Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.300.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
- TCP(HTTP/1.1) bbq.aa####.cn:80
- TCP(HTTP/1.1) tin####.c####.l####.####.com:80
- TCP(HTTP/1.1) st####.x####.com:80
- TCP(TLS/1.0) 1####.194.222.95:443
- TCP(TLS/1.0) weiboi####.g####.sina####.com:443
- TCP(TLS/1.0) def####.duals####.cn.####.com:443
- TCP(TLS/1.0) 2####.85.233.95:443
- TCP(TLS/1.2) 2####.85.233.95:443
- TCP(TLS/1.2) 64.2####.165.101:443
- TCP app-ro####.leanc####.cn:443
- TCP lchtt####.x####.com:443
- UDP 2####.85.233.95:443
DNS requests:
- app-ro####.leanc####.cn
- bbq.aa####.cn
- lc####.xichuan####.com
- lchtt####.x####.com
- log.u####.com
- m####.go####.com
- st####.x####.com
- st####.xichuan####.com
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
HTTP GET requests:
- def####.duals####.cn.####.com:443/bar/get/null/?pcv=####&de=####&mac=###...
- st####.x####.com/1B8973E8-67EA-4826-A1F8-B7E582EF3C76.jpg
- st####.x####.com/46169941-3498-4497-a5a9-65442c85c1a7
- st####.x####.com/49F80675-5BE1-4A99-8941-23FCC35D331D.jpg
- st####.x####.com/4b7ad422-8a42-42d3-9514-4419122e9e2d
- st####.x####.com/558ba5ad-260e-4d2d-bd77-0d49d414b862
- st####.x####.com/6315c9eb-c6d2-4ba2-8bd9-38745ae8d262
- st####.x####.com/99d6cdd2-7c96-47d5-969f-37d6fa5808b6
- st####.x####.com/b0c7485d-4ac4-4950-b416-32e0cb7f0b7a
- st####.x####.com/b33ef7cc-4280-4515-b629-c28790e8e5c1
- st####.x####.com/be6721f0-831f-4dbd-98ce-b6e30417c5cc
- st####.x####.com/c602a26e-342c-4f68-bc21-cc9655fedabc
- st####.x####.com/d96a1321-13e6-4d82-986f-a2900e9f1dfc
- st####.x####.com/fd7977c9-c13a-406c-951f-bc904d1e72d5
- tin####.c####.l####.####.com/c3b740afe0edc90abe7e.png?imageVi####
- tin####.c####.l####.####.com/iwPveiKlVdv0EUHL9nno7qz9z613pVFc/TSbook.jpg...
- tin####.c####.l####.####.com/yCu41OsKLcSqGzBDzh6FOz19j8LVqT6m/TSCbook.jp...
- tin####.c####.l####.####.com/zARlP4dRsEPVo8IKMVKDDcOshNTtoVcF/SCbook.jpg...
- weiboi####.g####.sina####.com/13FA478C-5444-419F-9188-63576688D88F.jpg?x...
- weiboi####.g####.sina####.com/5cfd46cd-9fde-433d-90f7-de8e7568cd91.jpg?x...
- weiboi####.g####.sina####.com:443/large/002taFs3ly1gudvms1wyvj60u0159jty...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gc2yerroe2j207v0bbaaj...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gc2yfsuldvj20m80xcah8...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gc2ygaf7fxj20u0190u0y...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gc2ylt43aej21mc0p043q...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gdvdjafwiuj207g0avjrx...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gtjm8drwokj20go0tn76w...
- weiboi####.g####.sina####.com:443/large/86e78dafly1gtjm92mux9j20go0qbt9y...
- weiboi####.g####.sina####.com:443/large/86e78dafly1h2p0toqupnj208c0etdh9...
- weiboi####.g####.sina####.com:443/large/86e78dafly1h3ra2s8j0qj212w0ijdif...
HTTP POST requests:
- bbq.aa####.cn/classes.dex
File system changes:
Creates the following files:
- /data/data/####/.cl
- /data/data/####/.jg.ic
- /data/data/####/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- /data/data/####/ObjSharedPrefs.xml
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/classes.oat
- /data/data/####/com.avos.avoscloud.approuter.9pq709je4y36ubi10x...44.xml
- /data/data/####/com.avos.avoscloud.approuter.9pq709je4y36ubi10x...ml.bak
- /data/data/####/com.hustzp.com.xichuangzhu_preferences.xml
- /data/data/####/com.hustzp.com.xichuangzhu_preferences.xml.bak
- /data/data/####/firstLogin.xml
- /data/data/####/libjiagu.so
- /data/data/####/share.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_socialize.xml
- /data/data/####/umeng_zero_cache.db
- /data/data/####/umeng_zero_cache.db-journal
- /data/media/####/.nomedia
- /data/media/####/002taFs3ly1gudvms1wyvj60u0159jty02.jpg
- /data/media/####/15t9jwgodyl6uv0h45zuo0dda0.tmp
- /data/media/####/19nt7u4oucj8o45gcr7cma4t40.tmp
- /data/media/####/1q93ei14odwgt4jge9v0jbxom0.tmp
- /data/media/####/1zx1rilkzphr5ik6dl1z59wre0.tmp
- /data/media/####/205cszfudlp6m5x6a1yc7zn460.tmp
- /data/media/####/2guy6sg5ji9ohbwiwktomshsj0.tmp
- /data/media/####/2j6nvgrls7jcpibaax4gjs3mi0.tmp
- /data/media/####/355p3vvxfr15ajoyybn17ufr20.tmp
- /data/media/####/36m2do0pzg8bl5zupaehdppnf0.tmp
- /data/media/####/38r82frw2c3hapiwpd54vbuke0.tmp
- /data/media/####/3921kppmgklsdtsjvp2za89rn0.tmp
- /data/media/####/3iwlzsh93mhdit8t0vydxmkw20.tmp
- /data/media/####/3nxsmizc84yv9lfs5ggwxzd8a0.tmp
- /data/media/####/44oa65fz37pw5x239qbnbkene0.tmp
- /data/media/####/47thcv2qwe0v1z383j5tq90n00.tmp
- /data/media/####/4vzbeteohlnavgryft83y80900.tmp
- /data/media/####/57uy805zgoxio1cx8nf4zp62v0.tmp
- /data/media/####/5abc5f7aafed5421bbc520cfc9f0e2d235057920cf02a6...7ec6.0
- /data/media/####/5kvd2yps1na7jh7moq8ia12ei0.tmp
- /data/media/####/66e0611ff8cdd07b7f817b61400109ae45bc02c690f32b....0.tmp
- /data/media/####/675tjg7ywdiyaar3q1murglnl0.tmp
- /data/media/####/6n1kpvpz0viqart7305asu0he0.tmp
- /data/media/####/6nboq2qnn53kchi01rp098w160.tmp
- /data/media/####/711prvchik6td7ub7za5s3ex90.tmp
- /data/media/####/73lkpl9q8jf4jordk76bk8s5z0.tmp
- /data/media/####/8e4pmt43c4u35a8ipr5aq5xw0.tmp
- /data/media/####/cu040y4ow8fen2q3tbi9d3rb0.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/rl1amwwrpw17s9qh997k5x040.tmp
- /data/media/####/xcz_150.db
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
