Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.570.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ff.t####.com.####.com:80
- TCP(HTTP/1.1) 1####.w####.cname####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) m.5####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) jss.j####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP y1.ey####.com:7073
- TCP y1.ey####.com:7072
- TCP y1.ey####.com:7071
DNS requests:
- adser####.go####.com
- c####.mm####.com
- c.c####.com
- dy####.com
- ff.t####.com
- h####.c####.com
- jss.j####.com
- l####.tbs.qq.com
- m.5####.com
- s6.c####.com
- ssl.gst####.com
- www.5####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
- y1.ey####.com
- y2.ey####.com
- y3.ey####.com
HTTP GET requests:
- 1####.w####.cname####.com/gx.php
- ff.t####.com.####.com/d/44rx.png
- m.5####.com/
- m.5####.com/favicon.ico
- m.5####.com/movie/dongzuo/
- m.5####.com/movie/dongzuo/[videolist:link]
- m.5####.com/pic/nopic.gif
- m.5####.com/pic/uploadimg/2016-1/201611117313920836.jpg
- m.5####.com/pic/uploadimg/2016-3/73731.jpg
- m.5####.com/pic/uploadimg/2017-12/79775.jpg
- m.5####.com/pic/uploadimg/2017-12/79776.jpg
- m.5####.com/pic/uploadimg/2017-12/79786.jpg
- m.5####.com/pic/uploadimg/2017-12/79789.jpg
- m.5####.com/pic/uploadimg/2017-12/79849.jpg
- m.5####.com/pic/uploadimg/2017-12/79893.jpg
- m.5####.com/pic/uploadimg/2017-12/80354.jpg
- m.5####.com/pic/uploadimg/2017-12/80634.jpg
- m.5####.com/pic/uploadimg/2018-4/82205.jpg
- m.5####.com/pic/uploadimg/2018-4/82344.jpg
- m.5####.com/pic/uploadimg/2018-5/50535.jpg
- m.5####.com/pic/uploadimg/2018-5/79330.jpg
- m.5####.com/pic/uploadimg/2018-5/80670.jpg
- m.5####.com/pic/uploadimg/2018-5/80910.jpg
- m.5####.com/pic/uploadimg/2018-5/81525.jpg
- m.5####.com/pic/uploadimg/2018-5/81562.jpg
- m.5####.com/pic/uploadimg/2018-5/81636.jpg
- m.5####.com/pic/uploadimg/2018-5/81664.jpg
- m.5####.com/pic/uploadimg/2018-5/81755.jpg
- m.5####.com/pic/uploadimg/2018-5/82126.jpg
- m.5####.com/pic/uploadimg/2018-5/82234.jpg
- m.5####.com/pic/uploadimg/2018-5/82308.jpg
- m.5####.com/pic/uploadimg/2018-5/82380.jpg
- m.5####.com/pic/uploadimg/2018-5/82381.jpg
- m.5####.com/pic/uploadimg/2018-5/82410.jpg
- m.5####.com/pic/uploadimg/2018-5/82507.jpg
- m.5####.com/pic/uploadimg/2018-5/82552.jpg
- m.5####.com/pic/uploadimg/2018-5/82564.jpg
- m.5####.com/pic/uploadimg/2018-5/82569.jpg
- m.5####.com/pic/uploadimg/2018-5/82576.jpg
- m.5####.com/pic/uploadimg/2018-5/82578.jpg
- m.5####.com/pic/uploadimg/2018-5/82579.jpg
- m.5####.com/pic/uploadimg/2018-5/82580.jpg
- m.5####.com/pic/uploadimg/2018-5/82582.jpg
- m.5####.com/pic/uploadimg/2018-5/82583.jpg
- m.5####.com/pic/uploadimg/2018-5/82584.jpg
- m.5####.com/pic/uploadimg/2018-5/82585.jpg
- m.5####.com/pic/uploadimg/2018-5/82586.jpg
- m.5####.com/template/mxf/images/logo.png
- m.5####.com/template/mxf/images/search.png
- m.5####.com/template/mxf/images/style.css
- m.5####.com/xdb-ad/db.js
- m.5####.com/xdb-ad/tj.js
HTTP POST requests:
- l####.tbs.qq.com/ajax?c=####&k=####
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
Modified file system:
Creates the following files:
- /data/data/####/001.jar
- /data/data/####/356507059351895yd.db-journal
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/WebpageIcons.db-journal
- /data/data/####/aypa0000.xml
- /data/data/####/aypb0000.xml
- /data/data/####/aypc0000.xml
- /data/data/####/ayqa0000.xml
- /data/data/####/ayqb0000.xml
- /data/data/####/core_info
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/index
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_config.xml.bak
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yysa.xml
- /data/data/####/yysa356507059351895.xml
- /data/data/####/yysb356507059351895.xml
- /data/data/####/yysc356507059351895.xml
- /data/media/####/.nomedia
- /data/media/####/44rx.png.tmp
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- cstrw3450ypguiljkcgdue564
Uses the following algorithms to encrypt data:
- DESede-ECB-PKCS5Padding
- RSA-ECB-NoPadding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
