Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Ninebox.4.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) crs.b####.com:80
- TCP(HTTP/1.1) m.l####.com:80
- TCP(HTTP/1.1) cm.qt####.com:80
- TCP(HTTP/1.1) ni.l####.com.####.net:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) zi####.b####.com:80
- TCP(HTTP/1.1) mi.l####.com.####.net:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) map####.y####.com.cn:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) cpu.b####.com:80
- TCP(HTTP/1.1) nsc####.b####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) llq.ush####.info:80
- TCP(HTTP/1.1) s.c####.b####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) em.b####.com:80
- TCP(HTTP/1.1) c####.jd.com:80
- TCP(TLS/1.0) zhanz####.b####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) publish####.b####.com.####.com:443
- TCP(TLS/1.0) cpu.b####.com:443
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) cdn-boo####.b0.a####.com:443
- TCP(TLS/1.0) zz.bdst####.com:443
- TCP(TLS/1.0) wn.pos.b####.com:443
- TCP(TLS/1.0) si####.jom####.com:443
- TCP(TLS/1.0) ec####.b####.com:443
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) cac####.b####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) g####.bdst####.com:443
- TCP(TLS/1.0) ni.l####.com.####.net:443
DNS requests:
- api.s####.b####.com
- b####.s####.b####.com
- c####.baidust####.com
- c####.baidust####.com
- c####.jd.com
- cac####.b####.com
- cdn.boo####.com
- cm.pos.b####.com
- cm.qt####.com
- cpu.b####.com
- crs.b####.com
- dup.baidust####.com
- e####.b####.com
- ec####.b####.com
- em.b####.com
- f10.b####.com
- f11.b####.com
- f12.b####.com
- g####.bdst####.com
- h####.b####.com
- hm.b####.com
- llq.ush####.info
- m.b####.com
- m.l####.com
- map####.y####.com.cn
- mi.l####.com
- ni.l####.com
- nsc####.b####.com
- p####.zhanz####.b####.com
- pos.b####.com
- publish####.b####.com
- r####.b####.com
- s.c####.b####.com
- t10.b####.com
- t11.b####.com
- t12.b####.com
- wn.pos.b####.com
- zhanz####.b####.com
- zi####.b####.com
- zz.bdst####.com
HTTP GET requests:
- c####.baidust####.com/cpro/expire/time2.js
- c####.baidust####.com/cpro/ui/cm.js
- c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- c####.baidust####.com/cpro/ui/noexpire/ws/3rd/esl_b150bbf.js
- c####.baidust####.com/cpro/ui/noexpire/ws/css/base_f258e90.css
- c####.baidust####.com/cpro/ui/noexpire/ws/css/ui_b99a586.css
- c####.baidust####.com/cpro/ui/noexpire/ws/js/anticheatMob_776abb3.js
- c####.baidust####.com/cpro/ui/noexpire/ws/widget/logo_94e2e1b.js
- c####.baidust####.com/cpro/ui/pr.js
- c####.baidust####.com/sync.htm?cproid=####
- c####.jd.com/du?&baidu_user_id=####&cookie_version=####×tamp=####&e...
- cm.qt####.com/pixel?allyes_dspid=####&allye####&extra=####
- cpu.b####.com/js/cb.js
- crs.b####.com/t.js?siteId=####&planId=####&async=####&referer=####&title...
- crs.b####.com/tj.gif?si=####&st=####&nv=####&et=####&ep=####&at=####&rnd...
- dup.baidust####.com/holmes/t-dots.svg
- em.b####.com/allyes?allyes_id=####&allyes_cver=####&extra=####
- em.b####.com/pixel?dspid=####
- em.b####.com/pixel?media_sign=####&media_site=####
- hm.b####.com/h.js?36c0283####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.gif?si=####&st=####&nv=####&et=####&ep=####&rnd=####
- llq.ush####.info/browser/css/browser.css?id=####
- llq.ush####.info/browser/css/common.css?id=####
- llq.ush####.info/browser/fb.asp?id=####&mid=####&e=####
- llq.ush####.info/browser/img/ic_bd.png
- llq.ush####.info/browser/img/ic_thunder.png
- llq.ush####.info/browser/js/browser.js?id=####
- llq.ush####.info/browser/js/circle-progress.min.js?id=####
- m.l####.com/
- m.l####.com/CSS/style.css
- m.l####.com/e/extend/DoTimeRepage/
- m.l####.com/e/public/ViewClick/?classid=####&id=####&addclick=####
- m.l####.com/gaosanlizhi/
- m.l####.com/gaosanlizhi/34773.html
- m.l####.com/images/backtop.png
- m.l####.com/images/home_ico.png
- m.l####.com/images/menu_ico.png
- m.l####.com/js/common.js
- m.l####.com/js/jquery.js
- m.l####.com/js/md.js
- m.l####.com/lizhiwenzhang/
- m.l####.com/renshengganwu/
- m.l####.com/renshengganwu/47893.html
- m.l####.com/shujixiazai/
- m.l####.com/shujixiazai/36505.html
- m.l####.com/weirenchushi/
- m.l####.com/weirenchushi/47880.html
- map####.y####.com.cn/s/mapping/?baidu_user_id=####&cookie_version=####&t...
- mi.l####.com.####.net/dkgppb?ros=####&gsn=####&ns=####&vde=####&dzb=####...
- mi.l####.com.####.net/llzfgkw/aar?c=####&ext=####
- mi.l####.com.####.net/llzfgkw/vw?c=####&ext=####
- mi.l####.com.####.net/m.html?baidu_error=####×tamp=####
- mi.l####.com.####.net/mijgywf?ros=####&gsn=####&ns=####&vde=####&zkb=###...
