Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.743.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) scs.opensp####.cn:80
- TCP(HTTP/1.1) oss.kuyi####.com:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) d####.opensp####.cn:80
- TCP(HTTP/1.1) 60.1####.12.146:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) cl####.diy####.cc:80
- TCP(HTTP/1.1) m####.dnsom####.com:80
- TCP(HTTP/1.1) f####.kuyi####.com:80
- TCP(HTTP/1.1) 1####.213.69.195:1028
- TCP(TLS/1.0) statson####.pu####.b####.com:443
- TCP(TLS/1.0) api.tui####.b####.com:443
- TCP(TLS/1.0) pns.al####.com:443
- UDP 1####.168.111.254:4466
- TCP sa.tui####.b####.com:5287
DNS requests:
- api.tui####.b####.com
- cl####.diy####.cc
- d####.opensp####.cn
- f####.kuyi####.com
- iws.opensp####.cn
- lo####.kuyi####.com
- m####.dnsom####.com
- ope####.kuyi####.com
- oss.kuyi####.com
- pis.al####.com
- pns.al####.com
- proxy####.aliv####.com
- pss.al####.com
- pus.al####.com
- sa.tui####.b####.com
- scs.opensp####.cn
- statson####.pu####.b####.com
- www.b####.com
HTTP GET requests:
- cl####.diy####.cc/common/q_ttstpl?an=####&cn=####&di=####&pi=####&v=####
- cl####.diy####.cc/resource/cols?a=####&v=####&px=####&p=####&id=####&ct=...
- cl####.diy####.cc/resource/recm?a=####&v=####&ct=####&tp=####&id=####&re...
- f####.kuyi####.com/group2/M00/6C/00/rBBGelcZdxSAY1t8AAAFUL6fwHk650.png
- f####.kuyi####.com/group3/M00/3D/97/rBBGq1rf13OAQjTaAADAYwbPGwk363.jpg
- f####.kuyi####.com/group3/M00/41/9A/rBBGrFrrq-SAAkmgAAC3pRjeLrA161.jpg
- f####.kuyi####.com/group3/M00/D7/40/rBBGq1owhDSAU3BiAAA4itB5Hak147.jpg?w...
- f####.kuyi####.com/group3/M00/D7/47/rBBGrFowhACAbNxyAANQ4qC7rNs228.jpg
- f####.kuyi####.com/group3/M00/F4/12/rBBGq1pK1b2AevoJAAARKq7pG_E650.png
- f####.kuyi####.com/group3/M00/F4/12/rBBGq1pK1dSAFdnXAAAUdqSqhJI057.png
- f####.kuyi####.com/group3/M00/F4/13/rBBGq1pK1i2AKgbKAAAVDH1IiNQ779.png
- f####.kuyi####.com/group3/M00/F4/13/rBBGq1pK1juAUlH6AAAUpyqTpiQ884.png
- f####.kuyi####.com/group3/M00/F4/1B/rBBGrFpK1hyAG7FDAAATcPMb7TE219.png
- m####.dnsom####.com/
- oss.kuyi####.com/11W2MYCO/rescloud1/a383cf3ff14245ce94ca9d36f92c1778.aac
- oss.kuyi####.com/11W2MYCO/rescloud1/detailimgV6_20180424145224.jpg
- oss.kuyi####.com/11W2MYCO/rescloud1/surfaceimgV6_20180424145224.jpg
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
HTTP POST requests:
- cl####.diy####.cc/DiyRing31ClientProxyService/queryhotkeywords.aspx?t=##...
- cl####.diy####.cc/DiyRing31ClientProxyService/queryrecordexamples.aspx?t...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/adduserchannel?t=####&z...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_cfgs?t=####&zipup=###...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_col_res?t=####&zipup=...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_recom_res?t=####&zipu...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_revbs?t=####&zipup=##...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_rs_ranklist?t=####&zi...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_sh_thm?t=####&zipup=#...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/q_sh_tip?t=####&zipup=#...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/queryalbum?t=####&zipup...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/queryalbumcomment?t=###...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/queryringwithlink?t=###...
- cl####.diy####.cc/DiyRing31ClientProxyService/v5/queryuid?t=####&zipup=#...
