Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.683.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) 4####.92.62.1:80
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.1) i####.vg####.com:80
- TCP(HTTP/1.1) api.s####.b####.com:80
- TCP(HTTP/1.1) wr.da.net####.com:80
- TCP(HTTP/1.1) www.vg####.com:80
- TCP(HTTP/1.1) a####.vg####.com:8080
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) www.bili####.com:80
- TCP(HTTP/1.1) q.q####.cn:80
- TCP(HTTP/1.1) p.m####.126.####.net:80
- TCP(HTTP/1.1) www.iw####.com:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) m####.163.com:80
- TCP(HTTP/1.1) cdn.app.h####.####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) 1####.26.227.88:80
- TCP(HTTP/1.1) img.h####.com:80
- TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) re####.163.com.####.net:80
- TCP(TLS/1.0) www.bili####.com:443
- TCP(TLS/1.0) ho####.h####.top:443
- TCP(TLS/1.0) api.leanc####.cn:443
- TCP(TLS/1.0) app-ro####.leanc####.cn:443
- TCP(TLS/1.0) router-####.leanc####.cn:443
- TCP(TLS/1.0) cn-n1-c####.leanc####.cn:443
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) img.h####.com:443
- UDP 1####.168.59.254:4466
DNS requests:
- a####.vg####.com
- and####.b####.qq.com
- api.leanc####.cn
- api.s####.b####.com
- app-ro####.leanc####.cn
- cdn.app.h####.top
- cn-n1-c####.leanc####.cn
- com####.bili####.com
- d14uy7w####.cloudf####.net
- ho####.h####.top
- i####.vg####.com
- i1.h####.com
- inter####.bili####.com
- log.u####.com
- m####.163.com
- p1.m####.126.net
- pis.al####.com
- pns.al####.com
- pss.al####.com
- pus.al####.com
- q.q####.cn
- router-####.leanc####.cn
- s####.u####.com
- s3.m####.126.net
- s4.m####.126.net
- st####.h####.com
- wr.da.net####.com
- www.bili####.com
- www.google-####.com
- www.iw####.com
- www.vg####.com
HTTP GET requests:
- api.s####.b####.com/s.gif?l=http://music.163.com/m/outchain/player?type=...
- cdn.app.h####.####.com/swenjian/322
- cdn.app.h####.####.com/swenjian/322m
- d14uy7w####.cloudf####.net/download/key
- i####.vg####.com/article/web/151129011813935.jpg
- i####.vg####.com/article/web/161130085602533.jpg
- i####.vg####.com/game/cover/2017/01/13/17011315401782.png@200w_0e
- i####.vg####.com/game/cover/2017/01/13/170113192820719.jpg@200w_0e
- i####.vg####.com/game/cover/2017/06/02/170602113610911.png@200w_0e
- i####.vg####.com/game/cover/2017/06/13/170613123730177.jpg@200w_0e
- i####.vg####.com/game/cover/2017/06/14/170614174623174.jpg@200w_0e
- i####.vg####.com/game/cover/2017/06/20/17062015430165.jpg
- i####.vg####.com/game/cover/2017/06/23/170623174056699.jpg@200w_0e
- i####.vg####.com/game/cover/2017/08/26/170826195241152.jpg
- i####.vg####.com/game/cover/2017/10/24/17102417294422.jpg@200w_0e
- i####.vg####.com/game/cover/2017/11/22/171122202720882.jpg@200w_0e
- i####.vg####.com/game/cover/2018/01/17/180117173915642.jpg?x-oss-process...
