Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.41.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.d####.com:80
- TCP(HTTP/1.1) v.adma####.com.cn:80
- TCP(HTTP/1.1) p####.api.adoc####.com:80
- TCP(HTTP/1.1) t####.a####.top:80
- TCP(HTTP/1.1) f.qia####.com:80
- TCP(HTTP/1.1) res####.a####.top:80
- TCP(HTTP/1.1) a####.w####.com:80
- TCP(HTTP/1.1) cu.c####.cn:80
- TCP(HTTP/1.1) api.m2g.adoc####.com:80
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) dsp.huoli####.cn:80
- TCP(HTTP/1.1) h.w####.com:80
- TCP(HTTP/1.1) 58.2####.201.145:654
- TCP(HTTP/1.1) api.lubang####.com:80
- TCP(HTTP/1.1) d####.cn:80
- TCP(HTTP/1.1) kou####.a####.top:80
- TCP(HTTP/1.1) i####.d####.cn:80
- TCP(HTTP/1.1) 58.2####.203.36:654
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) ip.j####.com:999
- TCP(HTTP/1.1) ip.j####.com:99
- TCP(HTTP/1.1) ia.c####.cn:80
- TCP(HTTP/1.1) p####.pc####.com.cn:80
- TCP(HTTP/1.1) i####.pcon####.com.cn:80
- TCP(HTTP/1.1) api.gug####.com:8935
- TCP(HTTP/1.1) cdn.boo####.com.####.com:80
- TCP(HTTP/1.1) v2.reac####.cn:80
- TCP(HTTP/1.1) a####.qia####.com:80
- TCP(HTTP/1.1) 6t####.com:80
- TCP(HTTP/1.1) co####.ssp.adoc####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) s.clients####.cn:80
- TCP(HTTP/1.1) s.zhito####.com:88
- TCP(HTTP/1.1) 58.2####.198.157:999
- TCP(HTTP/1.1) 1####.75.90.218:80
- TCP(HTTP/1.1) s.zhito####.com:808
- TCP(HTTP/1.1) s.zhito####.com:807
- TCP(HTTP/1.1) fc.clients####.cn:80
- TCP(HTTP/1.1) 1####.75.92.94:80
- TCP(HTTP/1.1) api.yunco####.com:80
- TCP(HTTP/1.1) ad.w####.com:80
- TCP(HTTP/1.1) api.adoc####.com:80
- TCP(HTTP/1.1) vvv.focusd####.cn:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) p####.pc####.com.cn:443
- TCP(TLS/1.0) mg####.pcon####.com.cn:443
- TCP(TLS/1.0) u.j####.com:443
- TCP(TLS/1.0) js.3con####.com:443
- TCP(TLS/1.0) i####.j####.com:443
- TCP(TLS/1.0) pc####.i####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) img.pcon####.com.####.cn:443
- TCP(TLS/1.0) wl.jd.com.####.com:443
- TCP(TLS/1.0) www.pc####.com.####.cn:443
- TCP(TLS/1.0) ec####.b####.com:443
- TCP(TLS/1.0) c####.pc####.com.cn:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) i####.d####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) p####.m.jd.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) ivy.pcon####.com.cn:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) api.g####.vip:443
- TCP(TLS/1.0) cdn.boo####.com.####.com:443
- TCP(TLS/1.0) 59.1####.190.31:443
- TCP(TLS/1.0) sw3.d####.com:443
DNS requests:
- 2.and####.p####.####.org
- 6t####.com
- a####.d####.com
- a####.qia####.com
- a####.w####.com
- ad.w####.com
- api.adoc####.com
- api.g####.vip
- api.gug####.com
- api.lubang####.com
- api.m2g.adoc####.com
- api.yunco####.com
- c####.mm####.com
- c####.pc####.com.cn
- c####.zhito####.com
- c.c####.com
- cdn.boo####.com
- co####.ssp.adoc####.com
- cu.c####.cn
- d####.cn
- d2.y####.com
- dsp.huoli####.cn
- dup.baidust####.com
- ec####.b####.com
- f.qia####.com
- fc.clients####.cn
- filt####.a####.top
- h.w####.com
- hm.b####.com
- i####.d####.cn
- i####.d####.com
- i####.pcon####.com.cn
- ia.c####.cn
- img.pcon####.com.cn
- ip.j####.com
- ip.zhito####.com
- ivy.pcon####.com.cn
- js.3con####.com
- kou####.a####.top
- m.360bu####.com
- mg####.pcon####.com.cn
- p####.api.adoc####.com
- p####.m.jd.com
- p####.pc####.com.cn
- pc####.i####.com
- pos.b####.com
- pv.s####.com
- res####.a####.top
- s.clients####.cn
- s.zhito####.com
- s13.c####.com
- s4.c####.com
- s5.c####.com
- sto####.360bu####.com
- sw3.d####.com
- t####.a####.top
- u####.a####.top
- u.j####.com
- v.adma####.com.cn
- v1.c####.com
- v2.reac####.cn
- vvv.focusd####.cn
- w####.jd.com
- w####.pc####.com.cn
- w####.pcon####.com.cn
- www.google-####.com
- www.pc####.com.cn
- www.pcon####.com.cn
- z11.c####.com
- z3.c####.com
- z6.c####.com
- z7.c####.com
- z9.c####.com
HTTP GET requests:
- 6t####.com/
- 6t####.com/css/style.css
- 6t####.com/img/weixin.png
- 6t####.com/js/jquery.min.js
- 6t####.com/js/secret.js
- a####.d####.com/rewrite?fromid=####
- api.adoc####.com/titan/monitor/device_info
- api.m2g.adoc####.com/ssp/mgm/task?taskId=####&ip=####
- cdn.boo####.com.####.com/jiahedsp/201911291574996942339.jpg
- co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
- co####.ssp.adoc####.com/api/v2/fwWebviewRatioConfig?channelCode=####&ver...
