Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) wc.find####.cc.####.com:80
- TCP(HTTP/1.1) i4.w####.com:80
- TCP(HTTP/1.1) do####.a####.com:80
- TCP(HTTP/1.1) reso####.a####.com.####.com:80
- TCP(HTTP/1.1) ers.b####.com:80
- TCP(HTTP/1.1) www.do####.in:80
- TCP(HTTP/1.1) s.un####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) mobads-####.b####.com:443
DNS requests:
- a####.u####.com
- dc.1####.com
- do####.a####.com
- ers.b####.com
- hm.b####.com
- i4.w####.com
- mo####.b####.com
- mobads-####.b####.com
- r####.wx.qq.com
- reso####.a####.com
- s.un####.com
- ser####.1####.com
- wc.find####.cc
- www.do####.in
HTTP GET requests:
- do####.a####.com/play/42-tf/icon.png
- do####.a####.com/play/42-tf/style/img/again.png
- ers.b####.com/app/s.js?siteId=####&goTop=####
- i4.w####.com/item/1508/21/55d6af11a5296_wx.jpg
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/__pasys.apk
- mo####.b####.com/ads/pa/__pasys.php
- mo####.b####.com/ads/pa/__pasys_remote_banner.jar
- mo####.b####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####...
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525573731991=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525573762204=####
- reso####.a####.com.####.com/resource/js/btst/main.js?42####
- s####.tc.qq.com/open/js/jweixin-1.1.0.js
- wc.find####.cc.####.com/2011/rio.jar
- www.do####.in/badword/verify.jsonp?callback=####&words=####
- www.do####.in/bd?is_opencookie=####&refer=####&sessionid=####&COOKIE_ID=...
- www.do####.in/js/dc.js
- www.do####.in/play/42-tf/
- www.do####.in/play/42-tf/icon.png
- www.do####.in/play/42-tf/script/index.js
- www.do####.in/play/42-tf/style/img/1.jpg
- www.do####.in/play/42-tf/style/img/2.jpg
- www.do####.in/play/42-tf/style/img/3.jpg
- www.do####.in/play/42-tf/style/img/more.png
- www.do####.in/play/42-tf/style/img/namebg.png
- www.do####.in/play/42-tf/style/img/startbg.png
- www.do####.in/play/42-tf/style/img/tbtn.png
- www.do####.in/play/42-tf/style/img/tbtnh.png
- www.do####.in/play/42-tf/style/img/testing.png
- www.do####.in/play/42-tf/style/index.css
- www.do####.in/play/common/common.css
- www.do####.in/play/common/common.js
- www.do####.in/play/common/logo-adv.jpg
- www.do####.in/play/common/share.js
- www.do####.in/play/common/zepto.min.js
- www.do####.in/wx/jsapiSignature.jsonp?callback=####&appType=####&noncest...
HTTP POST requests:
- a####.u####.com/app_logs
- s.un####.com/cw/cp.action?requestId=####&g=####
- s.un####.com/cw/interface!u2.action?protocol=####&version=####
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/W_Key.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/__pasys.apk.beforesign.tm
- /data/data/####/__pasys_remote_banner.jar.beforesign.tm
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/index
- /data/data/####/mobclick_agent_online_setting_com.moon.hao2.yuanfen1.xml
- /data/data/####/st.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/3.6_rio.jar.tmp
- /data/media/####/assetstime.dat
Miscellaneous:
Loads the following dynamic libraries:
- ke
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
