Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.1274.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) api.h####.com:81
- TCP(HTTP/1.1) jk.kbl####.com:80
- TCP(HTTP/1.1) p2.so.q####.com:80
- TCP(HTTP/1.1) p.ps####.com:80
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) g####.com:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) www.google####.com:443
- TCP(TLS/1.2) 1####.250.179.142:443
- TCP p.ps####.com:443
- TCP us####.al####.com.####.net:443
- TCP i.l####.net:443
- UDP 1####.194.160.72:443
- UDP www.google####.com:443
DNS requests:
- a####.al####.com
- api.h####.com
- g####.com
- i.l####.net
- img.r####.net
- jk.kbl####.com
- p.ps####.com
- p2.so.q####.com
- safebro####.google####.com
- ws3.sin####.cn
- ww1.sin####.cn
- ww3.sin####.cn
- ww4.sin####.cn
- www.google####.com
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- xhm.xhml####.com
- xhm.xhml####.com.####.8
HTTP GET requests:
- api.h####.com:81/mf/json.txt
- g####.com:443/snow-walk/Hjk/raw/master/2hyy
- jk.kbl####.com/data/upload/20190714/5d2b2f400cc8e.png
- p.ps####.com/large/006iJPGply1gavg2zhlayj305c05cq47.jpg
- p.ps####.com/large/87c01ec7gy1fqi4cgzdv6j2020020q2v.jpg
- p.ps####.com/large/87c01ec7gy1fr1m2fre6rj2036036jra.jpg
- p.ps####.com/large/87c01ec7ly1fr5dlbjj3xj204501u0sl.jpg
- p.ps####.com/mw690/0060lm7Tly1fu1100a52kj303m03cwec.jpg
- p.ps####.com/mw690/0060lm7Tly1fu14duxmp6j303y03f745.jpg
- p.ps####.com/mw690/0060lm7Tly1fu6p7zazkzj303t03imx2.jpg
- p.ps####.com/mw690/0060lm7Tly1fv0apoo8zuj3046046747.jpg
- p2.so.q####.com/t0202d8e2bdcedb45f8.jpg
- p2.so.q####.com/t0226041f1b32fd7c53.jpg
- p2.so.q####.com/t023eceeed34f5d56c1.jpg
- p2.so.q####.com/t0241a04e48f1e73f42.jpg
- p2.so.q####.com/t024562131739c88e27.jpg
- p2.so.q####.com/t0259a3a944d0f7558e.jpg
- p2.so.q####.com/t025f8b80c5f2e59f01.jpg
- p2.so.q####.com/t0263ded6e95d5ac013.jpg
- p2.so.q####.com/t0266204d13211e6f74.jpg
- p2.so.q####.com/t02a3bd890711408ef1.jpg
- p2.so.q####.com/t02d5f6478a7ea25d17.jpg
File system changes:
Creates the following files:
- /data/data/####/2d040fba084a4a2aee6cd48f0efdb24c.0.tmp
- /data/data/####/2d040fba084a4a2aee6cd48f0efdb24c.1
- /data/data/####/382dcb33aad6284b4ae1488872961dcf.0.tmp
- /data/data/####/382dcb33aad6284b4ae1488872961dcf.1.tmp
- /data/data/####/38413b7f7c81d444330a94632bafd71d.0.tmp
- /data/data/####/38413b7f7c81d444330a94632bafd71d.1.tmp
- /data/data/####/455ecfbfa53b2e38111f0964929025df.0.tmp
- /data/data/####/455ecfbfa53b2e38111f0964929025df.1
- /data/data/####/4b11fdd7f251c9f234f3a57b22d83057.0.tmp
- /data/data/####/4b11fdd7f251c9f234f3a57b22d83057.1.tmp
- /data/data/####/51f06573622c08076e5a167cbd2789db.0.tmp
- /data/data/####/51f06573622c08076e5a167cbd2789db.1.tmp
