I am reverse engineering an APK file. From the AndroidManifest.xml file, I found the class name (com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu) corresponding to Main Action as shown below:
<application android:allowBackup="true" android:icon="@mipmap/ic_launcher" android:label="System Message" android:name="com.diaisde.miatsnmd.rgEnPhtA" android:supportsRtl="true" android:theme="@android:style/Theme.Translucent.NoTitleBar">
<activity android:exported="false" android:name="com.google.android.gms.common.api.GoogleApiActivity" android:theme="@android:style/Theme.Translucent.NoTitleBar"/>
<meta-data android:name="com.google.android.gms.version" android:value="12211000"/>
<meta-data android:name="android.support.VERSION" android:value="26.1.0"/>
<meta-data android:name="android.arch.lifecycle.VERSION" android:value="27.0.0-SNAPSHOT"/>
<activity android:name="com.dfmlhsd.xecpwdugfsln.hnzpsm.KeQXGRNGu">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
</activity>
However, when I used dex2jar to convert the APK to a JAR file and decompiled the JAR file, I don't see the above class file.
In the com folder, I can only see the packages, com.diaisde.miatsnmd and com.zeqizplcin.zeqizplcin but I can't find com.dfmlhsd.xecpwdugfsln
How do I find the relevant class files for reversing this APK?
I have uploaded the APK file here: http://www.mediafire.com/file/0c9lrbz8o4lotq7/1.zip/file
Password: infected
Please note that this is a malicious APK file, so please analyze accordingly.
Thanks.