Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.127.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) d####.g####.p####.com:80
- TCP(HTTP/1.1) recom####.p####.com:80
- TCP(HTTP/1.1) t####.p####.com:80
- TCP(HTTP/1.1) api.ddp.vip.####.com:80
- TCP(HTTP/1.1) w####.p####.com.####.com:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) apm.su####.cn:80
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(HTTP/1.1) way.p####.com:80
- TCP(HTTP/1.1) api.pass####.p####.com:80
- TCP(TLS/1.0) api.pass####.p####.com:443
DNS requests:
- a####.u####.com
- api####.a####.com
- api.ddp.vip.####.com
- api.pass####.p####.com
- api.usergr####.p####.com
- apm.su####.cn
- cld####.mo####.p####.com
- gro####.p####.com
- i####.pp####.cn
- i####.pp####.cn
- int.d####.s####.####.cn
- ios.syna####.com
- m####.api.p####.com
- recom####.p####.com
- s####.p####.com
- sp####.mo####.p####.com
- sr1.pp####.cn
- sr1.pp####.com
- sr2.pp####.cn
- sr2.pp####.com
- sr3.pp####.cn
- sr3.pp####.com
- sr4.pp####.cn
- t####.p####.com
- v.img.pp####.cn
- way.p####.com
HTTP GET requests:
- api.ddp.vip.####.com/ticket/total?appid=####&username=####&format=####&a...
- api.pass####.p####.com/v3/query/usermessage.do?username=####&appplt=####...
- d####.g####.p####.com/1.html?sdPg0uXTraCSqrOWlrKpmpyoraSSrKeioJawpqmapqW...
- int.d####.s####.####.cn/iplookup/iplookup.php?format=####
- recom####.p####.com/recTopic?uid=####&extraFields=####&rmTopicIds=####&s...
- recom####.p####.com/recommend?uid=####&ppi=####&vipUser=####&num=####&re...
- t####.p####.com/
- t####.p####.com/check_update?platform=####&appplt=####&osv=####&appid=##...
- t####.p####.com/cms/11/05/88b043f06328e438f903e238dd163ba5.jpg
- t####.p####.com/cms/13/54/a4fa25bff1d0ec95ef088c26e50fb2a5.jpg
- t####.p####.com/cms/14/80/6409ec6b387f52d0b4c0fd15164b30de.jpg
- t####.p####.com/cms/14/81/87ae34ca35167d5e9e6fdce2df604144.jpg
- t####.p####.com/cms/15/99/221ca19e93db5d8d8c9ba8a468d20850.jpg.webp
- t####.p####.com/cms/16/27/711f531d4fdd9fca04e94405bd9d6676.jpg
- t####.p####.com/cms/16/35/c66c61fda8eb103aaf86bdf565afa2bc.png
- t####.p####.com/cms/18/10/fa7426723f7614bf947f30f8659c1260.png
- t####.p####.com/cms/19/50/8be57d72356269ba350f6c22180ba113.png
- t####.p####.com/cms/19/92/742cf6fc10870591fc628c72fc47ead5.jpg
- t####.p####.com/cms/23/02/b5936f1997fd8d7e2475b62e0ac947a5.gif
- t####.p####.com/cms/26/52/356e5f1b04633eeae52721b6eb84d2e6.jpg
- t####.p####.com/cms/26/81/11325d0347f8277a0b7e98be8ed21ef2.png
- t####.p####.com/cms/26/82/18251ed2ca0f0b3a7de42206443e5ac3.jpg
- t####.p####.com/cms/27/41/45293ac98c00317afbcba2a5c8180fba.jpg
- t####.p####.com/cms/30/24/deaf67e0375b0c9fb00df6cbf6b44c68.jpg
- t####.p####.com/cms/32/95/ecad0837de81ba3e2d9d38198958794f.jpg
- t####.p####.com/cms/33/13/82cb4b5f0f4ab3e61ec5b1ba0ced57d2.jpg
- t####.p####.com/cms/34/21/4a6362dc2579005cb449f7f7c5188279.jpg
- t####.p####.com/cms/35/30/ea7b216eff091deafa8c5a3f927460fb.jpg
- t####.p####.com/cms/35/88/73b2ef185ab4b12f7262204b94d436b3.gif
- t####.p####.com/cms/37/82/bfeedef1d8e885908b547f85b333852a.gif
- t####.p####.com/cms/38/38/1f98b08d491fe243cf37e9e3a9958793.png
- t####.p####.com/cms/40/32/0137be3ab4a3cd22210e159ecea0f4e8.gif
- t####.p####.com/cms/41/40/b72f78b5fdff8d2f80f039d5e30d42ba.png
- t####.p####.com/cms/43/87/5dda243e9f336fe1c33663fb64336702.gif
- t####.p####.com/cms/48/97/067c16e392ec51f31747b959e01a9cd3.jpg
- t####.p####.com/cms/52/39/988450f24b545b01133cc88205bbbf63.jpg
- t####.p####.com/cms/73/40/1c00bf75cd97d344dfbe3f0acef0493f.jpg
- t####.p####.com/cms/81/08/23ec0b48fd4aa6edaf9fd8f207d08c33.jpg
- t####.p####.com/competition/v1/list
- t####.p####.com/competitionschedule/v1/list?competitionid=####
- t####.p####.com/control?ver=####&userLevel=####&platform=####&osv=####&s...
