Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Kyview.2.origin
Prompts to install third-party applications.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) dow.ha####.com:80
- TCP(HTTP/1.1) dlup####.58####.com:8090
- TCP(HTTP/1.1) pg.x####.com:80
- TCP(HTTP/1.1) app.del####.cn:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- UDP(NTP) 1.cn.p####.####.org:123
- TCP(TLS/1.0) fp.fraudme####.cn:443
- TCP(TLS/1.0) so####.com:443
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) t####.c####.q####.####.com:443
- TCP(TLS/1.0) w####.wjx.cn:443
- TCP(TLS/1.0) c.c####.com:443
DNS requests:
- 1.cn.p####.####.org
- a####.u####.com
- api.s####.mob.com
- app.del####.cn
- av1.x####.com
- c####.x####.com
- dlup####.58####.com
- dow.ha####.com
- ei.c####.com
- fp.fraudme####.cn
- g####.c####.com
- hm.b####.com
- i####.cn
- pg.x####.com
- s13.c####.com
- so####.com
- static####.q####.com
- w####.wjx.cn
HTTP GET requests:
- app.del####.cn/siteapi/app/update?f=####&ak=####&d=####&sver=####&osver=...
- dlup####.58####.com:8090/api.php?code=####
- dow.ha####.com/zreanimage/app/install/201706/happyrp_sign-0620.apk
HTTP POST requests:
- a####.u####.com/app_logs
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/snsconf
- pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63
- pg.x####.com/api/statis/3cff577985556567209c8fa8131303f63/app-9513BC7A0F...
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/.mrecord
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/.td-3
- /data/data/####/HappyRp.xml
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/duiba_fm.jar
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/fm_shared.xml
- /data/data/####/libjiagu.so
- /data/data/####/mob_commons_1.xml
- /data/data/####/share_sdk_1.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/files/td.lock
- <Package Folder>/files/tdlock.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/HandZB.xml
- <Package Folder>/shared_prefs/TDCloudSettingsConfig9513BC7A0FEB...38.xml
- <Package Folder>/shared_prefs/TDCloudSettingsConfig9513BC7A0FEB...ml.bak
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/tdid.xml
- <SD-Card>/.tcookieid
- <SD-Card>/.td-3
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/happyrp_sign-0620.apk
- <SD-Card>/Download/.td-3
- <SD-Card>/Mob/####/.dic_lock
- <SD-Card>/Mob/####/.globalLock
- <SD-Card>/Mob/####/.pkg_lock
- <SD-Card>/Mob/.td-3
- <SD-Card>/Movies/.td-3
- <SD-Card>/Notifications/.td-3
- <SD-Card>/Podcasts/.td-3
- <SD-Card>/did_hp
Miscellaneous:
Executes next shell scripts:
- chmod 444/storage/emulated/0/.td-3
- chmod 444/storage/emulated/0/Download/.td-3
- chmod 444/storage/emulated/0/Mob/.td-3
- chmod 444/storage/emulated/0/Movies/.td-3
- chmod 444/storage/emulated/0/Notifications/.td-3
- chmod 444/storage/emulated/0/Podcasts/.td-3
- chmod 755 /data/data/com.lm.happyrp/.jiagu/libjiagu.so
- getprop net.dns1
- getprop net.dns2
- ls -l /system/xbin/su
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.