Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.248.origin
- Android.Triada.373.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) 2####.86.5.167:14840
- TCP(HTTP/1.1) f.up.v####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(TLS/1.0) pay.v####.com.cn:443
DNS requests:
- a####.u####.com
- f.up.v####.####.cn
- int.d####.s####.####.cn
- mi.g####.qq.com
- pay.v####.com.cn
- qzones####.g####.cn
- s####.e.qq.com
HTTP GET requests:
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-close.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/inter_close_lo...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/popup_ad_car_b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.appcache
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/i...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
HTTP POST requests:
- a####.u####.com/app_logs
- f.up.v####.####.com/usrsys/reportUsrsys?version=####
- int.d####.s####.####.cn/iplookup/iplookup.php
- s####.e.qq.com/activate
- s####.e.qq.com/launch
Modified file system:
Creates the following files:
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/update_lc
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/cache/####/-1143945219847306209
- <Package Folder>/cache/####/ApplicationCache.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/GDTSDK.db
- <Package Folder>/databases/GDTSDK.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/trackevents.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/unionuserinfo.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/0uYrWxOh-JPIxaTu1X_8Qg==.new
- <Package Folder>/files/####/5RmZVH2bwaNKnqcw
- <Package Folder>/files/####/BTAZAunmPHSvTawcaSpN9A==.new
- <Package Folder>/files/####/XBb9A3xwYBPVcKEA.zip
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/iBXw0UT5UIp8w16F7Lzk1w==
- <Package Folder>/files/####/lBnEoVYxPv1-HkV5e4bKSg==
- <Package Folder>/files/####/txaiag_f.zip
- <Package Folder>/files/####/vivounionapk_v2.2.1_a1381cb_201704101737.vua
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/rdata_comeivzkyizpv.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/BuglySdkInfos.xml
- <Package Folder>/shared_prefs/CitiGame.ini.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/gamedata.xml
- <Package Folder>/shared_prefs/prefs_vivounionsdk.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.vivoAccountsdk/sdkaccountinfo.db
- <SD-Card>/.vivoAccountsdk/sdkaccountinfo.db-journal
- <SD-Card>/.vivounionapk/vivounionapk_v2.2.1_a1381cb_201704101737.vua
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/sysid.dat
Miscellaneous:
Loads the following dynamic libraries:
- cocos2dcpp
- vivo_account_sdk
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