- ni.l####.com.####.net/2e4d96dca598a574c917.js
- ni.l####.com.####.net/bvzdlc.js
- ni.l####.com.####.net/bwocytlctzdec.js
- ni.l####.com.####.net/cpro/ui/noexpire/ws/3rd/esl_b150bbf.js
- ni.l####.com.####.net/cpro/ui/noexpire/ws/css/base_f258e90.css
- ni.l####.com.####.net/cpro/ui/noexpire/ws/css/ui_b99a586.css
- ni.l####.com.####.net/cpro/ui/noexpire/ws/images/logo/close_9d33a11.png
- ni.l####.com.####.net/cpro/ui/noexpire/ws/images/logo/logo-mob_94da672.png
- ni.l####.com.####.net/cpro/ui/noexpire/ws/js/anticheatMob_776abb3.js
- ni.l####.com.####.net/cpro/ui/noexpire/ws/widget/logo_94e2e1b.js
- ni.l####.com.####.net/faspgjbbb.js
- ni.l####.com.####.net/hcurilddk.js
- ni.l####.com.####.net/r9d95n7ne4.js
- ni.l####.com.####.net/zwd71hzk5n.js
- nsc####.b####.com/v.gif?pid=####&type=####&l=####&t=####&s=####&v=####&f...
- nsc####.b####.com/v.gif?pid=####&type=####&sign=####&desturl=####&linkid...
- pos.b####.com/ecom?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/nclm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/nclm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&p...
- pos.b####.com/nclm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&col=####&pis=####&dri...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&cpl=####&pss=####&dc=...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&dai=####&cdo=####&ccd...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&dc=####&tlm=####&tpr=...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&dtm=####&dri=####&cdo...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&exps=####&cja=####&tc...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####<r=####&dri=####&dtm...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&psr=####&dai=####&ps=...
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&ti=####&ccd=####&cmi=...
- pos.b####.com/sync_pos.htm?cproid=####
- pos.b####.com/sync_pos.htm?cproid=####&t=####
- pos.b####.com/tccm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/tcxm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/wcbm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/wcjm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/xcmm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&p...
- pos.b####.com/xcmm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- s####.jom####.com/dst.gif?r=####&l=####
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?r=####&l=####
- s####.jom####.com/static/api/css/share_style0_16.css?v=####
- s####.jom####.com/static/api/img/share/icons_0_16.png?v=####
- s####.jom####.com/static/api/js/base/tangram.js?v=####
- s####.jom####.com/static/api/js/component/partners.js?v=####
- s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
- s####.jom####.com/static/api/js/share/api_base.js
- s####.jom####.com/static/api/js/share/share_api.js?v=####
- s####.jom####.com/static/api/js/trans/logger.js?v=####
- s####.jom####.com/static/api/js/view/share_view.js?v=####
- s####.jom####.com/static/api/js/view/view_base.js
- s####.jom####.com/v.gif
- s.c####.b####.com/s.htm?cproid=####&t=####
- si####.jom####.com/it/u=123207413,1390522706&fm=76
- si####.jom####.com/it/u=145486076,4125360639&fm=76
- si####.jom####.com/it/u=2083361222,3746588903&fm=72
- si####.jom####.com/it/u=2578034984,2718778031&fm=76
- si####.jom####.com/it/u=275400655,3258712238&fm=76
- si####.jom####.com/it/u=2755584431,1129246769&fm=76
- si####.jom####.com/it/u=2809798572,723040982&fm=72
- si####.jom####.com/it/u=289674988,1830295868&fm=76
- si####.jom####.com/it/u=2945672991,220875966&fm=72
- si####.jom####.com/it/u=302945343,2161225857&fm=76
- si####.jom####.com/it/u=3257843026,3064008603&fm=76
- si####.jom####.com/it/u=3335963470,2980791554&fm=76
- si####.jom####.com/it/u=3338203536,3614097140&fm=76
- si####.jom####.com/it/u=3451521526,134313756&fm=72
- si####.jom####.com/it/u=3542005213,3649252086&fm=76
- si####.jom####.com/it/u=3631708702,3929097240&fm=76
- si####.jom####.com/it/u=374952429,3510588813&fm=76
- si####.jom####.com/it/u=3822554042,3928687533&fm=76
- si####.jom####.com/it/u=3950980665,2709437368&fm=76
- si####.jom####.com/it/u=3983405062,4089856182&fm=76
- si####.jom####.com/it/u=416081020,2317124897&fm=76
- si####.jom####.com/it/u=4173483332,157810343&fm=76
- si####.jom####.com/it/u=514292623,4134511655&fm=76
- si####.jom####.com/it/u=565542474,3427528455&fm=76
- wap.n.sh####.com/mobads.php?060000a####&ck=####
- wn.pos.b####.com/adx.php?c=####
- wn.pos.b####.com/adx.php?c=####&ext=####
- zi####.b####.com/api/reward/getpay?url=####&is_pc=####&callback=####
Modified file system:
Creates the following files:
- /data/data/####/1525303237952.jar
- /data/data/####/1525303237993.jar
- /data/data/####/1525303238231.jar
- /data/data/####/1525303238242.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dij.xml
- /data/data/####/dim.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/http_m.lzrsh.com_0.localstorage-journal
- /data/data/####/https_cpu.baidu.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/j-id.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/12.dat
- /data/media/####/MID.DAT
- /data/media/####/names.dat
- /data/media/####/share.dat
Miscellaneous:
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Displays its own windows over windows of other applications.