- d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- d####.opensp####.cn/online_param/config_update.php
- pis.al####.com/p/pcdn/i.php?v=####
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
- scs.opensp####.cn/scs?logver=####&cmd=####&size=####
Modified file system:
Creates the following files:
- /data/data/####/-1070665175
- /data/data/####/-1456445070
- /data/data/####/-1646942636
- /data/data/####/-1709976734
- /data/data/####/-278090891-98492709
- /data/data/####/-278090891206308830
- /data/data/####/-2780908912100941968
- /data/data/####/-30882946-1903393822
- /data/data/####/-398420258
- /data/data/####/-430822281
- /data/data/####/-545100323
- /data/data/####/-629927525563355788
- /data/data/####/-662262635
- /data/data/####/-698647370331693660
- /data/data/####/-698647370569488736
- /data/data/####/-879966091
- /data/data/####/-9573712251584642190
- /data/data/####/-989544238-97287233
- /data/data/####/09133cypLn6mSrVZI_lr5soDsSw.-123414547.tmp
- /data/data/####/1162221114
- /data/data/####/1783369401
- /data/data/####/1797584654
- /data/data/####/18317620781848348823
- /data/data/####/1930691972-1127074860
- /data/data/####/38040359
- /data/data/####/38626321120717473
- /data/data/####/4950320561079200048
- /data/data/####/501220586
- /data/data/####/641861648
- /data/data/####/8z9FL6-pmKWMKMA5kRUza1UlLW4.-1610607069.tmp
- /data/data/####/AZbU_pX1ZKsTMZvEuYDQC61pNns.249331848.tmp
- /data/data/####/HkHmCjBvLIZ5TKnx9gmuJdTJ8Os.1757408962.tmp
- /data/data/####/Jpcs7lXvl7si9MMBatWdphMZ9Tk.650429388.tmp
- /data/data/####/L34s8dIcCVidzX6HDRfxQemsREU.-1404051618.tmp
- /data/data/####/L8iikFJIgc_d5WKeqwOm_gqofik.-1198409441.tmp
- /data/data/####/PhoneShow.xml
- /data/data/####/SUBOXLOG_
- /data/data/####/Ssf1sHXaI0rRoGEr_R7gMJHw4YM.-336228676.tmp
- /data/data/####/TLojcpn6bTdHURxNbCKGzh51L7g.-1280170290.tmp
- /data/data/####/a06ecbba-601e-456a-8620-bd6791de6669.jar
- /data/data/####/a26ac999-5793-491a-bb83-5908a153a20f
- /data/data/####/aPXUjwUABXOXa3Pv2sKpf3TdrzU.1007632169.tmp
- /data/data/####/com.baidu.pushservice.BIND_CACHE.xml
- /data/data/####/com.ewytus.push_sync.xml
- /data/data/####/com.ewytus.self_push_sync.xml
- /data/data/####/com.ewytus_preferences.xml
- /data/data/####/com.ewytus_preferences.xml (deleted)
- /data/data/####/com.iflytek.id.xml
- /data/data/####/config
- /data/data/####/config.xml
- /data/data/####/daemon
- /data/data/####/e_bJAvjVQJD2fc1nRODbE0QV3Jc.1777678372.tmp
- /data/data/####/iflytek_cached_com.ewytus
- /data/data/####/iflytek_state_com.ewytus.xml
- /data/data/####/libcuid.so
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/mivmi.xml
- /data/data/####/multidex.version.xml
- /data/data/####/netshow.info.xml
- /data/data/####/odGvSRvpdDRsYKrrmVHuhmmhi0c.-1663742310.tmp
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pst.xml
- /data/data/####/pushclient.xml
- /data/data/####/pushinfo.db
- /data/data/####/pushinfo.db-journal
- /data/data/####/pushstat_5.5.0.db
- /data/data/####/pushstat_5.5.0.db-journal
- /data/data/####/ring_config.xml
- /data/data/####/settings.xml
- /data/data/####/start_client_log_file.xml
- /data/data/####/webview.db-journal
- /data/media/####/.cuid
- /data/media/####/.cuid2
- /data/media/####/94e6ec8d170f3bb30d02aa5e6464713f..temp
- /data/media/####/TelNo.db
- /data/media/####/config
- /data/media/####/iflyworkdir_test
- /data/media/####/myself.dat
- /data/media/####/telno.7z
- /data/media/####/u.data
Miscellaneous:
Executes next shell scripts:
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.iflytek.ipc.daemon.thirdcompat.ThirdEmptyService
- chmod 700 <Package Folder>/app_bin/daemon
- mars_d -p <Package> -s com.iflytek.ipc.daemon.thirdcompat.ThirdEmptyService -p1r 45 -p1w 46 -p2r 47 -p2w 48
- netstat -ant
Loads the following dynamic libraries:
- bdpush_V2_7
- daemon_api20
- faad
- imagepipeline
- libpcdn_acc
- msc
- pcdn_acc
- un7z
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES-ECB-PKCS7Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about APN settings.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
