Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) r####.adsna####.com:80
- TCP(HTTP/1.1) m.addthis####.com:80
- TCP(HTTP/1.1) mbs.ldgagaw####.com:80
- TCP(HTTP/1.1) st####.adsna####.com:80
- TCP(HTTP/1.1) s7.add####.com:80
- TCP(HTTP/1.1) xianxia####.di####.com:80
- TCP(HTTP/1.1) m.xianxia####.net:80
- TCP(HTTP/1.1) m####.disqu####.com:80
- TCP(HTTP/1.1) api.adsna####.com:80
- TCP(HTTP/1.1) c####.jq####.com:80
- TCP(HTTP/1.1) verak####.com:80
- TCP(HTTP/1.1) disqu####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) s####.srv.stacka####.com:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) ap####.mobi:80
- TCP(HTTP/1.1) www.xianxia####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) refe####.di####.com:443
- TCP(TLS/1.0) c.disqu####.com:443
- TCP(TLS/1.0) a.disqu####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) di####.com:443
- TCP(TLS/1.0) btt####.com:443
- TCP(TLS/1.0) digital####.com:443
- TCP(TLS/1.0) xianxia####.di####.com:443
- TCP(TLS/1.0) www.story####.net:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) r####.adsna####.com:443
- TCP(TLS/1.0) s####.outb####.com:443
DNS requests:
- a####.google####.com
- a####.u####.com
- a.disqu####.com
- ap####.mobi
- api.adsna####.com
- btt####.com
- c####.jq####.com
- c.disqu####.com
- di####.com
- digital####.com
- disqu####.com
- googl####.g.doublec####.net
- m####.disqu####.com
- m.add####.com
- m.addthis####.com
- m.xianxia####.net
- mbs.ldgagaw####.com
- offer####.online
- pag####.googles####.com
- r####.adsna####.com
- refe####.di####.com
- s####.outb####.com
- s####.srv.stacka####.com
- s7.add####.com
- st####.adsna####.com
- verak####.com
- www.google-####.com
- www.story####.net
- www.xianxia####.net
- xianxia####.di####.com
HTTP GET requests:
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20170918/r20170110/show_ads_impl.js
- st####.adsna####.com/static/js/render.v2.js
- www.google-####.com/analytics.js
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/ads-1988482097.jar
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/-1819277931
- <Package Folder>/files/####/580037954
- <Package Folder>/files/####/63560145
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/engines
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/46bd456abbbf79e43a366cf0575835e0.0.tmp
- <SD-Card>/Android/####/50a4e5b1576b6168e8ed02eed7ddce26.0.tmp
- <SD-Card>/Android/####/5e1b8d3cb9e662fe15da5f77d08d49d8.0.tmp
- <SD-Card>/Android/####/63b6a5eeba8cc1ebb112a6254af30deb.0.tmp
- <SD-Card>/Android/####/80e98a6479b282bfee2fd26e6cf35ee5.0.tmp
- <SD-Card>/Android/####/b0f82f210db1da667a0c1cecdb313f35.0.tmp
- <SD-Card>/Android/####/f518e51136838b80d4fd16931e37673e.0.tmp
- <SD-Card>/Android/####/journal (deleted)
- <SD-Card>/Android/####/journal.bkp (deleted)
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/journal.tmp (deleted)
- <SD-Card>/Download/FrameworkList.xml
- <SD-Card>/Download/WinFXList.xml
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/files/engines
- ps engines
- sh
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- desede-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- desede-ECB-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