- /data/data/####/5be911558abeb07617813413c6cca40d.0.tmp
- /data/data/####/5be911558abeb07617813413c6cca40d.1.tmp
- /data/data/####/72d9e7e2085eb5ca5b5acf41879108de.0.tmp
- /data/data/####/72d9e7e2085eb5ca5b5acf41879108de.1.tmp
- /data/data/####/8c34a4ab4c93a27214b344a538486fa6.0.tmp
- /data/data/####/8c34a4ab4c93a27214b344a538486fa6.1.tmp
- /data/data/####/90249f0bd32fa44587d8dc04c78c0024.0.tmp
- /data/data/####/90249f0bd32fa44587d8dc04c78c0024.1.tmp
- /data/data/####/9753a7ae84ced3fab2898dc857104138.0.tmp
- /data/data/####/9753a7ae84ced3fab2898dc857104138.1.tmp
- /data/data/####/9aadc38f429b38ffa27ce345861ebb76.0.tmp
- /data/data/####/9aadc38f429b38ffa27ce345861ebb76.1.tmp
- /data/data/####/@bdplayer_2.2.4.dex
- /data/data/####/@bdplayer_2.2.4.dex.flock (deleted)
- /data/data/####/aa9b264f6c03fc95c72ddf036df48862.0.tmp
- /data/data/####/aa9b264f6c03fc95c72ddf036df48862.1.tmp
- /data/data/####/abc4075cec85b8b7737de9d0ef38fa0d.0.tmp
- /data/data/####/abc4075cec85b8b7737de9d0ef38fa0d.1.tmp
- /data/data/####/b24e918b80d72827675f2bedc6281e7e.0.tmp
- /data/data/####/b24e918b80d72827675f2bedc6281e7e.1.tmp
- /data/data/####/b5aed4d00a9bf1427db2e73cebe6dfe7.0.tmp
- /data/data/####/b5aed4d00a9bf1427db2e73cebe6dfe7.1.tmp
- /data/data/####/b60cd8e5beaa6a5bc720d05cdf629f5a.0.tmp
- /data/data/####/b60cd8e5beaa6a5bc720d05cdf629f5a.1.tmp
- /data/data/####/bf87fd221a935f366c322d5075ed34fa.0.tmp
- /data/data/####/bf87fd221a935f366c322d5075ed34fa.1
- /data/data/####/bf87fd221a935f366c322d5075ed34fa.1.tmp
- /data/data/####/bf87fd221a935f366c322d5075ed34fa.1.tmp (deleted)
- /data/data/####/ccbf6b58f964175a0055e1eb1c0afd50.0.tmp
- /data/data/####/ccbf6b58f964175a0055e1eb1c0afd50.1.tmp
- /data/data/####/classes.dex
- /data/data/####/classes.dex.flock (deleted)
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/e1c796235fe065e3c1c1cf948a3feba1.0.tmp
- /data/data/####/e1c796235fe065e3c1c1cf948a3feba1.1.tmp
- /data/data/####/ea9291a839d17518b30a792256929a14.0.tmp
- /data/data/####/ea9291a839d17518b30a792256929a14.1.tmp
- /data/data/####/ec6bc989b1ade1ed3f09e2c6efec728e.0.tmp
- /data/data/####/ec6bc989b1ade1ed3f09e2c6efec728e.1.tmp
- /data/data/####/f0823f63051aeb028ad4e8f69006bf43.0.tmp
- /data/data/####/f0823f63051aeb028ad4e8f69006bf43.1.tmp
- /data/data/####/fc07556215540ee1b1a82c7423298b0f.0.tmp
- /data/data/####/fc07556215540ee1b1a82c7423298b0f.1.tmp
- /data/data/####/journal.tmp
- /data/data/####/libbdplayer.so
- /data/data/####/libbdsoundutils.so
- /data/data/####/libhls-download.so
- /data/data/####/libjiagu.so
- /data/data/####/libpcdn.so
- /data/data/####/libstlport_shared.so
- /data/data/####/proc_auxv
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.