- i####.vg####.com/game/cover/2018/03/02/180302155829363.jpg
- i####.vg####.com/game/cover/2018/03/14/180314150553232.jpg@1000w_0e
- i####.vg####.com/game/cover/2018/03/19/180319111621881.jpg
- i####.vg####.com/game/cover/2018/03/20/180320133806443.jpg
- i####.vg####.com/game/cover/2018/03/21/180321143101618.jpg@200w_0e
- i####.vg####.com/game/cover/2018/03/21/180321160945735.jpg@200w_0e
- i####.vg####.com/game/cover/2018/03/22/18032215131326.jpg
- i####.vg####.com/game/cover/2018/03/22/180322160534511.jpg
- i####.vg####.com/game/cover/2018/03/24/180324121349157.jpg@1000w_0e
- i####.vg####.com/game/cover/2018/03/24/180324160101693.jpg@1000w_0e
- i####.vg####.com/game/cover/2018/03/24/180324161823903.jpg
- i####.vg####.com/game/cover/2018/03/26/180326161239148.jpg@1000w_0e
- i####.vg####.com/game/cover/2018/03/27/180327102721379.jpg
- i####.vg####.com/game/cover/2018/03/27/180327134512549.jpg@1000w_0e
- i####.vg####.com/game/cover/2018/03/28/18032816331556.jpg
- i####.vg####.com/game/cover/2018/03/28/180328171028578.jpg
- i####.vg####.com/game/cover/2018/03/28/180328200345590.jpg
- i####.vg####.com/game/cover/2018/03/28/180328213052548.jpg
- i####.vg####.com/game/cover/2018/03/28/180328214622380.gif
- i####.vg####.com/game/cover/2018/03/28/180328215317157.jpg
- i####.vg####.com/game/cover/2018/03/28/180328221910310.jpg
- i####.vg####.com/game/cover/2018/03/28/18032822494699.jpg
- i####.vg####.com/game/cover/2018/03/28/180328232947179.jpg
- i####.vg####.com/game/cover/2018/03/29/180329101010711.jpg
- i####.vg####.com/game/cover/2018/03/29/180329102056215.jpg
- i####.vg####.com/game/web/150429235810788.jpg@200w_0e
- i####.vg####.com/game/web/150729210100110.jpg@200w_0e
- i####.vg####.com/game/web/150916180125458.jpg@200w_0e
- i####.vg####.com/game/web/151214113536883.jpg@200w_0e
- i####.vg####.com/game/web/151218191812394.jpg@200w_0e
- i####.vg####.com/game/web/160530102631247.jpg@200w_0e
- i####.vg####.com/headpic/2017/05/12/170512010506762.jpg
- i####.vg####.com/headpic/2017/05/21/170521180403694.jpg
- i####.vg####.com/headpic/2017/06/19/170619175722188.jpg
- i####.vg####.com/headpic/2017/08/23/170823110915494.jpg
- i####.vg####.com/headpic/2017/11/01/171101194341840.jpg
- i####.vg####.com/headpic/2017/11/09/171109014701867.jpg
- i####.vg####.com/headpic/2017/12/21/171221111728807.jpg
- i####.vg####.com/headpic/2018/01/29/180129113836325.jpg
- i####.vg####.com/headpic/2018/02/26/180226075220332.jpg
- i####.vg####.com/headpic/2018/03/10/180310095723740.jpg
- i####.vg####.com/headpic/2018/03/26/180326080854443.jpg
- i####.vg####.com/headpic/2018/03/26/180326234415979.jpg
- i####.vg####.com/headpic/web/jsp_avatar1_201512222139071408pgnsm25.jpg
- i####.vg####.com/headpic/web/jsp_avatar1_2016011712414944c4ym448t.jpg
- i####.vg####.com/space/170529103359719.png
- i####.vg####.com/space/170621141442183.png
- i####.vg####.com/space/171222183817920.png
- i####.vg####.com/topic/2018/03/28/180328225255842.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225300671.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225306307.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225311265.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225318671.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225322596.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225325999.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225329544.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328225455592.png?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328233155552.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328233156478.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328233156683.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328233628825.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328233630245.jpg?x-oss-process=####
