Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.589.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ssl.p.jw####.com:80
- TCP(HTTP/1.1) stat####.face####.com:80
- TCP(HTTP/1.1) cdn.app.q####.####.com:80
- TCP(HTTP/1.1) jw####.com:80
- TCP(HTTP/1.1) a####.r####.com:80
- TCP(HTTP/1.1) usa####.org:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) con####.face####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) fcm####.go####.com:443
- TCP(TLS/1.0) img-9ga####.9c####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) stat####.face####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) cm.g.doublec####.net:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) ip####.io:443
- TCP(TLS/1.0) i.y####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) adser####.go####.com:443
DNS requests:
- a####.r####.com
- adser####.go####.com
- adser####.go####.nl
- cdn.app.q####.top
- cm.g.doublec####.net
- con####.face####.net
- f####.google####.com
- f####.gst####.com
- fcm####.go####.com
- fcm####.you####.com
- g####.a3c####.net
- googl####.g.doublec####.net
- i.y####.com
- img-9ga####.9c####.com
- ip####.io
- jw####.com
- p####.q####.top
- pag####.googles####.com
- s####.g.doublec####.net
- ssl.p.jw####.com
- st####.xx.f####.net
- stat####.face####.com
- tpc.googles####.com
- usa####.org
- www.face####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
HTTP GET requests:
- cdn.app.q####.####.com/sfile/b137
- cdn.app.q####.####.com/sfile/spy7
- con####.face####.net/vi_VN/sdk.js
- jw####.com/v1/jwplayer6/ping.gif?h=1645135487&e=e&tv=2.20.2&n=9114845672...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20180327/r20170110/show_ads_impl.js
- ssl.p.jw####.com/player/v/7.10.2/jw-icons.ttf
- ssl.p.jw####.com/player/v/7.10.2/jwpsrv.js
- ssl.p.jw####.com/player/v/7.10.2/polyfills.intersection-observer.js
- ssl.p.jw####.com/player/v/7.10.2/polyfills.promise.js
- ssl.p.jw####.com/player/v/7.10.2/polyfills.vttrenderer.js
- ssl.p.jw####.com/player/v/7.10.2/provider.html5.js
- ssl.p.jw####.com/player/v/7.10.2/related.js
- stat####.face####.com/connect/xd_arbiter/r/FdM1l_dpErI.js?version=####
- usa####.org/jwplayer-7.10.2/jwplayer.js
- usa####.org/progressive/img/logo-128x128.png
- usa####.org/progressive/service-worker-registration.js?v=####
- usa####.org/public/js/all2.js?v=####
- usa####.org/public/js/gooima.js
- usa####.org/public/skin/bg-headline-title.png
- usa####.org/public/skin/bg-headline.png
- usa####.org/public/skin/btn-next.png
- usa####.org/public/skin/btn-prev.png
- usa####.org/public/skin/icon-menu.png
- usa####.org/public/skin/icon-search.png
- usa####.org/public/skin/icon-video-tiny.png
- usa####.org/public/skin/icon-video.png
- usa####.org/public/skin/icon.png
- usa####.org/public/skin/logo.png
- usa####.org/public/skin/transparent.png
- usa####.org/video/video-fridayyyy?utm_campaign=####&utm_source=####&utm_...
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=1&_v=j66&a=369604055&t=adtiming&_s=2&dl=ht...
- www.google-####.com/r/collect?v=1&_v=j66&a=369604055&t=pageview&_s=1&dl=...
HTTP POST requests:
- a####.r####.com/adlic
Modified file system:
Creates the following files:
- /data/data/####/1489418796403.jar
- /data/data/####/1489418796403.tmp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/CachedGeoposition.db
- /data/data/####/CachedGeoposition.db-journal
- /data/data/####/admob.xml
- /data/data/####/ar.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dsi.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/ff.xml
- /data/data/####/google_ads_flags_meta.xml
- /data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/isfirst.xml
- /data/data/####/spy7.jar
- /data/data/####/spy7.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/x_h.db-journal
- /data/media/####/.nomedia
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.
