Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.254.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) p####.s####.meiba####.com:80
- TCP(HTTP/1.1) img.meiba####.com:80
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) digital####.google####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) rr13---####.g####.com:443
- TCP(TLS/1.2) digital####.google####.com:443
- TCP(TLS/1.2) connect####.gst####.com:443
- UDP digital####.google####.com:443
DNS requests:
- and####.a####.go####.com
- and####.cli####.go####.com
- and####.google####.com
- api.dou####.com
- connect####.gst####.com
- digital####.google####.com
- img.meiba####.com
- md####.google####.com
- p####.google####.com
- p####.s####.meiba####.com
- pla####.google####.com
- pla####.googleu####.com
- rr13---####.g####.com
- www.google####.com
- www.s####.net
- www.s####.net.####.8
HTTP GET requests:
- img.meiba####.com/bidou/covers/1.jpg?_=####
- img.meiba####.com/bidou/covers/12.jpg?_=####
- img.meiba####.com/bidou/covers/13.jpg?_=####
- img.meiba####.com/bidou/covers/15.jpg?_=####
- img.meiba####.com/bidou/covers/16.jpg?_=####
- img.meiba####.com/bidou/covers/17.jpg?_=####
- img.meiba####.com/bidou/covers/19.jpg?_=####
- img.meiba####.com/bidou/covers/21.jpg?_=####
- img.meiba####.com/bidou/covers/22.jpg?_=####
- img.meiba####.com/bidou/covers/23.jpg?_=####
- img.meiba####.com/bidou/covers/24.jpg?_=####
- img.meiba####.com/bidou/covers/26.jpg?_=####
- img.meiba####.com/bidou/covers/28.jpg?_=####
- img.meiba####.com/bidou/covers/29.jpg?_=####
- img.meiba####.com/bidou/covers/3.jpg?_=####
- img.meiba####.com/bidou/covers/30.jpg?_=####
- img.meiba####.com/bidou/covers/31.jpg?_=####
- img.meiba####.com/bidou/covers/32.jpg?_=####
- img.meiba####.com/bidou/covers/33.jpg?_=####
- img.meiba####.com/bidou/covers/34.jpg?_=####
- img.meiba####.com/bidou/covers/35.jpg?_=####
- img.meiba####.com/bidou/covers/36.jpg?_=####
- img.meiba####.com/bidou/covers/37.jpg?_=####
- img.meiba####.com/bidou/covers/38.jpg?_=####
- img.meiba####.com/bidou/covers/39.jpg?_=####
- img.meiba####.com/bidou/covers/40.jpg?_=####
- img.meiba####.com/bidou/covers/41.jpg?_=####
- img.meiba####.com/bidou/covers/42.jpg?_=####
- img.meiba####.com/bidou/covers/43.jpg?_=####
- img.meiba####.com/bidou/covers/44.jpg?_=####
- img.meiba####.com/bidou/covers/45.jpg?_=####
- img.meiba####.com/bidou/covers/46.jpg?_=####
- img.meiba####.com/bidou/covers/47.jpg?_=####
- img.meiba####.com/bidou/covers/48.jpg?_=####
- img.meiba####.com/bidou/covers/49.jpg?_=####
- img.meiba####.com/bidou/covers/5.jpg?_=####
- img.meiba####.com/bidou/covers/50.jpg?_=####
- img.meiba####.com/bidou/covers/51.jpg?_=####
- img.meiba####.com/bidou/covers/52.jpg?_=####
- p####.s####.meiba####.com/index?uuid=####&callback=####&_=####
- p####.s####.meiba####.com/start.gif?v=####&c=####&u=####&t=####&model=##...
HTTP POST requests:
- p####.s####.meiba####.com/update
File system changes:
Creates the following files:
- /data/data/####/00b8e6e3ae9254d4_0
- /data/data/####/09fb2909964385a1_0
- /data/data/####/0b7f3d8228981371_0
- /data/data/####/18c148580736f1c5_0
- /data/data/####/1e38761a6d9f811e_0
- /data/data/####/1e78802ebf7ffe63_0
- /data/data/####/216433a7388bba78_0
- /data/data/####/242ed80f3f0f8336_0
- /data/data/####/2688d3d7ecbe1514_0
- /data/data/####/2becf8a6da7d80e9_0
- /data/data/####/30b4f82a531979d2_0
- /data/data/####/3168bd1cb0b8bbaa_0
- /data/data/####/360855cff5c61b09_0
- /data/data/####/3bfff5a206332855_0
- /data/data/####/3cbdfe55c4711f6c_0
- /data/data/####/4a58cfeda00138ed_0
- /data/data/####/4ab80829d85a526b_0
- /data/data/####/4ab80829d85a526b_1
- /data/data/####/4e906cbbda7c05c9_0
- /data/data/####/551ac723098e9257_0
- /data/data/####/575ca564f857eed0_0
- /data/data/####/57976ed6be970e7c_0
- /data/data/####/5f3b35a058ec2a17_0
- /data/data/####/6130875b6b96e6af_0
- /data/data/####/62fd379727ce9276_0
- /data/data/####/75b18784ff725824_0
- /data/data/####/7c7ed6189e59e912_0
- /data/data/####/88241e49d0caaf7c_0
- /data/data/####/884c8ac329dddf3b_0
- /data/data/####/8d8bf68dd4d6c6fd_0
- /data/data/####/9be7d1f254e1178e_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a323bb349e1e310d_0
- /data/data/####/a411ef5edf36bbfc_0
- /data/data/####/a8a8dd0ddf30c813_0
- /data/data/####/b1cca5d7a23afab5_0
- /data/data/####/b87ad6f0d3a94ddd_0
- /data/data/####/b9d7782bf28a6cd9_0
- /data/data/####/c14696f4855f7428_0
- /data/data/####/c6077f94e972cd48_0
- /data/data/####/c6077f94e972cd48_1
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.meibaoapp.ciushine.apk
- /data/data/####/com.meibaoapp.ciushine.dex
- /data/data/####/com.meibaoapp.ciushine.dex.flock (deleted)
- /data/data/####/com.meibaoapp.ciushine_preferences.xml
- /data/data/####/d25829acb8f8735d_0
- /data/data/####/d67a339b74bf0157_0
- /data/data/####/d7064fd481fe0d63_0
- /data/data/####/ee1e06bf304066da_0
- /data/data/####/f3fcd5dd64f76571_0
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjpush217
- libmanager
Uses the following algorithms to decrypt data:
- AES
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