- t####.p####.com/generalConfig?platform=####&appplt=####&configType=####&...
- t####.p####.com/generalConfig?platform=####&configkey=####&appplt=####&c...
- t####.p####.com/getConfig?ZGV2aWNlaWQ9MzU2NTA3MDU5MzUxODk1JmRldmljZXR5cG...
- t####.p####.com/globalConfig?platform=####&appplt=####&osv=####&appid=##...
- t####.p####.com/images/2017/07/17/12040797364.gif
- t####.p####.com/lpic/03d/3c7/555/319b537694d90ec9e19bdd79ce4ef82b.png?pr...
- t####.p####.com/lpic/34e/8d4/055/697d9911c7de6d1d31edcbe4b7f89ae5.png
- t####.p####.com/lpic/34f/c9c/038/bd2c61f50606c9791897ed5f37db41be.png?pr...
- t####.p####.com/lpic/3b0/72d/a26/b9e831e1ecee0a1c40229b1f1e029462.png?pr...
- t####.p####.com/lpic/711/11c/502/d6c778947ae18f27233fc9acc126139d.png
- t####.p####.com/lpic/82c/237/16e/6f70505a1492e1195264cede267f2c50.png
- t####.p####.com/lpic/bdc/c29/d05/d8a327ea7275ea9dd6bcd3c77bc6578f.png
- t####.p####.com/lpic/beb/ddd/6e9/acbd2ce6346bae749d76fe1ec0adf4f3.png
- t####.p####.com/lpic/ec4/c42/6f2/63862f99377cf076907cb63c4a42a01b.png
- t####.p####.com/lpic/f2b/82c/c6e/9cd0be6d82d7d86627dca7d79a808b8f.png
- t####.p####.com/manual_update?platform=####&appplt=####&osv=####&appid=#...
- t####.p####.com/v4/module?lang=####&platform=####&appid=####&appver=####...
- w####.p####.com.####.com/cms/18/58/ec1c4e42822e782f3e2dd1e555b82d34.png
- w####.p####.com.####.com/cms/40/08/420462a279acbe7b942cfe917564f7bb.png
- w####.p####.com.####.com/cp308/08/8d/088d9faa28a642e61c480e8159246207/15...
- w####.p####.com.####.com/cp308/0d/bb/0dbb7f838b99dc43de322059a000ef0d/15...
- w####.p####.com.####.com/cp308/0e/46/0e460482409bcbeb2926439159245604/15...
- w####.p####.com.####.com/cp308/15/13/1513515f47c53f628dd88973e9952b5b/3....
- w####.p####.com.####.com/cp308/39/14/3914197e0f9d380b7fe6e66d11382b04/3....
- w####.p####.com.####.com/cp308/4f/f4/4ff4d6cc5eaa22e5147b5be80ef96a2e/3....
- w####.p####.com.####.com/cp308/5e/45/5e456780df0a3e0f83eb483b13a5515c/15...
- w####.p####.com.####.com/cp308/64/5a/645a71cdde6e7761778f9dc02ab20013/15...
- w####.p####.com.####.com/cp308/69/60/69606b27fb10bf0527b33d6159251483/15...
- w####.p####.com.####.com/cp308/74/e6/74e62f71bed6494f284675a9288c5b28/15...
- w####.p####.com.####.com/cp308/75/b3/75b3f6a5ec725f7ca399718cbafda69a/15...
- w####.p####.com.####.com/cp308/7a/e5/7ae570235f3cf4a260c215d8d44374ac/15...
