Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.41.origin
- Android.Triada.417.origin
- Android.Triada.440.origin
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cfg.a####.com:80
- TCP(HTTP/1.1) p.a####.net:80
- TCP(HTTP/1.1) 1####.75.90.129:80
- TCP(HTTP/1.1) en####.tui####.com:80
- TCP(HTTP/1.1) 1####.171.140.78:80
- TCP(HTTP/1.1) p2.ai####.com:80
- TCP(HTTP/1.1) r####.qq####.cn:80
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) fp-st####.b0.a####.com:80
- TCP(HTTP/1.1) ob.nic####.cn:80
- TCP(HTTP/1.1) 2####.187.226.25:80
- TCP(HTTP/1.1) 1####.75.115.32:80
- TCP(HTTP/1.1) m.scx####.com:80
- TCP(HTTP/1.1) www.ye####.org:80
- TCP(HTTP/1.1) b####.www.ye####.org:80
- TCP(HTTP/1.1) embe####.d####.com.cn:80
- TCP(HTTP/1.1) do.soi####.com:80
- TCP(HTTP/1.1) yun.d####.com.cn:80
- TCP(HTTP/1.1) z.no####.net:80
- TCP(HTTP/1.1) 7k####.46####.com:20351
- TCP(HTTP/1.1) ja####.huita####.com:10091
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) fu####.u####.cn:80
- TCP(HTTP/1.1) yun.russi####.cn.####.com:80
- TCP(HTTP/1.1) ip.ch####.com:80
- TCP(HTTP/1.1) im####.nic####.cn:80
- TCP(HTTP/1.1) m.jj####.com:80
- TCP(HTTP/1.1) p####.cdb####.cn:80
- TCP(HTTP/1.1) 7k####.46####.com:15215
- TCP(HTTP/1.1) m1.laogeda####.com:80
- TCP(HTTP/1.1) cd.kw####.com:80
- TCP(HTTP/1.1) acti####.russi####.cn:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) log.cuda####.com:10090
- TCP(TLS/1.0) ad####.tand####.com:443
- TCP(TLS/1.0) dev-tes####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) st####.adhu####.com:443
- TCP(TLS/1.0) m.cuda####.com:443
- TCP(TLS/1.0) bu####.bianxia####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) at.al####.com:443
- TCP(TLS/1.0) 2b.tand####.com:443
- TCP(TLS/1.0) fp.ton####.net:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) dis####.in####.com:443
- TCP(TLS/1.0) adsc####.tand####.com:443
- TCP(TLS/1.0) fp.fraudme####.cn:443
- TCP(TLS/1.0) api.nic####.cn:443
- TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) log.cuda####.com:11090
- TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP(TLS/1.0) i.tand####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
DNS requests:
- 2.and####.p####.####.org
- 2b.tand####.com
- 7k####.46####.com
- acti####.russi####.cn
- ad####.tand####.com
- adsc####.tand####.com
- aliyuno####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- api.nic####.cn
- at.al####.com
- b####.www.ye####.org
- bu####.bianxia####.com
- c####.mm####.com
- c.c####.com
- cd.kw####.com
- cdn.a####.com
- cfg.a####.com
- dev-tes####.oss-cn-####.aliy####.com
- dis####.in####.com
- do.soi####.com
- dup.baidust####.com
- embe####.d####.com.cn
- en####.tui####.com
- fp.fraudme####.cn
- fp.ton####.net
- fu####.u####.cn
- hm.b####.com
- hotfix####.oss-cn-####.aliy####.com
- i.tand####.com
- im####.nic####.cn
- ip.ch####.com
- ja####.huita####.com
- log.cuda####.com
- m.cuda####.com
- m.jj####.com
- m.scx####.com
- m1.laogeda####.com
- ob.nic####.cn
- p####.cdb####.cn
- p.a####.net
- p2.ai####.com
- pos.b####.com
- r####.qq####.cn
- s19.c####.com
- s22.c####.com
- s23.c####.com
- st####.adhu####.com
- st####.fraudme####.cn
- w####.iy####.cn
- www.ye####.org
- y2####.uw####.com
- yun.d####.com.cn
- yun.russi####.cn
- yun.tuis####.com
- yun.tuit####.com
- z####.heyc####.net
- z.no####.net
- z1.c####.com
- z8.c####.com
HTTP GET requests:
- acti####.russi####.cn/activity/index?id=####&slotId=####&login=####&appK...
- acti####.russi####.cn/statistics/activityPagePerf?group_type=####&platfo...
