Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.192.origin
- Android.DownLoader.652
Overlays the screen with its own window and blocks GUI access.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) b####.vd.cn:80
- TCP(HTTP/1.1) ads.m####.net:80
- TCP(HTTP/1.1) api.m####.net:80
- TCP(HTTP/1.1) apk.m####.net:80
- TCP(HTTP/1.1) api.appj####.com:80
DNS requests:
- ads.m####.net
- api.appj####.com
- api.m####.net
- apk.m####.net
- b####.vd.cn
- ip.ta####.com
- p1.w####.com
- p2.w####.com
- s1.w####.com
- s2.w####.com
HTTP GET requests:
- ads.m####.net/newsdk/PopupAd_desc_1_3_1.zip
- ads.m####.net/newsdk/PopupAd_dex_1_3_1.zip
- ads.m####.net/newsdk/close.png
- apk.m####.net/adimg/banner/201901/1546930684670_400_400.png
- b####.vd.cn/
- b####.vd.cn/data/attachment/block/0d/0d18847fce418e56404a80b34332e461.jpg
- b####.vd.cn/data/attachment/block/18/18ed8e5c5e145f948c816ed7fd4ed43e.jpg
- b####.vd.cn/data/attachment/block/49/49cb88192a711b16e8fc1e905184fa76.jpg
- b####.vd.cn/data/attachment/block/50/5055d631ab21bfd863d965028cbedc4b.jpg
- b####.vd.cn/data/attachment/block/59/598f1b79de4f10876a3b8c927258f3aa.jpg
- b####.vd.cn/data/attachment/block/6e/6eeffc84eadc7c351e116f73989bc01f.jpg
- b####.vd.cn/data/attachment/block/79/791f217ce167413b7fd17f9dd74347bb.jpg
- b####.vd.cn/data/attachment/block/a8/a88991477183a8af143499fd4410ee37.jpg
- b####.vd.cn/data/attachment/block/c8/c86e91aad4c995fbec632a459fabd8b1.jpg
- b####.vd.cn/data/attachment/block/d5/d52712b22dfbdd48e3152501b555807d.jpg
- b####.vd.cn/data/attachment/block/db/db9343a55edc5bad6efa35a8ff69cf90.jpg
- b####.vd.cn/data/attachment/block/e7/e787f74bc18fd328d82b001354d4794c.jpg
- b####.vd.cn/data/attachment/common/38/common_246_icon.png
- b####.vd.cn/data/attachment/image/000/17/57/57_200_140.jpg?mobile=####
- b####.vd.cn/data/attachment/image/000/17/57/57_800_1600.jpg?mobile=####
- b####.vd.cn/data/attachment/image/000/17/57/93_800_1600.jpg?mobile=####
- b####.vd.cn/data/cache/style_9_common.css?f####
- b####.vd.cn/forum-246-1.html
- b####.vd.cn/forum.php?mod=####&aid=####&size=####&key=####
- b####.vd.cn/forum.php?mod=####&aid=####&size=####&key=####&type=####
- b####.vd.cn/forum.php?mod=####&tid=####&mobile=####
- b####.vd.cn/home.php?mod=####&uid=####&do=####&mobile=####
- b####.vd.cn/portal.php?mod=####&mobile=####
- b####.vd.cn/static//image/mobile/images/pic_select.png
- b####.vd.cn/static/image/smiley/custom/dinlihai_org.gif
- b####.vd.cn/template/rtj1009_005/css/extend_common.css
- b####.vd.cn/template/rtj1009_005/image/14.jpg
- b####.vd.cn/template/rtj1009_005/image/ico_baike.png?2017####
- b####.vd.cn/template/rtj1009_005/image/ico_bbs.png?2017####
- b####.vd.cn/template/rtj1009_005/image/ico_try.png?2017####
- b####.vd.cn/template/rtj1009_005/image/ico_wenda.png?2017####
- b####.vd.cn/template/rtj1009_005/image/icon_photo.png
- b####.vd.cn/template/rtj1009_005/image/ren_go_pic.png
- b####.vd.cn/template/rtj1009_005/image/ren_ss.png
- b####.vd.cn/template/rtj1009_005/image/rtj1009_ui001.png
- b####.vd.cn/template/rtj1009_005/image/rtj1009_ui008.png
- b####.vd.cn/template/rtj1009_005/image/rtj1009_ui009.png
- b####.vd.cn/template/rtj1009_005/image/rtj1009_ui010.png
- b####.vd.cn/template/rtj1009_005/image/rtj1009_xl.png
- b####.vd.cn/template/rtj1009_005/js/common.js?f####
- b####.vd.cn/template/rtj1009_005/js/index.js
- b####.vd.cn/template/rtj1009_005/js/jquery-1.8.3.min.js?f####
- b####.vd.cn/template/rtj1009_005/js/modernizr.custom.js
- b####.vd.cn/template/rtj1009_005/js/ren.m.tab.js
- b####.vd.cn/template/rtj1009_005/js/ren.nav.js
- b####.vd.cn/template/rtj1009_005/style/t9/style.css
- b####.vd.cn/thread-108132-1-1.html
- b####.vd.cn/uc_server/avatar.php?uid=####&size=####