- co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
- co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
- cu.c####.cn/v1.0/pages?ao=####&pid=####&aid=####&keyword=####&model=####...
- d####.cn/aawc.html
- d####.cn/aawm.html
- d####.cn/baiduwm.html
- d####.cn/bbwc.html
- d####.cn/bbwm.html
- d####.cn/xincan.html?3####
- d####.cn/xincan.html?4####
- d####.cn/yhyd.html
- dsp.huoli####.cn/fenpei.html?3####
- dsp.huoli####.cn/web/app.html
- dsp.huoli####.cn/web/wap.html
- dup.baidust####.com/js/os.js
- f.qia####.com/e/20191108171457b_600017_v61.enc
- fc.clients####.cn/static/upload/materials/201904021609039254398.jpg
- fc.clients####.cn/static/upload/materials/201905231146308319024.jpg
- fc.clients####.cn/static/upload/materials/201908291748237210348.jpg
- fc.clients####.cn/static/upload/materials/201908291752167233666.jpg
- fc.clients####.cn/static/upload/materials/201908291754587249825.jpg
- fc.clients####.cn/static/upload/materials/201909201503519630311.jpg
- fc.clients####.cn/static/upload/materials/201910221356332379392.jpg
- fc.clients####.cn/static/upload/materials/201911271629534339306.jpg
- fc.clients####.cn/static/upload/materials/201912031410365343661.jpg
- gd.a.s####.com/cityjson?ie=####
- i####.d####.cn/goldcool.php?id=####
- i####.pcon####.com.cn/blank.gif
- ia.c####.cn/sy17/pc2438/mt103094811/ip95.211.190.198/ti1575637208/dv8673...
- ia.c####.cn/sy17/pc2438/mt103094811/ip95.211.190.198/ti1575637215/dv8673...
- ia.c####.cn/sy17/pc2674/mt102080756/ip95.211.190.198/ti1575637208/dv8673...
- ia.c####.cn/sy17/pc2674/mt102080756/ip95.211.190.198/ti1575637208/dv8693...
- ia.c####.cn/sy17/pc2674/mt102636367/ip95.211.190.198/ti1575637207/dv8693...
- ia.c####.cn/sy17/pc2674/mt102636395/ip95.211.190.198/ti1575637215/dv8673...
- ia.c####.cn/sy17/pc2674/mt102636423/ip95.211.190.198/ti1575637210/dv8673...
- ia.c####.cn/sy17/pc2674/mt102757880/ip95.211.190.198/ti1575637208/dv8693...
- ia.c####.cn/sy17/pc2674/mt102869271/ip95.211.190.198/ti1575637208/dv8693...
- ia.c####.cn/sy17/pc2674/mt103026799/ip95.211.190.198/ti1575637207/dv8673...
- ia.c####.cn/sy17/pc2674/mt103026799/ip95.211.190.198/ti1575637210/dv8673...
- ia.c####.cn/sy17/pc2674/mt103081903/ip95.211.190.198/ti1575637209/dv8673...
- ia.c####.cn/sy17/pc2674/mt103143538/ip95.211.190.198/ti1575637207/dv8693...
- ip.j####.com:99/IP/Index/geturls
- ip.j####.com:99/Public/Access/js/modules/common.js
- ip.j####.com:99/Public/Access/js/modules/creifr.js
- ip.j####.com:99/ip/index.html
- ip.j####.com:999/wap/index.php?0####
- kou####.a####.top/kouling.json
- p####.api.adoc####.com/ip
- p####.pc####.com.cn/cars/image/1471508-1-sg9488-o1.html?ad=####
- pos.b####.com/acnm?psi=6482c8796059d43faab986478f6cc805&di=6611856&dri=0...
- pos.b####.com/bcrm?psi=7b3be033ce551e5bf3d5837458023a06&di=6688728&dri=0...
