Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.1274.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) rr7---s####.g####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) ot####.be####.qq.com:443
- TCP(TLS/1.0) down####.we####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) a####.qq.com:443
- TCP(TLS/1.0) d####.g####.com.####.com:443
- TCP(TLS/1.0) cd####.cn.te####.####.com:443
- TCP(TLS/1.0) h5.q####.qq.com:443
- TCP(TLS/1.0) qzones####.mid.td####.com:443
- TCP(TLS/1.0) s####.we####.com:443
- TCP(TLS/1.0) img.we####.com.####.com:443
- TCP(TLS/1.0) 64.2####.165.94:443
- TCP(TLS/1.0) c####.tc.qq.com:443
- TCP(TLS/1.0) pin####.qq.com:443
- TCP(TLS/1.0) rr5---s####.g####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.2) 64.2####.165.94:443
- TCP(TLS/1.2) and####.google####.com:443
DNS requests:
- a####.qq.com
- and####.a####.go####.com
- and####.google####.com
- cd####.cn
- d####.g####.com
- down####.we####.com
- h5.q####.qq.com
- img.we####.com
- m####.go####.com
- ot####.be####.qq.com
- p####.google####.com
- pi####.qq.com
- pin####.qq.com
- pla####.google####.com
- qzones####.g####.cn
- re####.hu####.qq.####.8
- re####.hu####.qq.com
- rr5---s####.g####.com
- rr5---s####.g####.com
- rr7---s####.g####.com
- s####.we####.com
HTTP GET requests:
- s####.we####.com:443/03o4KuAZ
- s####.we####.com:443/zyG66gqG
File system changes:
Creates the following files:
- /data/data/####/000001.dbtmp
- /data/data/####/02e7041bb849ca67_0
- /data/data/####/1dc12fb46567c800_0
- /data/data/####/1dc12fb46567c800_1
- /data/data/####/222e887ca1818023_0
- /data/data/####/2587d41854faedd9_0
- /data/data/####/2587d41854faedd9_1
- /data/data/####/276c66f221e79e29_0
- /data/data/####/3983700a08beaa51_0
- /data/data/####/3a7766c158398ec1_0
- /data/data/####/3b2c677ab6e3a939_0
- /data/data/####/3b2c677ab6e3a939_1
- /data/data/####/447c8b2554cca1d8_0
- /data/data/####/4a530e4f317e235c_0
- /data/data/####/4c7d9f41481a7e54_0
- /data/data/####/4ff196c8c3d43791_0
- /data/data/####/5269eb8237071491_0
- /data/data/####/526ce90695e1c2b9_0
- /data/data/####/55c177c61cd82e0b_0
- /data/data/####/5a2611c03662a60b_0
- /data/data/####/6f7adfa7b3ef9380_0
- /data/data/####/752bafe53ebabc56_0
- /data/data/####/752bafe53ebabc56_1
- /data/data/####/7f30a0b499414e03_0
- /data/data/####/8f9e42ac91cadec9_0
- /data/data/####/8f9e42ac91cadec9_1
- /data/data/####/93e77404a4e8b0c8_0
- /data/data/####/93e77404a4e8b0c8_1
- /data/data/####/9559b1137e7bb817_0 (deleted)
- /data/data/####/Cookies-journal
- /data/data/####/Databases.db-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/MacbWMXUkuiZ (deleted)
- /data/data/####/QuotaManager-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/ab0546664d87bd6a_0
- /data/data/####/b5cc147c17f4fe40_0
- /data/data/####/bfb97cba49049480_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/com.gjyhds_preferences.xml
- /data/data/####/d21c972ef22f38fb_0 (deleted)
- /data/data/####/ddfecda3b850d8c3_0
- /data/data/####/e301400c74572aa1_0
- /data/data/####/e7137e070112c407_0
- /data/data/####/e9faae51de2dc37e_0
- /data/data/####/getAndroidData.dex
- /data/data/####/getAndroidData.dex.flock (deleted)
- /data/data/####/getAndroidData.jar
- /data/data/####/https_share.weiyun.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/rVrunvSrrlZo (deleted)
- /data/data/####/the-real-index
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
- libluajava
- libygsiyu
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about installed apps.
Displays its own windows over windows of other apps.
