Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.743.origin
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) 4####.92.21.13:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) cdn.app.fr####.top:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) large####.c####.l####.####.com:80
- TCP(HTTP/1.1) t####.b####.com:80
- TCP(HTTP/1.1) fc-####.cdn.bc####.####.com:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) hiph####.wsh####.com:80
- TCP(TLS/1.0) 1####.239.211.92:443
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) hiph####.wsh####.com:443
- TCP(TLS/1.0) tb1.bdst####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) t####.b####.com:443
- TCP(TLS/1.0) ssls####.jom####.com:443
- TCP(TLS/1.0) n####.t####.top:443
- TCP(TLS/1.0) pass####.b####.com:443
- TCP(TLS/1.0) g####.b####.com:443
- UDP 1####.168.111.254:4466
DNS requests:
- a####.u####.com
- au.u####.co
- au.u####.com
- cdn.app.fr####.top
- cdn.img.fly####.top
- fc-####.cdn.bc####.com
- g####.b####.com
- g####.bdst####.com
- hiph####.b####.com
- hm.b####.com
- i####.b####.com
- im####.b####.com
- mo####.b####.com
- n####.t####.top
- nsc####.b####.com
- pass####.b####.com
- pns.al####.com
- proxy####.aliv####.com
- pss.al####.com
- pus.al####.com
- t####.b####.com
- tb1.bdst####.com
- tb2.bdst####.com
HTTP GET requests:
- cdn.app.fr####.top/upload/201811/21/app/20181121113354709.apk
- fc-####.cdn.bc####.####.com/0/pic/669fae1c146117cbc6d0cb1a52a9f1a7.jpg
- fc-####.cdn.bc####.####.com/0/pic/7fbea922e6d1315befa356368289f3ad.jpg
- fc-####.cdn.bc####.####.com/0/pic/88d0fc41f3d747c897bee289962c73a6.jpg
- hiph####.wsh####.com/forum/eWH=720,1280/sign=2e7209955efbb2fb2641251f787...
- hiph####.wsh####.com/forum/pic/item/3a292df5e0fe992555b3f8ff39a85edf8cb1...
- hiph####.wsh####.com/forum/pic/item/fdfaaf51f3deb48f6a3b3471fd1f3a292cf5...
- large####.c####.l####.####.com/upload/201709/14/img/20170914164519090.png
- large####.c####.l####.####.com/upload/201709/14/img/20170914164520204.png
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
- t####.b####.com/f?kw=####
HTTP POST requests:
- a####.u####.com/app_logs
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/01764449-da8a-448f-98e0-4184c026fcf4
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/beea1a2e-72ef-49ab-a543-34cc6e4281cc.jar
- /data/data/####/cs.xml
- /data/data/####/cxhh.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/index
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/maomaojiao.xml
- /data/data/####/mivmi.xml
- /data/data/####/multidex.version.xml
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pcdnconfigs.xml.bak
- /data/data/####/tmp-com.qidian.QDReader-1.apk.classes-103224502.zip
- /data/data/####/tmp-com.qidian.QDReader-1.apk.classes-1772564325.zip
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_it.cache
- /data/data/####/v.jar
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/3f0ea7e43b6b1
- /data/media/####/55ed89037668e
- /data/media/####/b2e597e42e9356dc753baa5c70a732c2.apk
- /data/media/####/cl.tmp
- /data/media/####/ds.tmp
- /data/media/####/ds.tmp (deleted)
- /data/media/####/myself.dat
Miscellaneous:
Executes the following shell scripts:
- chmod 777 /storage/emulated/0/spxin/b2e597e42e9356dc753baa5c70a732c2.apk
- ls -l /system/bin/su
Loads the following dynamic libraries:
- bspatch
- libpcdn_acc
- pcdn_acc
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