- w####.p####.com.####.com/cp308/7f/75/7f758bb4d0c0de91cef72bc943c96ec6/15...
- w####.p####.com.####.com/cp308/8c/53/8c5316846b1502dde78222cb9a9dc49c/15...
- w####.p####.com.####.com/cp308/9f/0f/9f0f708c3d42938d0bb0ff4f6db2bd70/15...
- w####.p####.com.####.com/cp308/9f/de/9fde0cfe72f0df8c85dbcf82e08cf357/15...
- w####.p####.com.####.com/cp308/a6/12/a61280d4e2c2073003d3301102b7cc40/15...
- w####.p####.com.####.com/cp308/b7/65/b765ad1975bbf9310d173207f80c16d1/15...
- w####.p####.com.####.com/cp308/ca/f9/caf9669c63b9a4c2576deec91593e4d4/15...
- w####.p####.com.####.com/cp308/dd/1f/dd1f1ffa102efa75d6b0043b31d28c24/3....
- w####.p####.com.####.com/cp308/e1/44/e14463e212f0935ce2163cbcfbafc532/15...
- w####.p####.com.####.com/cp308/e5/dd/e5dd78c3224a3b9e6edde0f476674c97/15...
- w####.p####.com.####.com/cp308/f0/44/f04440610271ba401a0b02c159249370/15...
- w####.p####.com.####.com/cp308/f3/2c/f32cdfe105630c5f45d0362794106907/15...
- w####.p####.com.####.com/sp342/2008/03/25/16111092795.jpg.webp
- w####.p####.com.####.com/sp342/2008/11/28/17404485745.jpg.webp
- w####.p####.com.####.com/sp342/2014/05/06/13501246237.jpg.webp
- w####.p####.com.####.com/sp342/2014/06/04/17502024243.jpg.webp
- w####.p####.com.####.com/sp342/2015/06/29/16442009994.jpg.webp
- w####.p####.com.####.com/sp342/2015/10/22/16050587815.jpg.webp
- w####.p####.com.####.com/sp342/2016/01/22/14210225592.jpg.webp
- w####.p####.com.####.com/sp342/2016/01/22/14385884645.jpg.webp
- w####.p####.com.####.com/sp342/2016/04/12/15431559015.jpg.webp
- w####.p####.com.####.com/sp342/2016/06/06/10114416833.jpg.webp
- w####.p####.com.####.com/sp342/2016/07/29/11025340412.jpg.webp
- w####.p####.com.####.com/sp342/2016/08/01/10270710719.jpg.webp
- w####.p####.com.####.com/sp342/2016/08/03/16541041592.jpg.webp
- w####.p####.com.####.com/sp342/2016/09/26/17472540273.jpg.webp
- w####.p####.com.####.com/sp342/2016/11/18/02191536287.jpg.webp
- w####.p####.com.####.com/sp342/2017/03/02/14574724094.jpg.webp
- w####.p####.com.####.com/sp342/2017/05/18/16441363829.jpg.webp
- w####.p####.com.####.com/sp342/2017/05/22/09223807065.jpg.webp
- w####.p####.com.####.com/sp342/2017/08/09/13054877397.jpg.webp
- w####.p####.com.####.com/sp342/2017/08/23/18214619263.jpg.webp
- w####.p####.com.####.com/sp342/2017/09/24/14100193674.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/06/14523877449.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/08/12101518116.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/18/14312448442.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/26/16573363281.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/28/18132244186.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/28/18172680837.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/28/18284303397.jpg.webp
- w####.p####.com.####.com/sp342/2017/12/29/17483430258.jpg.webp
- way.p####.com/get/aphone?index=####&appplt=####&ustr=vU####&dstr=Hv####&...
- way.p####.com/getUserCreditDoublePolicy?appid=####&from=####&format=####...
- way.p####.com/pcardInfo/getMonthPcard?username=####&from=####&version=##...
- way.p####.com/public/ppi?appid=####&appplt=####&tk=####&cc=####&appver=#...
- way.p####.com/v6/流风清音/Favorites?version=####&from=####
- way.p####.com/v6/流风清音/Recent?version=####&from=####
- way.p####.com/v7/流风清音/Barrage/all?from=####&version=####&tk=####
HTTP POST requests:
- a####.u####.com/app_logs
- apilo####.a####.com/v3/log/init
- apm.su####.cn/httpSampling.gif
- recom####.p####.com/usertag?uid=####&num=####&vipUser=####&appplt=####&a...
