASE
Source: com.nll.nativelibs.callrecording.c;->a:5	Field Access: android.os.Build$VERSION.RELEASE
Source: com.nll.nativelibs.callrecording.c;->g:32	Field Access: android.os.Build.MODEL
Source: com.nll.nativelibs.callrecording.c;->h:36	Field Access: android.os.Build.MANUFACTURER

Queries several sensitive phone informations

Show sources

Source: Lnet/vkurhandler/AddRemovePackageReceiver;->b(Landroid/content/Context;Ljava/lang/String;Ljava/lang/String;I)V	Method string: "type"
Source: Lnet/vkurhandler/ah;->a()V	Method string: "version"
Source: Lnet/vkurhandler/dh;-><clinit>()V	Method string: "phone"
Source: Lnet/vkurhandler/as;-><clinit>()V	Method string: "time"

Queries the unique operating system id (ANDROID_ID)

Show sources

Source: net.vkurhandler.Mobile;->h:161

API Call: android.provider.Settings$Secure.getString

Language, Device and Operating System Detection:

Queries the device phone number (MSISDN)

Show sources

Source: net.vkurhandler.CallReceiver;->b:187

API Call: android.content.Intent.getStringExtra

Queries the network operator name

Show sources

Source: net.vkurhandler.Mobile;->g:137

API Call: android.telephony.TelephonyManager.getNetworkOperatorName

Queries the network operator numeric MCC+MNC (mobile country code + mobile network code)

Show sources

Source: net.vkurhandler.Mobile;->b:122

API Call: android.telephony.TelephonyManager.getNetworkOperator

Queries the unqiue device ID (IMEI, MEID or ESN)

Show sources

Source: net.vkurhandler.Mobile;->a:117	API Call: android.telephony.TelephonyManager.getSubscriberId
Source: net.vkurhandler.Mobile;->h:148	API Call: android.telephony.TelephonyManager.getDeviceId

Lowering of HIPS / PFW / Operating System Security Settings:

May check for install Android security applications (AV and firewalls)

Show sources

Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.drweb"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.cleanmaster.mguard"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.eset.ems2.gp"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.avast.android.mobilesecurity"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.cleanmaster.security"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.qihoo.security"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.antivirus"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.avira.android"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.qihoo.security.lite"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.antivirus.security.forandroid.scanner"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.antivirus.tablet"
Source: Lnet/vkurhandler/de;-><clinit>()V	Method string: "com.wsandroid.suite"

Stealing of Sensitive Information:

Monitors outgoing Phone calls

Show sources

Source: net.vkurhandler.CallReceiver

Registered receiver: android.intent.action.NEW_OUTGOING_CALL

Reads the serial number of the device

Show sources

Source: Lnet/vkurhandler/Mobile;->h()Ljava/lang/String;

Method string: "ro.serialno"

Creates SMS data (e.g. PDU)

Show sources

Source: net.vkurhandler.Sms2Receiver;->onReceive:50

API Call: android.telephony.SmsManager.createFromPdu

Has an unnatural receiver priority (often indicator for malware)

Show sources

Source: android.intent.action.NEW_OUTGOING_CALL

Unnatural priority: 2147483647

Has permission to read contacts

Show sources

Source: submitted apk

Request permission: android.permission.READ_CONTACTS

Has permission to read the SMS storage

Show sources

Source: submitted apk

Request permission: android.permission.READ_SMS

Has permission to read the call log

Show sources

Source: submitted apk

Request permission: android.permission.READ_CALL_LOG

Has permission to read the default browser history

Show sources

Source: submitted apk

Request permission: com.android.browser.permission.READ_HISTORY_BOOKMARKS

Has permission to read the phones state (phone number, device IDs, active call ect.)

Show sources

Source: submitted apk

Request permission: android.permission.READ_PHONE_STATE

Has permission to receive SMS in the background

Show sources

Source: submitted apk

Request permission: android.permission.RECEIVE_SMS

Has permissions to create, read or change account settings (inlcuding account password settings)

Show sources

Source: submitted apk

Request permission: android.permission.GET_ACCOUNTS

May spy on facebook database

Show sources

Source: Lnet/vkurhandler/df;->run()V	Method string: "/data/data/com.facebook.orca/databases/threads_db2" (chat messages)
Source: Lnet/vkurhandler/df;-><init>(Landroid/content/Context;)V	Method string: "/data/data/com.facebook.orca/databases/threads_db2" (chat messages)
Source: Lnet/vkurhandler/df;-><clinit>()V	Method string: "/data/data/com.facebook.orca/databases/threads_db2.cp" (chat messages)

May spy on skype database

Show sources

Source: Lnet/vkurhandler/dm;-><clinit>()V

Method string: "/data/data/com.skype.raider/files/%s/main.db"

