Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) i0.h####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) bst####.h####.com:443
- TCP(TLS/1.0) a.w.bili####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.2) and####.a####.go####.com:443
- TCP(TLS/1.2) 74.1####.205.94:443
- TCP(TLS/1.2) 64.2####.165.95:443
- TCP(TLS/1.2) 1####.251.1.100:443
- TCP arm.lc####.cn:10003
- TCP arm.lc####.cn:10008
- UDP rr2---s####.g####.com:443
- UDP rr1---s####.g####.com:443
- UDP p####.google####.com:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- api.bili####.com
- arm.lc####.cn
- b####.tv
- i0.h####.com
- m.bili####.com
- p####.google####.com
- rr1---s####.g####.com
- rr2---s####.g####.com
- s####.bili####.com
- s1.h####.com
File system changes:
Creates the following files:
- /data/data/####/09079053a6a1c19e_0
- /data/data/####/09079053a6a1c19e_1
- /data/data/####/1f95249cf7429a31_0
- /data/data/####/208fa62ce78cc4ab_0
- /data/data/####/243e02789d335bde_0
- /data/data/####/243e02789d335bde_1
- /data/data/####/2a675a8157ac81c0_0
- /data/data/####/2bdcb08e607d5bd0_0
- /data/data/####/2da0522f5fbfb086_0
- /data/data/####/315a3c73b3bd4325_0
- /data/data/####/34507f70097d63bb_0
- /data/data/####/34c2c5b9109a7ffa_0
- /data/data/####/3932d995107ad947_0
- /data/data/####/3932d995107ad947_1
- /data/data/####/3baa8fa11fd3d56e_0
- /data/data/####/4180eced2c560289_0
- /data/data/####/4343129f867c062e_0
- /data/data/####/45b45bc61c3a30db_0
- /data/data/####/46704649d53e668d_0
- /data/data/####/46704649d53e668d_1
- /data/data/####/4aea733ccb3ec04d_0
- /data/data/####/4d02e6b2d0af4610_0
- /data/data/####/51e9e59faf03628b_0
- /data/data/####/51e9e59faf03628b_1
- /data/data/####/579be784272c8f99_0
- /data/data/####/60ff76364fe3d91b_0
- /data/data/####/61924b2ed995e631_0
- /data/data/####/62247e77d77888cc_0
- /data/data/####/68b27a8af49a7378_0
- /data/data/####/6c4b4352835df82f_0
- /data/data/####/6caf9dc8eef172c7_0
- /data/data/####/723dfa60aa07e8b1_0
- /data/data/####/74e148a68197f4e7_0
- /data/data/####/7fd60edc2da4c7fd_0
- /data/data/####/80401b32b222163e_0
- /data/data/####/81ce958807fde27f_0
- /data/data/####/82e2530561257a40_0
- /data/data/####/82e5e2cf97402d5f_0
- /data/data/####/880410e6beab3100_0
- /data/data/####/880410e6beab3100_1
- /data/data/####/8b772e8b3f50c172_0
- /data/data/####/8c849c2c797c510a_0
- /data/data/####/8ccdb3668d3d97d8_0
- /data/data/####/95f338b313885687_0
- /data/data/####/96663e2f07dcf3bc_0
- /data/data/####/97f079848ecf2191_0
- /data/data/####/98e6b4419873eedd_0
- /data/data/####/9ca4bba4bbb1d39c_0
- /data/data/####/9ca4bba4bbb1d39c_1
- /data/data/####/9f290f283289e7ca_0
- /data/data/####/9f8e1676db5f7daf_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a0d119b36736d065_0
- /data/data/####/a406e635c48856c3_0
- /data/data/####/a406e635c48856c3_1
- /data/data/####/a8666c2538ff6899_0
- /data/data/####/a99cf3dd90d62b4c_0
- /data/data/####/ac82387c3750b533_0
- /data/data/####/ad51ed14fd105a02_0
- /data/data/####/b1952c604ac33bca_0
- /data/data/####/b29b8e4915a10615_0
- /data/data/####/bb191d2c54d92c8e_0
- /data/data/####/c0b9c8cf1bf527a6_0
- /data/data/####/c1693e2d5921910d_0
- /data/data/####/c9f2404d241e74fa_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/d0394dde750123d8_0
- /data/data/####/d11b5ccb33f4b0b1_0
- /data/data/####/d1d5cd05f1836f45_0
- /data/data/####/d1d5cd05f1836f45_1
- /data/data/####/d2be225c5b60e520_0
- /data/data/####/d3bc057160606104_0
- /data/data/####/d7019394d09a7713_0
- /data/data/####/dba034e021ea323b_0
- /data/data/####/dce7e249ef7a42d4_0
- /data/data/####/e0251213eb8a064e_0
- /data/data/####/e8d4f3e2dff75cf3_0
- /data/data/####/ebdce8f60badd8b9_0
- /data/data/####/ed689a2ef76559bc_0
- /data/data/####/f0fa56d690f20616_0
- /data/data/####/f3bd555ae79d9b7d_0
- /data/data/####/f4420388b6056e80_0
- /data/data/####/f79fc33aa71638fb_0
- /data/data/####/f8a5f0d249700d45_0
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/notice.xml
- /data/data/####/proc_auxv
- /data/data/####/qbige.nb_preferences.xml
- /data/data/####/the-real-index
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libarm
- libjiagu
- libluajava
- libygsiyu
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about network.
Displays its own windows over windows of other apps.
Requests the system alert window permission.