Modified file system:
Creates the following files:
- <Package Folder>/cache/applog.log
- <Package Folder>/databases/_ire-journal
- <Package Folder>/databases/pptv.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/configcenter.txt
- <Package Folder>/files/exitadinfo
- <Package Folder>/files/globalConfig.txt
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/mobclick_agent_cached_<Package>999999999
- <Package Folder>/files/static_config
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/MATSharedPreferences.xml
- <Package Folder>/shared_prefs/USER_BILLING.xml
- <Package Folder>/shared_prefs/cn.com.mma.mobile.tracking.other.xml
- <Package Folder>/shared_prefs/com.suning.statistics.Cloudytrace...ml.bak
- <Package Folder>/shared_prefs/com.suning.statistics.Cloudytrace...or.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/last_know_location.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pptv.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/unicom.xml
- <Package Folder>/shared_prefs/view_from.xml
- <Package Folder>/shared_prefs/webp.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/PPTV/####/-1036967398.tmp
- <SD-Card>/PPTV/####/-1085049267.tmp
- <SD-Card>/PPTV/####/-1166087116
- <SD-Card>/PPTV/####/-1173250089
- <SD-Card>/PPTV/####/-1194227210.tmp
- <SD-Card>/PPTV/####/-119484607.tmp
- <SD-Card>/PPTV/####/-1198530913.tmp
- <SD-Card>/PPTV/####/-1280156338.tmp
- <SD-Card>/PPTV/####/-1362455474.tmp
- <SD-Card>/PPTV/####/-1392706450.tmp
- <SD-Card>/PPTV/####/-1441151610.tmp
- <SD-Card>/PPTV/####/-1441862793.tmp
- <SD-Card>/PPTV/####/-1484680069
- <SD-Card>/PPTV/####/-1608497551.tmp
- <SD-Card>/PPTV/####/-1624000149
- <SD-Card>/PPTV/####/-164568908.tmp
- <SD-Card>/PPTV/####/-1654007276.tmp
- <SD-Card>/PPTV/####/-1681448299
- <SD-Card>/PPTV/####/-1693854143.tmp
- <SD-Card>/PPTV/####/-169517242.tmp
- <SD-Card>/PPTV/####/-1764712775.tmp
- <SD-Card>/PPTV/####/-1818098334.tmp
- <SD-Card>/PPTV/####/-1841300072.tmp
- <SD-Card>/PPTV/####/-1842134284.tmp
- <SD-Card>/PPTV/####/-1855208769.tmp
- <SD-Card>/PPTV/####/-1873951733.tmp
- <SD-Card>/PPTV/####/-1877752018.tmp
- <SD-Card>/PPTV/####/-1880845980
- <SD-Card>/PPTV/####/-1883978257.tmp
- <SD-Card>/PPTV/####/-1901400715.tmp
- <SD-Card>/PPTV/####/-190441864.tmp
- <SD-Card>/PPTV/####/-1917343615
- <SD-Card>/PPTV/####/-1917343619
- <SD-Card>/PPTV/####/-1920326167.tmp
- <SD-Card>/PPTV/####/-1938929229.tmp
- <SD-Card>/PPTV/####/-2006369586.tmp
- <SD-Card>/PPTV/####/-2020577616.tmp
- <SD-Card>/PPTV/####/-2033098391.tmp
- <SD-Card>/PPTV/####/-2046700463.tmp
- <SD-Card>/PPTV/####/-2106605619.tmp
- <SD-Card>/PPTV/####/-2134614834.tmp
- <SD-Card>/PPTV/####/-301649047.tmp
- <SD-Card>/PPTV/####/-311146098.tmp
- <SD-Card>/PPTV/####/-389929846
- <SD-Card>/PPTV/####/-465549933.tmp
- <SD-Card>/PPTV/####/-50650037.tmp
- <SD-Card>/PPTV/####/-532698417.tmp
- <SD-Card>/PPTV/####/-577683169.tmp
- <SD-Card>/PPTV/####/-584164839.tmp
- <SD-Card>/PPTV/####/-605536553
- <SD-Card>/PPTV/####/-645134678.tmp
- <SD-Card>/PPTV/####/-660528491
- <SD-Card>/PPTV/####/-710073089.tmp
- <SD-Card>/PPTV/####/-736216026.tmp
