Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Ninebox.4.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
DNS requests:
- a####.u####.com
- p####.me####.com
HTTP POST requests:
- a####.u####.com/app_logs
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/1558268657286.jar
- /data/data/####/1558268657456.jar
- /data/data/####/1558268657620.jar
- /data/data/####/1558268657734.jar
- /data/data/####/1558268657753.jar
- /data/data/####/1558268680954.jar
- /data/data/####/1558268681143.jar
- /data/data/####/1558268681318.jar
- /data/data/####/1558268681454.jar
- /data/data/####/1558268681460.jar
- /data/data/####/1558268685581.jar
- /data/data/####/1558268685722.jar
- /data/data/####/1558268685873.jar
- /data/data/####/1558268686006.jar
- /data/data/####/1558268686016.jar
- /data/data/####/1558268688763.jar
- /data/data/####/1558268688888.jar
- /data/data/####/1558268689027.jar
- /data/data/####/1558268689142.jar
- /data/data/####/1558268689157.jar
- /data/data/####/1558268692170.jar
- /data/data/####/1558268692283.jar
- /data/data/####/1558268692421.jar
- /data/data/####/1558268692527.jar
- /data/data/####/1558268692546.jar
- /data/data/####/1558268694411.jar
- /data/data/####/1558268694515.jar
- /data/data/####/1558268694659.jar
- /data/data/####/1558268694789.jar
- /data/data/####/1558268694797.jar
- /data/data/####/1558268697788.jar
- /data/data/####/1558268697903.jar
- /data/data/####/1558268698050.jar
- /data/data/####/1558268698159.jar
- /data/data/####/1558268698171.jar
- /data/data/####/1558268700979.jar
- /data/data/####/1558268701118.jar
- /data/data/####/1558268701284.jar
- /data/data/####/1558268701429.jar
- /data/data/####/1558268701431.jar
- /data/data/####/1558268704354.jar
- /data/data/####/1558268704490.jar
- /data/data/####/1558268704656.jar
- /data/data/####/1558268704785.jar
- /data/data/####/1558268704793.jar
- /data/data/####/1558268706884.jar
- /data/data/####/1558268707008.jar
- /data/data/####/1558268707137.jar
- /data/data/####/1558268707260.jar
- /data/data/####/1558268707267.jar
- /data/data/####/1558268709650.jar
- /data/data/####/1558268709788.jar
- /data/data/####/1558268709928.jar
- /data/data/####/1558268710065.jar
- /data/data/####/1558268710074.jar
- /data/data/####/1558268713996.jar
- /data/data/####/1558268714151.jar
- /data/data/####/1558268714298.jar
- /data/data/####/1558268714416.jar
- /data/data/####/1558268714417.jar
- /data/data/####/1558268716642.jar
- /data/data/####/1558268716766.jar
- /data/data/####/1558268716900.jar
- /data/data/####/1558268717018.jar
- /data/data/####/1558268717042.jar
- /data/data/####/1558268722888.jar
- /data/data/####/1558268723276.jar
- /data/data/####/1558268723413.jar
- /data/data/####/1558268723488.jar
- /data/data/####/1558268723650.jar
- /data/data/####/bah.xml
- /data/data/####/baj.xml
- /data/data/####/bak.xml
- /data/data/####/bid.xml
- /data/data/####/bim.xml
- /data/data/####/cfb.xml
- /data/data/####/cfj.xml
- /data/data/####/cft.xml
- /data/data/####/cix.xml
- /data/data/####/eid.xml
- /data/data/####/ftime.xml
- /data/data/####/libxwalkcore.so
- /data/data/####/mobclick_agent_cached_com.zynxtxl.zuoyounafjjox...nlian7
- /data/data/####/mobclick_agent_online_setting_com.zynxtxl.zuoyo...an.xml
- /data/data/####/pid.xml
- /data/data/####/pim.xml
- /data/data/####/sid.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/media/####/MID.DAT
- /data/media/####/share.dat
Miscellaneous:
Loads the following dynamic libraries:
- libxwalkcore
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