- i####.vg####.com/topic/2018/03/28/180328233630526.jpg?x-oss-process=####
- i####.vg####.com/web/topic/2018/03/28/180328190758627.jpg
- i####.vg####.com/web/topic/2018/03/28/180328190758627.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/180328190948244.jpg
- i####.vg####.com/web/topic/2018/03/28/180328190948244.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/180328202955288.jpg
- i####.vg####.com/web/topic/2018/03/28/180328202955288.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/180328204526499.jpg
- i####.vg####.com/web/topic/2018/03/28/180328204526499.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/180328204659887.jpg
- i####.vg####.com/web/topic/2018/03/28/180328204659887.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/18032820493522.jpg
- i####.vg####.com/web/topic/2018/03/28/18032820493522.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/180328205009485.jpg
- i####.vg####.com/web/topic/2018/03/28/180328205009485.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/18032821155199.jpg
- i####.vg####.com/web/topic/2018/03/28/18032821155199.jpg@188w_0e
- i####.vg####.com/web/topic/2018/03/28/180328212454748.jpg
- i####.vg####.com/web/topic/2018/03/28/180328213032599.jpg
- i####.vg####.com/web/topic/2018/03/28/180328213745599.jpg
- i####.vg####.com/web/topic/2018/03/28/180328213810984.jpg
- i####.vg####.com/web/topic/2018/03/28/180328213847314.jpg
- i####.vg####.com/web/topic/2018/03/29/180329094358803.jpg@380w_0e
- img.h####.com/css/simple.v2.min.css
- img.h####.com/images/bilibili.ttf
- img.h####.com/images/loading.gif
- img.h####.com/js/simple.v2.min.js?_=####
- img.h####.com/mobile/css/mobile.css
- img.h####.com/mobile/img/app_logo.v3.png
- img.h####.com/mobile/img/close_icon.png
- img.h####.com/mobile/img/ui_2.png
- m####.163.com/UA-38766552-1/__utm.gif?utmwv=5.5.3&utms=1&utmn=928976266&...
- m####.163.com/m/outchain/player?type=####&id=####&auto=####&height=####
- m####.163.com/outchain/player?type=####&id=####&auto=####&height=####
- m####.163.com/style/web2/css/base.css
- m####.163.com/style/web2/css/outchain-player.css
- m####.163.com/style/web2/img/outchain/audio_sprite.png
- p.m####.126.####.net/-dnzELiWUg1p_3uIRiug9w==/109951163205203424.jpg?par...
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
- q.q####.cn/qqapp/1104592008/021C6837464976E93B4241200AB94666/100
- re####.163.com.####.net/style/web2/img/default/default_list.jpg?param=####
- re####.163.com.####.net/web/s/core.js?d2add5f####
- re####.163.com.####.net/web/s/pt_outchain_player.js?b50de9e####
- sh.wagbr####.alibaba####.com/bar/get/58eaff85c62dca6674001938/?ud_get=####
- wr.da.net####.com/ga.js
- www.bili####.com/nav.js?_=####
- www.bili####.com/recommendnew,21169281
- www.bili####.com/search?action=####&main_ver=####
- www.bili####.com/video/av21169281
- www.google-####.com/__utm.gif?utmwv=5.5.3&utms=1&utmn=1457433645&utmhn=m...
- www.iw####.com/static/app/vgtime5.apk
- www.vg####.com/resources/app/android.js
- www.vg####.com/resources/app/app.css
- www.vg####.com/resources/app/img/1.png
- www.vg####.com/resources/app/img/ad_close.png
- www.vg####.com/resources/app/img/bili_play.png
- www.vg####.com/resources/app/img/iv_review_icon_0.png
- www.vg####.com/resources/app/img/iv_review_icon_2.png
- www.vg####.com/resources/app/img/iv_review_icon_7.png
- www.vg####.com/resources/app/img/iv_review_icon_8.png
- www.vg####.com/resources/app/img/iv_review_icon_point.png
- www.vg####.com/resources/app/img/ping.png
- www.vg####.com/resources/app/img/vg_subjetc_cover.png
- www.vg####.com/resources/bili/bili.html?aid=####&page=####
