Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.399.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) p.zcul####.net:80
- TCP(HTTP/1.1) d.bjsd####.com:80
- TCP(HTTP/1.1) a.bjsd####.com:80
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) a####.free-ey####.com:80
- TCP(HTTP/1.1) d####.dd7####.com:80
- TCP(HTTP/1.1) api.16####.com:651
- TCP(HTTP/1.1) v.zcul####.net:80
- TCP(HTTP/1.1) 1####.23.233.80:9091
- TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) 2####.58.211.110:443
- TCP(TLS/1.0) project####.cn-nort####.eb.####.cn:3333
DNS requests:
- a####.free-ey####.com
- a.bjsd####.com
- aliyuno####.oss-cn-####.aliy####.com
- api-co####.fog####.cn
- api.16####.com
- api.free-ey####.com
- d####.dd7####.com
- d.bjsd####.com
- p.zcul####.net
- v.zcul####.net
- w####.pcon####.com.cn
- z####.heyc####.net
- z2.c####.com
- z5.c####.com
- z9.c####.com
HTTP GET requests:
- a####.free-ey####.com/asfile/nocomp1227?auth_key=####
- d####.dd7####.com//upload/sdk2/clsdkdex20181129.jar
- d####.dd7####.com//upload/sdk2/sdk04dex20190218.jar
- d####.dd7####.com/upload/plog/N38de20181225.jar
- d####.dd7####.com/upload/plog/mfgz.jar
- d####.dd7####.com/upload/sdk3/SSDK_28.jar
- z.c####.com/stat.htm?id=####&cnzz_eid=####
HTTP POST requests:
- a.bjsd####.com/index.php?r=####
- api.16####.com:651/api_yi.aspx
- api.16####.com:651/slsdk/getdata.aspx
- api.16####.com:651/slsdk/settings.aspx
- d.bjsd####.com/index.php?r=####
- p.zcul####.net/m/a/t
- v.zcul####.net/x/appr/i
- w####.pcon####.com.cn/ip.jsp
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
File system changes:
Creates the following files:
- /data/data/####/1d31cf33ca1bc1eb9e28e34125ec078b.d
- /data/data/####/2094700396.jar
- /data/data/####/9bf089d710a6241538393c3876d249c7.d
- /data/data/####/_nohttp_cookies_db.db
- /data/data/####/_nohttp_cookies_db.db-journal
- /data/data/####/ad.vv.sdk.xml
- /data/data/####/alias.xml
- /data/data/####/config.xml
- /data/data/####/dpi
- /data/data/####/ef12f5026515354bb3b08063249b2e7e1.png
- /data/data/####/fgzde.data-journal
- /data/data/####/fkadsdk_pid_config.xml
- /data/data/####/hid.db
- /data/data/####/lzzhe.xml
- /data/data/####/lzzhe.xml.bak
- /data/data/####/lzzhe.xml.bak (deleted)
- /data/data/####/nhgbbpxz.xml
- /data/data/####/ombjhvs.data-journal
- /data/data/####/sp.data.xml
- /data/data/####/webview.db-journal
- /data/media/####/.fankadcoas
- /data/media/####/.nid
- /data/media/####/N38de20181225.jar
- /data/media/####/SSDK_28.jar
- /data/media/####/ad.vv.sdk.db51
- /data/media/####/ad.vv.sdk.db51-journal
- /data/media/####/clsdkdex20181129.jar
- /data/media/####/com.example.fdsafd
- /data/media/####/dbversion51
- /data/media/####/ef12f5026515354bb3b08063249b2e7e1.png
- /data/media/####/mfgz.jar
- /data/media/####/sdk04dex20190218.jar
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- getprop
- ls -l /dev
- ls -l /dev/block
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuctl/apps
- ls -l /dev/cpuctl/apps/bg_non_interactive
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/log
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ps
Uses the following algorithms to encrypt data:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