- b####.vd.cn/uc_server/data/avatar/000/20/60/60_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/000/23/16/03_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/000/78/55/55_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/001/14/01/94_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/001/38/55/73_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/001/39/31/99_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/001/40/12/69_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/001/44/16/19_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/001/47/80/91_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/00/00/91_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/08/10/93_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/09/84/31_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/66/81_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/72/14_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/72/81_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/72/91_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/73/53_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/75/30_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/75/89_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/77/40_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/77/43_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/77/51_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/78/19_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/78/35_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/79/68_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/82/23_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/83/03_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/84/15_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/84/19_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/84/52_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/85/45_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/87/33_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/87/96_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/97/87_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/11/98/08_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/43/17_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/56/92_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/57/15_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/57/32_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/58/88_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/59/18_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/59/52_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/59/71_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/60/51_avatar_small.jpg
- b####.vd.cn/uc_server/data/avatar/002/12/61/12_avatar_small.jpg
- b####.vd.cn/uc_server/images/noavatar_small.gif
- ip.ta####.com/service/getIpInfo.php?ip=####
HTTP POST requests:
- ads.m####.net/appscore4/active.bin
- ads.m####.net/appscore4/getappconf.bin
- ads.m####.net/appscore4/popscreen.bin
- api.appj####.com/appjiagu
- api.m####.net/sys_sta/aa.bin
- api.m####.net/sys_sta/an.bin
File system changes:
Creates the following files:
- /data/data/####/-2074665960
- /data/data/####/Download-journal
- /data/data/####/Downloado
- /data/data/####/Downloado-journal
- /data/data/####/Log-journal
- /data/data/####/Logo
- /data/data/####/Logo-journal
- /data/data/####/android_cache1.jar
- /data/data/####/com.inetfjdrwr.vdianshequ_preferences.xml
- /data/data/####/config.xml
- /data/data/####/configo.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/iConfig.xml
- /data/data/####/iDownload-journal
- /data/data/####/iLog-journal
- /data/data/####/index
- /data/data/####/jiagu.lock
- /data/data/####/libjiagu.so
- /data/data/####/pop_app_data.xml
- /data/data/####/popup_clientprofile.xml
- /data/data/####/setting1.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.android.dat
- /data/media/####/.android.dat-journal
- /data/media/####/.id
- /data/media/####/.iid
- /data/media/####/.mii
- /data/media/####/close
- /data/media/####/com.jssihh.nnhiddc.dex
- /data/media/####/com.jssihh.nnhiddc.dex (deleted)
- /data/media/####/com.jssihh.nnhiddk.dex (deleted)
- /data/media/####/com.jssihh.nnhiddl.dex
- /data/media/####/download.db
- /data/media/####/download.db-journal
- /data/media/####/id
- /data/media/####/logo.png
- /data/media/####/spot.dat
- /data/media/####/spot_in.png
Miscellaneous:
Loads the following dynamic libraries:
- jiagu
- libjiagu
Uses the following algorithms to encrypt data:
- DES
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