- www.vg####.com/resources/bili/bilibili.base.mobile.js
- www.vg####.com/resources/img/panst/panst_11.gif
- www.vg####.com/resources/img/panst/panst_21.gif
- www.vg####.com/resources/img/panst/panst_94.gif
- www.vg####.com/resources/js/jquery-1.8.2.min.js
HTTP POST requests:
- a####.vg####.com:8080/vgtime-app/api/v2/comments/hot/list
- a####.vg####.com:8080/vgtime-app/api/v2/elite/topic/list
- a####.vg####.com:8080/vgtime-app/api/v2/forum/list
- a####.vg####.com:8080/vgtime-app/api/v2/game/last/sales
- a####.vg####.com:8080/vgtime-app/api/v2/game/platList.json
- a####.vg####.com:8080/vgtime-app/api/v2/game/previewList.json
- a####.vg####.com:8080/vgtime-app/api/v2/game/tagList.json
- a####.vg####.com:8080/vgtime-app/api/v2/homepage/listByTag.json
- a####.vg####.com:8080/vgtime-app/api/v2/hotword.json
- a####.vg####.com:8080/vgtime-app/api/v2/index/focusmap/list
- a####.vg####.com:8080/vgtime-app/api/v2/index/list
- a####.vg####.com:8080/vgtime-app/api/v2/init/ad.json
- a####.vg####.com:8080/vgtime-app/api/v2/init/version.json
- a####.vg####.com:8080/vgtime-app/api/v2/post/detail.json
- a####.vg####.com:8080/vgtime-app/api/v2/post/detailStatus.json
- a####.vg####.com:8080/vgtime-app/api/v2/reward/user/list.jhtml
- a####.vg####.com:8080/vgtime-app/api/v2/timeline/forumTags.json
- and####.b####.qq.com/rqd/async?aid=####
- m####.163.com/weapi/dj/program/detail
- pis.al####.com/p/pcdn/i.php?v=####
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
Modified file system:
Creates the following files:
- /data/data/####/0e2adc408396e6ab1691d48a6ce5783c2e58dbcb9c9cdf0....0.tmp
- /data/data/####/1004
- /data/data/####/1510835230217.log
- /data/data/####/54637f24b0e3cb9e4cea0929c933093993237a94b07f0f5....0.tmp
- /data/data/####/56863d1e13e5ade8b7db2fbe20c05efb3126cf9b73cb22a....0.tmp
- /data/data/####/9f6db49a-4c5b-4b2f-8afc-02bed75632ba
- /data/data/####/AVOSCloud-SDK.xml
- /data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- /data/data/####/AV_PUSH_SERVICE_APP_DATA.xml
- /data/data/####/MultiDex.lock
- /data/data/####/SUBOXLOG_
- /data/data/####/a91d5cff514770be59c59a1f99d1d8b7
- /data/data/####/avoscloud-analysis
- /data/data/####/bugly_db_-journal
- /data/data/####/bzwn.db-journal
- /data/data/####/c6717e739b952f9b5cb0b2e281b0f44d
- /data/data/####/clo.xml
- /data/data/####/cn-n1-cell6.leancloud.cn.443
- /data/data/####/com.avos.avoscloud.RequestStatisticsUtil.data.xml
- /data/data/####/com.avos.avoscloud.analysis.xml
- /data/data/####/com.avos.avoscloud.approuter.qw1fas3msdbutvno0s...76.xml
- /data/data/####/com.avos.push.router.server.cacheqw1fas3msdbutv...76.xml
- /data/data/####/com.pp.td.Ha.xml
- /data/data/####/com.pp.td.Noej.jar
- /data/data/####/com.pp.td.Noej.xml
- /data/data/####/crashrecord.xml
- /data/data/####/creativelocker.pref.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadApk.xml
- /data/data/####/e1d39482-1f49-43ed-8e30-e11545bd3f40.jar
- /data/data/####/e5a638756a212696edc1e6ba251fb738a210e3d5aa7c9a1....0.tmp
- /data/data/####/ebn.xml
- /data/data/####/ebn.xml.bak
- /data/data/####/efc46ff3fe35db73f1e6fe9a46cc6ddf
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/index
- /data/data/####/installation
- /data/data/####/journal.tmp
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/local_crash_lock
- /data/data/####/multidex.version.xml
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pcdnconfigs.xml.bak
- /data/data/####/security_info
- /data/data/####/tmp-dxt.duke.union-1.apk.classes-1962323543.zip
- /data/data/####/umeng_socialize.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-1002194713.tmp
- /data/media/####/-1088677268.tmp
- /data/media/####/-1153658008.tmp
- /data/media/####/-1166317529.tmp
