Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Panda.1.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) api.p####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.2) 1####.217.168.234:443
- TCP(TLS/1.2) 2####.58.208.99:443
DNS requests:
- api.p####.com
- nerv####.aiq####.com
- nerv####.aiq####.com.####.8
- p####.google####.com
- www.pan####.net
HTTP POST requests:
- api.p####.com:443/2/user_signup_or_login
File system changes:
Creates the following files:
- /data/data/####/37b5532ca152634585871600f2b3d3d8.dex
- /data/data/####/37b5532ca152634585871600f2b3d3d8.dex.flock (deleted)
- /data/data/####/BDILoggerClientId
- /data/data/####/BDILoggerDispatchReportSN.xml
- /data/data/####/BDILoggerInternalStatusReport.xml
- /data/data/####/BDILoggerSerailNumber.xml
- /data/data/####/ParseOfflineStore
- /data/data/####/ParseOfflineStore-journal
- /data/data/####/WORLD_SHARED.xml
- /data/data/####/api.parse.com.443
- /data/data/####/applicationId
- /data/data/####/cn.nxsbgcy.kopves.xml
- /data/data/####/cn.nxsbgcy.kopves.xml.bak
- /data/data/####/cn.nxsbgcy.kopves;GSID.xml
- /data/data/####/gaClientId
- /data/data/####/installationId
- /data/data/####/lopital.db-journal
- /data/data/####/proc_auxv
- /data/media/####/0_Female_Hair_A.hair
- /data/media/####/1_Female_Hair_B.hair
- /data/media/####/2_Male_Hair_Pearl.hair
- /data/media/####/37b5532ca152634585871600f2b3d3d8.zip
- /data/media/####/3_Male_Hair_Alexios.hair
- /data/media/####/4_Male_NoHair_Bald.hair
- /data/media/####/Angry.anim
- /data/media/####/BeingFunny.anim
- /data/media/####/BigCryingFace.anim
- /data/media/####/Blink.anim
- /data/media/####/BullyLaugh.anim
- /data/media/####/Default_3.head
- /data/media/####/Default_5.head
- /data/media/####/Dosing.anim
- /data/media/####/EyebrowWave.anim
- /data/media/####/Goforit.anim
- /data/media/####/HAHAHA.anim
- /data/media/####/Innocent.anim
- /data/media/####/Laugh.anim
- /data/media/####/MegaAngry.anim
- /data/media/####/MovingEars.anim
- /data/media/####/Nio.info
- /data/media/####/Nio_Angry.emt
- /data/media/####/Nio_BigCryingFace.emt
- /data/media/####/Nio_BullyLaugh.emt
- /data/media/####/Nio_EyebrowWave.emt
- /data/media/####/Nio_MegaAngry.emt
- /data/media/####/Nio_MovingEars.emt
- /data/media/####/Nio_Please.emt
- /data/media/####/Nio_Shocked.emt
- /data/media/####/Nio_Shy.emt
- /data/media/####/Nio_Smilyface.emt
- /data/media/####/Nio_Sorry_global.emt
- /data/media/####/Nio_Yawn.emt
- /data/media/####/Ooops.anim
- /data/media/####/Please.anim
- /data/media/####/Shocked.anim
- /data/media/####/Shy.anim
- /data/media/####/Smilyface.anim
- /data/media/####/Sorry_global.anim
- /data/media/####/What.anim
- /data/media/####/Yawn.anim
- /data/misc/####/primary.prof
- /data/user_de/####/librs.stackblur.so
- /data/user_de/####/stackblur.bc
- /data/user_de/####/stackblur.o
Miscellaneous:
Executes the following shell scripts:
- /system/bin/bcc -unroll-runtime -scalarize-load-store -rs-global-info -rs-global-info-skip-constant -o stackblur -output_path /data/user_de/0/<Package>/code_cache/com.android.renderscript.cache -bclib /system/lib/libclcore_x86.bc -mtriple i686-unknown-linux -O 3 -fPIC -embedRSInfo /data/user_de/0/<Package>/code_cache/com.android.renderscript.cache/stackblur.bc -build-checksum 212895f7
- /system/bin/ld.mc -shared -nostdlib /system/lib/libcompiler_rt.so -mtriple=i686-unknown-linux --library-path=/system/vendor/lib --library-path=/system/lib -lRSDriver -lm -lc /data/user_de/0/<Package>/code_cache/com.android.renderscript.cache/stackblur.o -o /data/user_de/0/<Package>/code_cache/com.android.renderscript.cache/librs.stackblur.so
Loads the following dynamic libraries:
- libFaceReconstruction
- libFaceReconstructionSDK_jni
- libencryptUtil
- librs.stackblur
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-PKCS5Padding
- DES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
