Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.204.origin
- Android.DownLoader.205.origin
- Android.DownLoader.456.origin
Downloads the following detected threats from the Web:
- Android.HiddenAds.239.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sdk.d####.cn:80
- TCP(HTTP/1.1) ad####.d####.cn.####.com:80
- TCP(HTTP/1.1) s####.d####.cn:80
- TCP(HTTP/1.1) cf.gdata####.net:80
- TCP(HTTP/1.1) aps.vpwork####.com:80
- TCP(HTTP/1.1) ku.k####.cn:80
- TCP(TLS/1.0) api.b####.cn.####.com:443
DNS requests:
- a####.c####.com
- a####.u####.com
- ad####.d####.cn
- api.b####.cn
- aps.vpwork####.com
- cf.gdata####.net
- ku.k####.cn
- rd.gdata####.net
- s####.d####.cn
- sdk.d####.cn
HTTP GET requests:
- ad####.d####.cn.####.com/sdk/hlpt/lib_v1.0.36.zip
- aps.vpwork####.com/a1001013905.apk
- aps.vpwork####.com/dtt1128.zip
- aps.vpwork####.com/dttinsta1201.zip
- aps.vpwork####.com/panda_dex_139_3.zip
- aps.vpwork####.com/pinku0126.zip
HTTP POST requests:
- a####.u####.com/app_logs
- cf.gdata####.net/config/update
- cf.gdata####.net/dc/sync_adr
- ku.k####.cn/702619E220213D3BFE64AC4C86FBECF1
- ku.k####.cn/F6EA80A604B90C1AFFF602C719787160
- ku.k####.cn/FA193DF6DFDF511DCB16AEA4AA91E793
- s####.d####.cn/702619E220213D3BFE64AC4C86FBECF1
- s####.d####.cn/F6EA80A604B90C1AFFF602C719787160
- s####.d####.cn/FA193DF6DFDF511DCB16AEA4AA91E793
- sdk.d####.cn/70F5024058DC2E24DFD61302050EEED3
Modified file system:
Creates the following files:
- <Package Folder>/databases/ab_new.db
- <Package Folder>/databases/ab_new.db-journal
- <Package Folder>/databases/bb_new.db
- <Package Folder>/databases/bb_new.db-journal
- <Package Folder>/databases/dataeye_database_BBF1B3828A8106FDF6F...CB0.db
- <Package Folder>/databases/dataeye_database_BBF1B3828A8106FDF6F...ournal
- <Package Folder>/databases/dl_old.db
- <Package Folder>/databases/dl_old.db-journal
- <Package Folder>/databases/dtad_old.db
- <Package Folder>/databases/dtad_old.db-journal
- <Package Folder>/files/####/cqoktq
- <Package Folder>/files/####/dataapqsuly
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/lyqhcs.so
- <Package Folder>/files/####/wuqbce
- <Package Folder>/files/.imprint
- <Package Folder>/files/JARD_-1218777797.zip
- <Package Folder>/files/JARD_-1516549105.zip
- <Package Folder>/files/JARD_-1600945457.zip
- <Package Folder>/files/JARD_1540903321.zip
- <Package Folder>/files/JARD_2083352933.zip
- <Package Folder>/files/JARD_263242813.zip
- <Package Folder>/files/JARD_342698750.zip
- <Package Folder>/files/JNID_-466503776.so
- <Package Folder>/files/JNID_586571686.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/admainlib.xml
- <Package Folder>/shared_prefs/admainlib_new.xml
- <Package Folder>/shared_prefs/admainlib_new.xml.bak
- <Package Folder>/shared_prefs/dc.BBF1B3828A8106FDF6F83FFB7EA6FC...es.xml
- <Package Folder>/shared_prefs/lib_names.xml
- <Package Folder>/shared_prefs/lib_names_new.xml
- <Package Folder>/shared_prefs/newim.xml
- <Package Folder>/shared_prefs/ota_panda_dex_139_3.xml
- <Package Folder>/shared_prefs/pinku_dex_0126.xml
- <Package Folder>/shared_prefs/shared_lib_info.xml
- <Package Folder>/shared_prefs/shared_lib_info_new.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/unins.xml
- <SD-Card>/.SystemService/####/2D7F07BB6125DEB407E92A22DC4AC550
- <SD-Card>/.SystemService/####/uid
- <SD-Card>/lysy/####/config.ini
- <SD-Card>/lysy/####/journal.tmp
- <SD-Card>/sys/a1001013905.apk
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh
- app_process /system/bin com.android.commands.pm.Pm install -r /storage/emulated/0/sys/a1001013905.apk
- getprop ro.build.version.release
- getprop ro.build.version.sdk
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- pm install -r /storage/emulated/0/sys/a1001013905.apk
Loads the following dynamic libraries:
- JNID_-466503776
- JNID_586571686
- cqoktq
- lyqhcs
- shellx-0.0
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