- cfg.a####.com/hdjump?iclicashid=####
- do.soi####.com/201811/wlj.jar
- dup.baidust####.com/js/os.js
- embe####.d####.com.cn/exposure/standard?dpm=####&consumer_id=####&domain...
- en####.tui####.com/index/activity?appKey=####&adslotId=####
- fp-st####.b0.a####.com/v2/fm.js?ver=####&t=####
- fu####.u####.cn/agent/funbox?appId=####&rdeviceId=####
- im####.nic####.cn/group1/M00/00/9E/rBGXxFsowHOAO1UdAAAeeTSyotk448.png
- im####.nic####.cn/group1/M00/00/9E/rBGXxFsowICAf14pAAAeNCv0uwI537.png
- im####.nic####.cn/group1/M00/00/9E/rBGXxFsowJ2AaTOZAABstA9fLmw744.png
- im####.nic####.cn/group1/M00/00/9E/rBGXxFsowJGATHAjAAAeD18-ajM000.png
- im####.nic####.cn/group1/M00/00/9E/rBGXxFsowK2ASJbmAAAsjC6zG7o702.png
- im####.nic####.cn/group1/M00/01/BC/rBGXxFvOgmyAXJb4AAE9SRtGbF8760.jpg
- im####.nic####.cn/h5-mami/activity/smashg/1.0/images/N11mK1472645269925....
- im####.nic####.cn/h5-mami/activity/smashg/1.0/images/rule.png
- im####.nic####.cn/h5-mami/couponPrize/1.27.8/bg-back.png
- im####.nic####.cn/h5-mami/couponPrize/1.27.8/bodybg.png
- im####.nic####.cn/h5-mami/couponPrize/1.27.8/button.png
- im####.nic####.cn/h5-mami/couponPrize/1.27.8/redpacks.png
- im####.nic####.cn/h5-mami/couponPrize/1.27.8/win-tip.png
- im####.nic####.cn/h5-mami/couponPrize/3.8/halo2.png
- im####.nic####.cn/h5-mami/couponPrize/close.png
- im####.nic####.cn/h5/showCouponPrize/4.0.0/assets/light.png
- im####.nic####.cn/mami-media/img/3lvzf7z2rr.png
- im####.nic####.cn/mami-media/img/4nzcc16gi5.png
- im####.nic####.cn/mami-media/img/835o9gg0ij.png
- im####.nic####.cn/mami-media/img/fwfwn52a14.png
- im####.nic####.cn/mami-media/img/mqoqqxa0tf.png
- im####.nic####.cn/mami-media/img/q2mm848pac.png
- im####.nic####.cn/mami-media/img/tfbcjuzu29.png
- ip.ch####.com/getip.aspx
- m.jj####.com/tezhongyangzhi/20180110/10.html
- m.jj####.com/w5j6gTDabo0i.php?o=####&i=####&s=####&ad=####
- m.scx####.com/VPEMj4t2vRU7.php?o=####&i=####&s=####&ad=####
- m.scx####.com/zuixinzixun/20180427/2099.html
- m1.laogeda####.com/ads/admaster24.php?o=####
- m1.laogeda####.com/ads/admaster24.php?o=####&qqtqhe=####
- m1.laogeda####.com/ads/admaster240.php?o=####
- m1.laogeda####.com/templets/tui/js/jquery-1.8.3.min.js
- ob.nic####.cn/huodong/Production/20181031/node_modules/fastclick/lib/fas...
- ob.nic####.cn/huodong/Production/20181031/node_modules/iscroll/build/isc...
- ob.nic####.cn/huodong/Production/20181031/pkg/Common.js
- ob.nic####.cn/huodong/Production/20181031/pkg/Vendor.js
- ob.nic####.cn/huodong/Production/20181031/projects/page/SmashGoldenEgg/S...
- ob.nic####.cn/huodong/Production/20181031/projects/page/SmashGoldenEgg/c...
- ob.nic####.cn/huodong/Production/20181031/projects/widget/PrizeModal/Fla...
- p####.cdb####.cn/z/2gdbvnfgbdf4x.zip
- p####.cdb####.cn/z/2hadfvsdvdr4x.zip
- p####.cdb####.cn/z/2jafghbdf4x.zip
- p####.cdb####.cn/z/2mbfgsdgfkl4x.zip
- p####.cdb####.cn/z/2wofgghjyj4x.zip
- p.a####.net/eppu
- p.a####.net/l/go/?time=6&url=https://i.tandehao.com/activities/?appKey=#...
