Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.1274.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) st####.3####.com:443
- TCP(TLS/1.0) i####.zym####.com.####.cn:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.0) at.al####.com:443
- TCP(TLS/1.0) m.z####.cn:443
- TCP(TLS/1.0) g####.mm####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) www.a.sh####.com:443
- TCP(TLS/1.0) api.ifly####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) zz.bdst####.com:443
- TCP(TLS/1.2) p####.google####.com:443
- UDP p####.google####.com:443
DNS requests:
- 2.and####.p####.####.org
- api.ifly####.com
- at.al####.com
- c####.mm####.com
- c.c####.com
- hm.b####.com
- i####.zym####.com
- m.z####.cn
- p####.google####.com
- p####.google####.com.####.8
- rr1---s####.g####.com
- sp0.b####.com
- st####.3####.com
- v####.c####.com
- z13.c####.com
- z4.c####.com
- zz.bdst####.com
HTTP GET requests:
- api.ifly####.com:443/notes/share/note/shareFileDetail?fid=####
File system changes:
Creates the following files:
- /data/data/####/00bd0d43384e6231_0
- /data/data/####/00cdd9fa7979663d_0
- /data/data/####/06980ec9b2bb78ff_0
- /data/data/####/0b8d97464bab6011_0
- /data/data/####/0b8d97464bab6011_1
- /data/data/####/0c796661d0dada43_0
- /data/data/####/0e0ce3c39d35704c_0
- /data/data/####/0f180eb03856629c_0
- /data/data/####/115ebefaf5b191b0_0
- /data/data/####/15b5adb7c9fac9ef_0
- /data/data/####/15f48fb1301dff49_0
- /data/data/####/1656065e3d08d9eb_0
- /data/data/####/193ce204d3052ff8_0
- /data/data/####/193ce204d3052ff8_1
- /data/data/####/1b096e5ddfd3962e_0
- /data/data/####/1d1af229b80c00e5_0
- /data/data/####/1e625cb0498c30fa_0
- /data/data/####/203a0e95e10e165b_0
- /data/data/####/22d4491dbe3b375a_0 (deleted)
- /data/data/####/29ddcdfc9a84fb58_0
- /data/data/####/2bc76367511cd861_0
- /data/data/####/32674ccd2b87fa3d_0
- /data/data/####/3d1ba23728903448_0
- /data/data/####/3d1ba23728903448_1
- /data/data/####/434851b5d1ea1be0_0
- /data/data/####/4432653caa23556f_0
- /data/data/####/4b0b7304d8975b25_0
- /data/data/####/4d9039338a81c7be_0 (deleted)
- /data/data/####/4f37bf60001a7aeb_0
- /data/data/####/54d3f07033694b61_0
- /data/data/####/5785e38177382e35_0
- /data/data/####/5c9cbeb047fd692d_0
- /data/data/####/6baea505b80601c3_0
- /data/data/####/6c6008ad5f7c132b_0
- /data/data/####/6cb1e49171dcc5af_0
- /data/data/####/79c6f661865a796a_0
- /data/data/####/79c6f661865a796a_1
- /data/data/####/88b4d7a563b679f2_0
- /data/data/####/89c8f16113b63df4_0
- /data/data/####/8a4ffcf4cc598df3_0
- /data/data/####/911310fd215a6aa0_0
- /data/data/####/92e660f4391f5828_0
- /data/data/####/9a273d7aebc8c21b_0
- /data/data/####/9c4e7188d0ca5bf9_0
- /data/data/####/9c7b147bbbb4c105_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a4fdeac39e817e42_0
- /data/data/####/a6fe388703175c05_0
- /data/data/####/a6fe388703175c05_1
- /data/data/####/b56f9250ab79e08b_0
- /data/data/####/b790299ab6396740_0
- /data/data/####/bab173d2784623a9_0
- /data/data/####/baf186122109276a_0
- /data/data/####/bf66a7b887d6877a_0
- /data/data/####/c1ec68fb463cc1e9_0
- /data/data/####/c1ec68fb463cc1e9_1
- /data/data/####/c71e89c31de12683_0
- /data/data/####/c71e89c31de12683_1
- /data/data/####/ce8ca15961e0eb3c_0
- /data/data/####/ce8ca15961e0eb3c_1
- /data/data/####/cfada309b4730d3f_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/com.guaidaomanke_preferences.xml
- /data/data/####/d318c1302d0038f9_0
- /data/data/####/d58cf05392497d09_0
- /data/data/####/d627634738a9b87e_0
- /data/data/####/e1b8413b4d885705_0
- /data/data/####/e5df7f6900e7a979_0
- /data/data/####/e6a7229ce53202bc_0
- /data/data/####/e6a7229ce53202bc_1
- /data/data/####/efa77f4c0336b39b_0 (deleted)
- /data/data/####/f6d17dd012b6e57e_0
- /data/data/####/f7b3dc247d76c755_0
- /data/data/####/fe42b24d5d3349e0_0
- /data/data/####/fe42b24d5d3349e0_1
- /data/data/####/https_m.zymk.cn_0.localstorage-journal
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
- libluajava
- libygsiyu
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about installed apps.
Displays its own windows over windows of other apps.