- pos.b####.com/bfp/snippetcacher.php?dpv=####&di=####
- pos.b####.com/hcqm?conwid=####&conhei=####&rtbid=####&rdid=####&dc=####&...
- pos.b####.com/hcqm?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
- pos.b####.com/hcrm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/hcrm?psi=8860dd3b89eeb71a500ac09e00279374&di=6669420&dri=0...
- pos.b####.com/kcdm?conwid=234&conhei=60&rtbid=3184800&rdid=13808384&dc=2...
- pos.b####.com/kcdm?psi=013d863c0e16ef2346ebfe0efe0f8692&di=6669420&dri=0...
- pos.b####.com/ncqm?conwid=234&conhei=60&rtbid=3033352&rdid=13147349&dc=2...
- pos.b####.com/ncqm?psi=eb7bbd34ed3e672406ce675aa6187411&di=5897808&dri=0...
- pos.b####.com/qcbm?psi=1d019d58363de15140887d1c8baf9d84&di=6688728&dri=0...
- pos.b####.com/rcwm?psi=b4e34e0ff5831abf386a4678a904803a&di=6611856&dri=0...
- pos.b####.com/wcjm?psi=####&di=####&dri=####&dis=####&dai=####&ps=####&e...
- res####.a####.top/LHYY.png
- res####.a####.top/filter_control_611.json
- res####.a####.top/sdk16.png
- res####.a####.top/sdk17.png
- res####.a####.top/sdk18.png
- res####.a####.top/sdk5_2.png
- res####.a####.top/sdk7.png
- s.clients####.cn/dspo.htm?sp=####&ext=MCw####&f=####
- s.zhito####.com:807/528/jf0622.html
- s.zhito####.com:807/ip/ip.html
- s.zhito####.com:808/0622/index.html
- s.zhito####.com:808/0622/yrc_001mobile.js
- s.zhito####.com:88/wap.html
- t####.a####.top/channl_adong5.png
- v.adma####.com.cn/i/a125276,b3306905,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306906,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306907,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306908,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306909,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306910,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306911,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306912,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a125276,b3306913,c151,i0,m202,8a2,8b3,0i__IESID__,h
- v.adma####.com.cn/i/a136234,b3859763,c4365,i0,m202,8a2,8b2,0a0,0cf78d97f...
- v2.reac####.cn/count/run.php?a=####&ver=####&cpid=####&pub=####&bc=####&...
- vvv.focusd####.cn/ad/v1/log.action?action=####&package=####&channel=####...
HTTP POST requests:
- a####.qia####.com//api/2io82K
- a####.qia####.com//api/8VbeIo
- a####.qia####.com//api/Ddgv3VE
- a####.qia####.com//api/Mny1OOW3
- a####.qia####.com//api/QTnLukEdO1
- a####.qia####.com//api/SEEzevU1
- a####.qia####.com//api/SJoGF44Q
- a####.qia####.com//api/SVFUp6
- a####.qia####.com//api/voEYG7
- a####.w####.com/rest/pt
- ad.w####.com/api.htm?pid=####
- api.adoc####.com/ssp/monitor/collect/error
- api.gug####.com:8935/
- api.lubang####.com/domain.php
- api.lubang####.com/srp.php
- api.yunco####.com/service/rest
- h.w####.com/api/Gu5wT0Z
File system changes:
Creates the following files:
- /data/data/####/.3WN9
- /data/data/####/.5TE4.xml
- /data/data/####/.J1_v.xml
- /data/data/####/.__mob_ad_data.xml
- /data/data/####/.fKSra
- /data/data/####/.fKSra.zip
- /data/data/####/16.jar
- /data/data/####/17.jar
- /data/data/####/18.jar
- /data/data/####/1c57054f65daf33c2ff6aafa6e479c44.db
- /data/data/####/5_2.jar
- /data/data/####/7.jar
- /data/data/####/7295ece1696c2c3e0ee9a8b27f4b49a3.db
- /data/data/####/85b8370a53d6eca22da5f3fb5c291ed7.db
- /data/data/####/ahq_spu_ti.xml
- /data/data/####/countIp.xml
- /data/data/####/d19e9c953d3ee5108f32dc026e00652c.db
- /data/data/####/d19e9c953d3ee5108f32dc026e00652c.jar
- /data/data/####/d2530b6daefa9b15f2ea89ae51fb23b6.db
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downUmeng.jar
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/fe0dfcec6e195d55d555804df2596854.db
- /data/data/####/hhq_spu_ti.xml
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/xx.dsad.xxxxsadxhcTEST.xml
- /data/data/####/xx_dsad_xxxxsadxhcTEST.txt
- /data/media/####/.YiAds.log
- /data/media/####/.YiAds_Net.log
- /data/media/####/xx_dsad_xxxxsadxhcTEST.txt
Miscellaneous:
Executes the following shell scripts:
- cat /proc/cpuinfo
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