- <SD-Card>/PPTV/####/-786954828
- <SD-Card>/PPTV/####/-787117020
- <SD-Card>/PPTV/####/-830058253
- <SD-Card>/PPTV/####/-866687464.tmp
- <SD-Card>/PPTV/####/-870125393.tmp
- <SD-Card>/PPTV/####/-922155264.tmp
- <SD-Card>/PPTV/####/-946424229.tmp
- <SD-Card>/PPTV/####/-951372358.tmp
- <SD-Card>/PPTV/####/-955399492.tmp
- <SD-Card>/PPTV/####/-957909324.tmp
- <SD-Card>/PPTV/####/-996232583.tmp
- <SD-Card>/PPTV/####/1002218453
- <SD-Card>/PPTV/####/1094408075.tmp
- <SD-Card>/PPTV/####/1102871416.tmp
- <SD-Card>/PPTV/####/1105022018.tmp
- <SD-Card>/PPTV/####/1122221299.tmp
- <SD-Card>/PPTV/####/1151884099.tmp
- <SD-Card>/PPTV/####/1172701200.tmp
- <SD-Card>/PPTV/####/117470798.tmp
- <SD-Card>/PPTV/####/1212722609.tmp
- <SD-Card>/PPTV/####/1237243701
- <SD-Card>/PPTV/####/134287387.tmp
- <SD-Card>/PPTV/####/1416041203.tmp
- <SD-Card>/PPTV/####/1417387601
- <SD-Card>/PPTV/####/1426880800.tmp
- <SD-Card>/PPTV/####/143897019
- <SD-Card>/PPTV/####/1440913056.tmp
- <SD-Card>/PPTV/####/1448180133.tmp
- <SD-Card>/PPTV/####/156916210.tmp
- <SD-Card>/PPTV/####/1594906143.tmp
- <SD-Card>/PPTV/####/1616349569.tmp
- <SD-Card>/PPTV/####/1617452578.tmp
- <SD-Card>/PPTV/####/1644975282.tmp
- <SD-Card>/PPTV/####/1662247042.tmp
- <SD-Card>/PPTV/####/16706169
- <SD-Card>/PPTV/####/1698013877.tmp
- <SD-Card>/PPTV/####/1805646784.tmp
- <SD-Card>/PPTV/####/1813485605.tmp
- <SD-Card>/PPTV/####/1874340974.tmp
- <SD-Card>/PPTV/####/195189149.tmp
- <SD-Card>/PPTV/####/1985334736
- <SD-Card>/PPTV/####/2110819128.tmp
- <SD-Card>/PPTV/####/230007421
- <SD-Card>/PPTV/####/230656310.tmp
- <SD-Card>/PPTV/####/291275334.tmp
- <SD-Card>/PPTV/####/301923942.tmp
- <SD-Card>/PPTV/####/306331144.tmp
- <SD-Card>/PPTV/####/318641848.tmp
- <SD-Card>/PPTV/####/39760670.tmp
- <SD-Card>/PPTV/####/404067176.tmp
- <SD-Card>/PPTV/####/409146915
- <SD-Card>/PPTV/####/413182191.tmp
- <SD-Card>/PPTV/####/465505223.tmp
- <SD-Card>/PPTV/####/546041606
- <SD-Card>/PPTV/####/5515625.tmp
- <SD-Card>/PPTV/####/579534534
- <SD-Card>/PPTV/####/592173627
- <SD-Card>/PPTV/####/625050451.tmp
- <SD-Card>/PPTV/####/656727095.tmp
- <SD-Card>/PPTV/####/675860725
- <SD-Card>/PPTV/####/720067411.tmp
- <SD-Card>/PPTV/####/771382083.tmp
- <SD-Card>/PPTV/####/776714370.tmp
- <SD-Card>/PPTV/####/8343750.tmp
- <SD-Card>/PPTV/####/848256716.tmp
- <SD-Card>/PPTV/####/891388567.tmp
- <SD-Card>/PPTV/####/894598840.tmp
- <SD-Card>/PPTV/####/941181615
- <SD-Card>/PPTV/####/965397903.tmp
- <SD-Card>/PPTV/####/969045233.tmp
- <SD-Card>/PPTV/####/_livetab1
- <SD-Card>/PPTV/####/_livetab5
- <SD-Card>/PPTV/####/_livetabtab
Miscellaneous:
Executes next shell scripts:
- cat /sys/class/net/wlan0/address
- chmod 755 <Package Folder>/files/libjiagu.so
Loads the following dynamic libraries:
- audioeffect_jni
- libjiagu
- meet
- mresearch
- subtitle-jni
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- DESede-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
- DESede-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about APN settings.
Displays its own windows over windows of other applications.
