Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.89.origin
- Android.Triada.192.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- a####.####.com:7901
- imgc####.####.com
- p####.####.com
- la####.com
- o####.####.com:8080
- c####.####.com
- w####.####.cn
- c####.####.com:8080
- c####.####.com:8230
- b####.####.com:9230
- l####.####.com
- m####.####.com
- i####.####.cn
- b####.####.com
- a####.####.com
- qzones####.####.cn
HTTP GET requests:
- i####.####.cn/tfscom/i2/TB1B4QFKVXXXXbaXXXXXXXXXXXX_!!0-item_pic.jpg_430...
- m####.####.com/Public/img/goodbook/m_banner_tssc.jpg
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js-release/2017022...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appca...
- i####.####.cn/tfscom/i1/TB1xhJSLXXXXXb6XpXXXXXXXXXX_!!0-item_pic.jpg_430...
- m####.####.com/Public/js/m_footer.js
- p####.####.com/ycam?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- i####.####.cn/tfscom/i3/TB12HVGJFXXXXX6XXXXXXXXXXXX_!!0-item_pic.jpg_430...
- i####.####.cn/tfscom/i1/TB1WlcCKVXXXXcnXVXXXXXXXXXX_!!0-item_pic.jpg_430...
- m####.####.com/Public/js/m_pre_nav.js
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his...
- c####.####.com:8080/ads/promotion/ee48e7cc-d841-4048-94a5-67fbb8dd1209.png
- p####.####.com/ycam?sz=####&conwid=####&conhei=####&rdid=####&dc=####&di...
- c####.####.com/bd/bdAlone.js
- m####.####.com/Public/js/m_float.js
- i####.####.cn/tfscom/i2/TB1_0dLKXXXXXcoXFXXXXXXXXXX_!!0-item_pic.jpg_430...
- i####.####.cn/tfscom/i1/TB11pzgKFXXXXbaaXXXXXXXXXXX_!!0-item_pic.jpg_430...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo...
- m####.####.com/4031188.txt
- s####.####.com/hky0129.js
- i####.####.cn/tfscom/i4/TB15IdAOpXXXXXaaXXXXXXXXXXX_!!0-item_pic.jpg_430...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_ca...
- m####.####.com/
- m####.####.com/detail/detail.html?id=####&ali_trackid=####&pvid=####&e=#...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- w####.####.cn/;jsessionid=6AE2B23D712390E9FEB63DD5D4469797
- m####.####.com/Public/css/swiper3.06.min.css
- m####.####.com/Public/js/m.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close....
- w####.####.cn/render
- i####.####.cn/tfscom/i3/TB1bV3lKVXXXXXaXpXXXXXXXXXX_!!0-item_pic.jpg_430...
- l####.####.com/jquery/1.9.0/jquery.min.js
- la####.com/render?1####
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- i####.####.cn/tfscom/i2/TB1Kpx3IFXXXXa4XFXXXXXXXXXX_!!0-item_pic.jpg_430...
- c####.####.com/cpro/ui/cm.js
- s####.####.com/hky0130.js
- c####.####.com/js/hyapialltw.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/inter_close...
- c####.####.com/ads/js/web5.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- i####.####.cn/tfscom/i4/TB1EVckKVXXXXXeXVXXXXXXXXXX_!!0-item_pic.jpg_430...
- l####.####.com/cloudaapi/lightapp.js
- m####.####.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datat...
- m####.####.com/Public/js/swiper3.06.jquery.min.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/android01/images/score.png
- m####.####.com/Public/img/logo.png
- m####.####.com/Public/js/m_after_nav.js
- la####.com/;jsessionid=83355EAB8CDE43E9A5BAC53DCBC252A4
- m####.####.com/Public/img/goodbook/cp_20.jpg
- m####.####.com/Public/css/m.css
- m####.####.com/Public/js/m_buttom.js
HTTP POST requests:
- o####.####.com:8080/beacon/vercheck
- a####.####.com:7901/
- s####.####.com/err
- b####.####.com:9230/
- c####.####.com:8230/
- a####.####.com/
- b####.####.com/
- s####.####.com/launch
- s####.####.com/activate
Modified file system:
Creates the following files:
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.sig
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.cfg
- /data/data/####/app_e_qq_com_setting/gdt_suid
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/job2126.temp
- /sdcard/.76761b91/e628c755/cdd960e0d471385dc47085c3177a86ac
- /data/data/####/shared_prefs/global.xml
- /data/data/####/cache/job1025_61842338.jar
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/files/work_check_flag.cache
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/databases/GDTSDK.db-journal
- /data/data/####/app_e_qq_com_setting/devCloudSetting.cfg
- /data/data/####/files/beacontsa_cover_check.lock
- /sdcard/.76761b91/fc2c360/webinfo.xml
- /data/data/####/cache/job2388.temp
- /data/data/####/app_e_qq_com_plugin/update_lc
- /sdcard/.76761b91/65f4d34/d74827ee76d4e4213cc4aea063109265_1025.d7
- /data/data/####/app_288512176/assets/arm/fourteen.so
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/files/0b02030f08011f1410256727812.jar
- /sdcard/Android/data/####/cache/gdtadmobwebcache/ApplicationCache.db-journal
- /data/data/####/databases/GDTSDK.db
- /data/data/####/shared_prefs/global_timeout.xml
- /data/data/####/shared_prefs/beacontsa_cover.xml
- /data/data/####/cache/-261030783####.apk
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/app_e_qq_com_dex/gdt_plugin.dex
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp
- /data/data/####/cache/job1025_1118937733.jar
- /data/data/####/databases/SqlDataContainer
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/0b02030f08011f14101283398520.jar
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar
- /data/data/####/0b02030f08011f14101283398520.dex
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/job2078.temp
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/job2361.temp
- /data/data/####/files/downLoad_1011.cache
- /data/data/####/shared_prefs/global_timeouttimeoutlist.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar.sig
- /data/data/####/app_native/marble.so
- /data/data/####/shared_prefs/DataSdk.xml
- /data/data/####/cache/job2062.temp
- /data/data/####/files/0b02030f08011f1410534177742.jar
- /sdcard/Android/data/####/cache/gdtadmobwebcache/ApplicationCache.db
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- /data/data/####/app_e_qq_com_setting/devCloudSetting.sig
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