May spy on viber chat VOIP data

Show sources

Source: Lnet/vkurhandler/dq;->run()V	Method string: "/data/data/com.viber.voip/databases/viber_messages"
Source: Lnet/vkurhandler/dq;-><init>(Landroid/content/Context;)V	Method string: "/data/data/com.viber.voip/databases/viber_messages"

May spy on whatsapp messages

Show sources

Source: Lnet/vkurhandler/ds;->run()V	Method string: "/data/data/com.whatsapp/databases/msgstore.db"
Source: Lnet/vkurhandler/ds;->d(Ljava/lang/String;)Ljava/lang/String;	Method string: "/data/data/com.whatsapp/databases/msgstore.db"

Monitors incoming Phone calls

Show sources

Source: net.vkurhandler.CallReceiver

Registered receiver: android.intent.action.PHONE_STATE

Monitors incoming SMS

Show sources

Source: net.vkurhandler.Sms2Receiver

Registered receiver: android.provider.Telephony.SMS_RECEIVED

Parses SMS data (e.g. originating address)

Show sources

Source: net.vkurhandler.Sms2Receiver;->onReceive:56

API Call: android.telephony.SmsMessage.getOriginatingAddress

Queries SMS data

Show sources

Source: net.vkurhandler.fz;-><clinit>:2

API Call: android.net.Uri.parse("content://sms")

Queries a list of installed applications

Show sources

Source: net.vkurhandler.ScreenMakerAppFilter;->c:84	API Call: android.content.pm.PackageManager.getInstalledApplications
Source: net.vkurhandler.gn;->o:797	API Call: android.content.pm.PackageManager.getInstalledApplications

Queries browser bookmarks

Show sources

Source: Lnet/vkurhandler/ah;->a()V

Method string: content://com.android.chrome.browser/bookmarks

Queries camera information

Show sources

Source: net.vkurhandler.PhotoActivity;->onCreate:66	API Call: android.hardware.Camera.open
Source: net.vkurhandler.ay;->a:3	API Call: android.hardware.Camera.getNumberOfCameras
Source: net.vkurhandler.ay;->a:4	API Call: android.hardware.Camera.open
Source: net.vkurhandler.ay;->a:5	API Call: android.hardware.Camera.getCameraInfo
Source: net.vkurhandler.ay;->a:6	API Call: android.hardware.Camera.open
Source: net.vkurhandler.cz;->a:35	API Call: android.hardware.Camera.open
Source: net.vkurhandler.ga;->a:2	API Call: android.hardware.Camera.open

Queries phone contact information

Show sources

Source: net.vkurhandler.al;->a:12	API Call: android.content.ContentResolver.query content://com.android.contacts/data/phones
Source: net.vkurhandler.al;->a:82	API Call: android.content.ContentResolver.query content://com.android.contacts/data/phones
Source: net.vkurhandler.MyApp;->y:48	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: net.vkurhandler.ah;->b:1942	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: net.vkurhandler.al;->a:10	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: net.vkurhandler.al;->a:81	Field access: android.provider.ContactsContract$CommonDataKinds$Phone.CONTENT_URI
Source: net.vkurhandler.gn;->a:87	Field access: android.provider.ContactsContract$PhoneLookup.CONTENT_FILTER_URI

Reads the incoming call number

Show sources

Source: net.vkurhandler.CallReceiver;->a:11

API Call: android.content.Intent.getStringExtra

Has permission to query the current location

Show sources

Source: submitted apk

Request permission: android.permission.ACCESS_FINE_LOCATION

Remote Access Functionality:

Found suspicious command strings (may be related to BOT commands)

Show sources

Source: Lnet/vkurhandler/gn;->b(Ljava/lang/String;Ljava/lang/String;)V	Method string: "utils->sendsms"
Source: Lnet/vkurhandler/SettingsActivity;->i()V	Method string: "change_sim_send_sms"
Source: Lcom/nll/nativelibs/callrecording/a;->startRecording()V	Method string: "start recording"
Source: Lnet/vkurhandler/gn;->b(Ljava/lang/String;Ljava/lang/String;)V	Instruction: "const-string v1, "utils->sendsms""
Source: Lnet/vkurhandler/SettingsActivity;->i()V	Instruction: "const-string v2, "change_sim_send_sms""
Source: Lcom/nll/nativelibs/callrecording/a;->startRecording()V	Instruction: "const-string v1, "start recording""

Has permission to mount or unmount file systems (removable storage)

Show sources

Source: submitted apk

Request permission: android.permission.MOUNT_UNMOUNT_FILESYSTEMS

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report nUcFpnJ7qZ

Overview

General Information

Detection

Confidence

Classification

Mitre Att&ck Matrix

Signature Overview

Location Tracking:

Privilege Escalation:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

Operating System Destruction:

Change of System Appearance:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Screenshots

Thumbnails