Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.743.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.1) 1####.89.125.214:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) l####.4####.top:443
- UDP 1####.168.106.254:4466
DNS requests:
- l####.4####.top
- pis.al####.com
- pns.al####.com
- pss.al####.com
- pus.al####.com
- sett####.crashly####.com
HTTP GET requests:
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
HTTP POST requests:
- pis.al####.com/p/pcdn/i.php?v=####
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
Modified file system:
Creates the following files:
- /data/data/####/.FlurrySenderIndex.info.AnalyticsData_Q8DHK2CBZ...S8_170
- /data/data/####/.FlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.flurryagent.27eb79d7
- /data/data/####/.flurrydatasenderblock.775230bb-e021-4e2a-b045-...fe9ac3
- /data/data/####/.flurrydatasenderblock.a0c269e7-1089-43b2-81e5-...aa2b6a
- /data/data/####/3c7913b8-b2e1-435e-a697-447569ac1bf9
- /data/data/####/5B9220FA01E9-0001-07F5-AFE2BD9E5062BeginSession.cls_temp
- /data/data/####/5B9220FA01E9-0001-07F5-AFE2BD9E5062SessionApp.cls_temp
- /data/data/####/5B9220FA01E9-0001-07F5-AFE2BD9E5062SessionDevice.cls_temp
- /data/data/####/5B9220FA01E9-0001-07F5-AFE2BD9E5062SessionEvent...s_temp
- /data/data/####/5B9220FA01E9-0001-07F5-AFE2BD9E5062SessionOS.cls_temp
- /data/data/####/FotoAdStrategy.xml
- /data/data/####/FotoCustomReportSet.xml
- /data/data/####/SUBOXLOG_
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/b96a24b8-82b7-433d-9b50-9ed522a570c0.jar
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android;answers;com.a.a.a.a.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.fotoable.photocollage.android.photocollageSetting.xml
- /data/data/####/com.google.android.gcm.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/h.jar
- /data/data/####/h.xml
- /data/data/####/index
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;a.a.a.a.u.xml
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/mivmi.xml
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pcdnconfigs.xml.bak
- /data/data/####/sa_77a39847-5754-4ef0-abee-27aa8b187c6a_1536303356681.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/signOfIcon.xml
- /data/data/####/sysconfig.xml
- /data/data/####/vmeni.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.thumbdata3--1967290299
- /data/media/####/1364fb5ef1da7a3dc9c7e99a397d8e6b.0
- /data/media/####/1536303383440.jpg
- /data/media/####/1536303383666.jpg
- /data/media/####/a496db7d7335ce1124af906f42415646.0
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/myself.dat
Miscellaneous:
Loads the following dynamic libraries:
- libpcdn_acc
- pcdn_acc
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS7Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.