Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) sf1-ttc####.ps####.com.####.com:80
- TCP(TLS/1.0) and####.b####.qq.com:443
- TCP(TLS/1.0) rr6---s####.g####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) sdk.qzbon####.com:443
- TCP(TLS/1.0) pre####.apptian####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) rr5---s####.g####.com:443
- TCP(TLS/1.0) scma####.py####.com.####.cn:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 2####.85.233.138:443
- TCP(TLS/1.2) md####.google####.com:443
- TCP(TLS/1.2) connect####.gst####.com:443
- UDP www.google####.com:443
- UDP md####.google####.com:443
- TCP x####.cdn.bc####.####.com:443
DNS requests:
- and####.b####.qq.com
- and####.cli####.go####.com
- connect####.gst####.com
- digital####.google####.com
- md####.google####.com
- pla####.google####.com
- pla####.googleu####.com
- pre####.apptian####.com
- rr5---s####.g####.com
- rr6---s####.g####.com
- s####.py####.com
- scma####.py####.com
- sdk.qzbon####.com
- sf1-ttc####.ps####.com
- tj.apphaiw####.com
- www.google####.com
- x####.cdn.bc####.com
HTTP GET requests:
- pre####.apptian####.com:443/catalog/8/1.json
- scma####.py####.com.####.cn:443/StaticFiles/NewHotBook.html
- scma####.py####.com.####.cn:443/ver9/base/fontlist_new.html
- scma####.py####.com.####.cn:443/ver9/base/rd_bg_conf.html
- sdk.qzbon####.com:443/ver9/36mh/sdk/v9_36mh2_jh_conf2.html
- sf1-ttc####.ps####.com.####.com/obj/novel-common/font_300_hyxrws_1.zip
HTTP POST requests:
- and####.b####.qq.com:443/rqd/async?aid=####
File system changes:
Creates the following files:
- /data/data/####/.jg.ac
- /data/data/####/1004
- /data/data/####/BUGLY_COMMON_VALUES.xml
- /data/data/####/JW_BOOK_3.db-journal
- /data/data/####/TEfqHDrhakre (deleted)
- /data/data/####/bugly_db_-journal
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/crashrecord.xml
- /data/data/####/libjiagu_64.so
- /data/data/####/local_crash_lock
- /data/data/####/meta-data.xml
- /data/data/####/native_record_lock
- /data/data/####/native_record_lock (deleted)
- /data/data/####/proc_auxv
- /data/data/####/sxvfBjqSrxvd (deleted)
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/media/####/._category_mh.html
- /data/media/####/._category_novel.html
- /data/media/####/._local_index.html
- /data/media/####/._scmh_jx.html
- /data/media/####/._scmh_jx2.html
- /data/media/####/._scmh_lady.html
- /data/media/####/._scmh_man.html
- /data/media/####/._scxs_jx.html
- /data/media/####/._scxs_jx2.html
- /data/media/####/._scxs_lady.html
- /data/media/####/._scxs_man.html
- /data/media/####/._shudan_man_mh_new_1.html
- /data/media/####/._shudan_man_new_1.html
- /data/media/####/._top_man_hot_week_1.html
- /data/media/####/._top_man_mh_hotw_1.html
- /data/media/####/1.zip
- /data/media/####/category_mh.html
- /data/media/####/category_novel.html
- /data/media/####/font_300_hyxrws.ttf
- /data/media/####/font_300_hyxrws_1.zip (deleted)
- /data/media/####/local_index.html
- /data/media/####/scmh_jx.html
- /data/media/####/scmh_jx2.html
- /data/media/####/scmh_lady.html
- /data/media/####/scmh_man.html
- /data/media/####/scxs_jx.html
- /data/media/####/scxs_jx2.html
- /data/media/####/scxs_lady.html
- /data/media/####/scxs_man.html
- /data/media/####/shudan_man_mh_new_1.html
- /data/media/####/shudan_man_new_1.html
- /data/media/####/top_man_hot_week_1.html
- /data/media/####/top_man_mh_hotw_1.html
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- /system/bin/sh -c getprop
- getprop
Loads the following dynamic libraries:
- libBugly-ext
- libCryptDesManager
- libjiagu_64
- libmmkv
- libsecsdk
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- desede-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Accesses the ITelephony private interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