- p2.ai####.com/activity/index?key=####
- r####.qq####.cn/f/AAAfgskyg026
- r####.qq####.cn/g/fbgfby026
- yun.d####.com.cn/h5-tuia/couponPrize/lucky.png?nnn=####
- yun.russi####.cn.####.com/h5-mami/activity/redPack/2.0/index_20180824110...
- yun.russi####.cn.####.com/h5-mami/activity/redPack/2.0/index_20180921185...
- yun.russi####.cn.####.com/h5-mami/activity/turnCircle/5.0/actBase_201809...
- yun.russi####.cn.####.com/h5-mami/common/actBase_201810091908.css
- yun.russi####.cn.####.com/h5-mami/common/actBase_201810311043.js
- yun.russi####.cn.####.com/h5-mami/h5-discern-simulator-1.0.19.min.js?t=#...
- yun.russi####.cn.####.com/mami-media/img/2jvzgm2bxz.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/6pbzqjxjcb.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/80ejdpfzh2.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/c500wpfdgv.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/gaelp1uwug.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/h3itzt2x74.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/hf4qcg2n0l.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/kiilb2tu8r.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/o8uld99ac4.jpg?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/svp9759qsv.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/v3zdbc89ws.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/w6wvhw2clc.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/xugpoxf9eu.png?x-oss-process=####
HTTP POST requests:
- 7k####.46####.com:15215/tr/
- 7k####.46####.com:15215/ts/
- 7k####.46####.com:20351/ds/
- acti####.russi####.cn/activity/ajaxOptions
- b####.www.ye####.org/i?requestId=####&g=####
- cd.kw####.com/c
- ja####.huita####.com:10091/wisdom/marking
- ob.nic####.cn/niceapi/getactivity
- ob.nic####.cn/niceapi/getactivitybuoy
- ob.nic####.cn/niceapi/getadvertorder
- ob.nic####.cn/niceapi/orderdatainfo
- www.ye####.org/i?requestId=####&g=####
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
- z.no####.net/m/a/f
- z.no####.net/m/a/t
Modified file system:
Creates the following files:
- /data/data/####/4e793485339d62b7f39474831e879f9a
- /data/data/####/518b137efcadca43d34c532689bb9f56.log
- /data/data/####/518b137efcadca43d34c532689bb9f56.log.temp
- /data/data/####/5ff9fbceaae1b0f381c9a2589fb0cc4c.log
- /data/data/####/5ff9fbceaae1b0f381c9a2589fb0cc4c.log.temp
- /data/data/####/718808d93795e42acb919bab227e6424.xml
- /data/data/####/ENrxPu.jar
- /data/data/####/JSON.xml
- /data/data/####/Nj5Q2No4DR.jar
- /data/data/####/W_Key.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/a4be9ff4668403efdb304dc0106533f6.log
- /data/data/####/a4be9ff4668403efdb304dc0106533f6.log.temp
- /data/data/####/com.example.cpdemo_preferences.xml
- /data/data/####/com.example.cpdemo_preferences.xml.bak
- /data/data/####/com_example_cpdemo.txt
- /data/data/####/commmauwucik.xml
- /data/data/####/countClickIP.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/dpi
- /data/data/####/e2d119a1c8895232098cd0bba4d5750c.log
- /data/data/####/e2d119a1c8895232098cd0bba4d5750c.log.temp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/ff533ee364e852cd5369a6766a6f448b.log
- /data/data/####/ff533ee364e852cd5369a6766a6f448b.log.temp
- /data/data/####/g2B7jiH.jar
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/hid.db
- /data/data/####/index
- /data/data/####/libmbgv.so
- /data/data/####/libmbgv.so-32
- /data/data/####/libmbgv.so-64
- /data/data/####/oikrikrw.jar
- /data/data/####/plsghuaw.xml
- /data/data/####/reVx9mXSZ.jar
- /data/data/####/st.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yd_config_c.xml
- /data/media/####/.nid
- /data/media/####/.uucrrux
- /data/media/####/0668F4008AFBD99853A8C2B6CF76D3FD.temp
- /data/media/####/0668F4008AFBD99853A8C2B6CF76D3FD.zip
- /data/media/####/5.1wlj.jar.x
- /data/media/####/com_example_cpdemo.txt
- /data/media/####/restime.dat
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh
- cat /proc/version
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- cat /sys/class/net/wlan0/address
- getprop
- getprop ro.board.platform
- getprop ro.product.cpu.abi
- ls -l /dev
- ls -l /dev/block
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuctl/apps
- ls -l /dev/cpuctl/apps/bg_non_interactive
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/log
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ps
Loads the following dynamic libraries:
- libmbgv
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, IMEI, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.