- /data/media/####/-1184244728.tmp
- /data/media/####/-1220904921.tmp
- /data/media/####/-124929722.tmp
- /data/media/####/-1256421928.tmp
- /data/media/####/-1306996112.tmp
- /data/media/####/-1324232509.tmp
- /data/media/####/-1328328303.tmp
- /data/media/####/-1353480967.tmp
- /data/media/####/-1363816250.tmp
- /data/media/####/-1415504486.tmp
- /data/media/####/-1437796989.tmp
- /data/media/####/-1458447742.tmp
- /data/media/####/-1467506373.tmp
- /data/media/####/-1577448807.tmp
- /data/media/####/-1673309404.tmp
- /data/media/####/-1697950040.tmp
- /data/media/####/-1716848683.tmp
- /data/media/####/-1803291094.tmp
- /data/media/####/-1831829344.tmp
- /data/media/####/-184521709.tmp
- /data/media/####/-1875753031.tmp
- /data/media/####/-1907862170.tmp
- /data/media/####/-1948405859.tmp
- /data/media/####/-1966941836.tmp
- /data/media/####/-1988312754.tmp
- /data/media/####/-2008370916.tmp
- /data/media/####/-200893630.tmp
- /data/media/####/-2034624868.tmp
- /data/media/####/-232335766.tmp
- /data/media/####/-295607610.tmp
- /data/media/####/-325824614.tmp
- /data/media/####/-334740492.tmp
- /data/media/####/-36475677.tmp
- /data/media/####/-371742089.tmp
- /data/media/####/-389716104.tmp
- /data/media/####/-43507721.tmp
- /data/media/####/-519364399.tmp
- /data/media/####/-562460774.tmp
- /data/media/####/-662773140.tmp
- /data/media/####/-672334091.tmp
- /data/media/####/-90200216.tmp
- /data/media/####/-903847869.tmp
- /data/media/####/-92065052.tmp
- /data/media/####/-922917375.tmp
- /data/media/####/-926790523.tmp
- /data/media/####/-964479362.tmp
- /data/media/####/.nomedia
- /data/media/####/1016903586.tmp
- /data/media/####/1017204250.tmp
- /data/media/####/1017557957.tmp
- /data/media/####/1066101001.tmp
- /data/media/####/1079567365.tmp
- /data/media/####/1123872834.tmp
- /data/media/####/1130076063.tmp
- /data/media/####/1181504618.tmp
- /data/media/####/1192122518.tmp
- /data/media/####/1211086741.tmp
- /data/media/####/1251035198.tmp
- /data/media/####/1269842877.tmp
- /data/media/####/1336375666.tmp
- /data/media/####/1338114891.tmp
- /data/media/####/1344733194.tmp
- /data/media/####/135632213.tmp
- /data/media/####/1367341444.tmp
- /data/media/####/1368849479.tmp
- /data/media/####/1460854298.tmp
- /data/media/####/1481893455.tmp
- /data/media/####/1502494354.tmp
- /data/media/####/1538813309.tmp
- /data/media/####/1585952350.tmp
- /data/media/####/1654446308.tmp
- /data/media/####/166124678.tmp
- /data/media/####/1684849617.tmp
- /data/media/####/1776548256.tmp
- /data/media/####/1782826601.tmp
- /data/media/####/1860860298.tmp
- /data/media/####/1889426475.tmp
- /data/media/####/1976066765.tmp
- /data/media/####/1978629035.tmp
- /data/media/####/2012974134.tmp
- /data/media/####/2024945954.tmp
- /data/media/####/2069335908.tmp
- /data/media/####/2074850771.tmp
- /data/media/####/2103479922.tmp
- /data/media/####/2116486124.tmp
- /data/media/####/2125871659.tmp
- /data/media/####/219025610.tmp
- /data/media/####/236756503.tmp
- /data/media/####/328821273.tmp
- /data/media/####/379642717.tmp
- /data/media/####/419585105.tmp
- /data/media/####/440865465.tmp
- /data/media/####/503101514.tmp
- /data/media/####/58167649.tmp
- /data/media/####/633971866.tmp
- /data/media/####/73729017.tmp
- /data/media/####/751538741.tmp
- /data/media/####/VGtime_2.2.2_1520999179.apk
- /data/media/####/myself.dat
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- getprop
Loads the following dynamic libraries:
- Bugly
- libpcdn_acc
- pcdn_acc
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-GCM-NoPadding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Displays its own windows over windows of other applications.
