Technical information
Malicious functions:
Overlays the screen with its own window and blocks GUI access.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) rdt.gdata####.net:80
- TCP(HTTP/1.1) t.g####.qq.com:80
- TCP(HTTP/1.1) api.x####.com:80
- TCP(HTTP/1.1) dsp.x####.com:80
- TCP(HTTP/1.1) serv####.sdk.quic####.net:80
- TCP(HTTP/1.1) sdka####.sdk.quic####.net:80
- TCP(TLS/1.0) wx####.hns####.cn:9006
- TCP(TLS/1.0) wx####.hns####.cn:443
- TCP(TLS/1.0) 1####.100.207.233:443
- TCP(TLS/1.0) f46a####.cdn.uc####.####.cn:443
DNS requests:
- api.x####.com
- dsp.x####.com
- pv.s####.com
- rdt.gdata####.net
- sdka####.sdk.quic####.net
- serv####.sdk.quic####.net
- t.g####.qq.com
- wx####.hns####.cn
- wxxyx####.hns####.cn
HTTP GET requests:
- api.x####.com/v2/contacts?client_id=####&agent_id=####
- api.x####.com/v2/versions/latest?client_id=####&agent_id=####&agent_id=#...
- api.x####.com/v2/versions?client_id=####&agent_id=####&agent_id=####
- serv####.sdk.quic####.net/59912560027761211034840562832208-133.html
- t.g####.qq.com/conv/sdk/spa/conv?vx=sjy2####&encver=####
HTTP POST requests:
- api.x####.com/v2/config
- api.x####.com/v2/devices/active
- dsp.x####.com/index/callback_android
- rdt.gdata####.net/echo?appId=####&mac=####&imei=####&imei2=####&uid=####...
- rdt.gdata####.net/tracking/async
- sdka####.sdk.quic####.net/v1/api/init
- sdka####.sdk.quic####.net/v2/users/checkVersion
File system changes:
Creates the following files:
- /data/data/####/356507059351895_qSdk_ex.log
- /data/data/####/ActivateTimePref.xml
- /data/data/####/com_qk.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dataeye_tracking_database_CEF558197BD5DC43325E0...C25.db
- /data/data/####/dataeye_tracking_database_CEF558197BD5DC43325E0...ournal
- /data/data/####/dc.tracking.CEF558197BD5DC43325E009FE3F80CC25.p...es.xml
- /data/data/####/dc.tracking.global.prfrerence.xml
- /data/data/####/device_id.xml.xml
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/index
- /data/data/####/multidex.version.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/yxq_xmw_info.xml
- /data/media/####/com.gzyy.hsxy.xmw.qkflag.133.txt
- /data/media/####/qk.dvid.txt
- /data/media/####/uid
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh
- cat /sys/class/net/wlan0/address
- getprop ro.build.display.id
- getprop ro.miui.ui.version.name
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
Loads the following dynamic libraries:
- qkcheck
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- DES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.