Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.743.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) d.sin####.cn.####.net:80
- TCP(HTTP/1.1) weiboi####.g####.sina####.com:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) da####.c####.qini####.com:80
- TCP(HTTP/1.1) cdn.app.p####.####.com:80
- TCP(SSL/3.0) weiboi####.g####.sina####.com:443
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) down####.huizhon####.com.####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) p####.e####.com:443
- TCP(TLS/1.0) xy####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) 8####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) a876####.com:443
- TCP(TLS/1.0) l####.4####.top:443
- TCP(TLS/1.0) p####.1####.com:443
- TCP(TLS/1.0) l####.sx####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) app-d7####.openins####.io:443
- TCP(TLS/1.0) weiboi####.g####.sina####.com:443
- TCP(TLS/1.0) openins####.io:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP(TLS/1.0) 5####.com:443
- TCP(TLS/1.0) mc.ya####.ru:443
- TCP(TLS/1.0) p####.q####.com:443
- UDP 1####.168.113.254:4466
DNS requests:
- 5####.com
- 8####.com
- a876####.com
- app-d7####.openins####.io
- c####.mm####.com
- c.c####.com
- cdn.app.p####.top
- cdn.img.p####.top
- down####.huizhon####.com
- hb####.com
- l####.4####.top
- l####.sx####.com
- l####.tbs.qq.com
- mc.ya####.ru
- openins####.io
- p####.1####.com
- p####.e####.com
- p####.q####.com
- p####.q####.com
- p####.quanmin####.com
- p####.quanmin####.com
- p####.sen####.com
- p####.shenba####.com
- p####.shenba####.com
- p####.shenba####.com
- pis.al####.com
- pns.al####.com
- proxy####.aliv####.com
- pss.al####.com
- pus.al####.com
- s####.g.doublec####.net
- s2.sin####.cn
- s22.c####.com
- www.google-####.com
- wx2.sin####.cn
- wx3.sin####.cn
- xy####.com
- z1.c####.com
HTTP GET requests:
- cdn.app.p####.####.com/upload/201809/26/app/20180926161236296.apk
- cdn.app.p####.####.com/upload/201810/29/app/20181029144030467.apk
- d.sin####.cn.####.net/orignal/007imNC4zy7nAFc8Zk5b1&690
- da####.c####.qini####.com/upload/201809/25/img/20180925182241271.png
- da####.c####.qini####.com/upload/201809/25/img/20180925182243360.png
- da####.c####.qini####.com/upload/201809/26/img/20180926161209969.png
- da####.c####.qini####.com/upload/201809/26/img/20180926161211483.jpg
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
- ti####.c####.l####.####.com/8X_01.gif
- ti####.c####.l####.####.com/dsqp04_01.jpg
- ti####.c####.l####.####.com/dsqp04_02.jpg
- ti####.c####.l####.####.com/dsqp04_03.jpg
- weiboi####.g####.sina####.com/large/0075Y33pgy1frslr91m5tg30qo02877k.gif
- weiboi####.g####.sina####.com/large/0078AiVhgy1fuwcsbdfjtg30qo04gwrf.gif
HTTP POST requests:
- pis.al####.com/p/pcdn/i.php?v=####
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
Modified file system:
Creates the following files:
- /data/data/####/4924517c-6bc6-42c5-8a41-ddca2f0a7143
- /data/data/####/8c3b77b8-a9c0-431d-a459-79fa655983cc.jar
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/SUBOXLOG_
- /data/data/####/com.pornmov.hello8x_preferences.xml
- /data/data/####/core_info
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/e.jar
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/https_8xnm.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/mivmi.xml
- /data/data/####/multidex.version.xml
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pcdnconfigs.xml.bak
- /data/data/####/vmeni.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/1091bae73b31118671ba7038ae022072.apk
- /data/media/####/2ac89324fa069
- /data/media/####/42169f5580e43
- /data/media/####/791e3d5d3f67a
- /data/media/####/c4229935f64f5
- /data/media/####/cl.tmp
- /data/media/####/dv.tmp
- /data/media/####/dv.tmp (deleted)
- /data/media/####/myself.dat
Miscellaneous:
Executes next shell scripts:
- chmod 777 /storage/emulated/0/instal/1091bae73b31118671ba7038ae022072.apk
- ls -l /system/bin/su
Loads the following dynamic libraries:
- libpcdn_acc
- pcdn_acc
Gains access to network information.
Gains access to telephone information (number, IMEI, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.