Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.248.origin
- Android.Triada.373.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) zvi####.v.bsc####.cn:80
- TCP(HTTP/1.1) 1####.159.53.238:80
- TCP(HTTP/1.1) i.t####.com:80
- TCP(HTTP/1.1) 1####.159.208.192:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) gv1.x####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) pay.v####.com.cn:443
DNS requests:
- adser####.go####.com
- c####.x####.com
- f.up.v####.####.cn
- gv1.x####.com
- i.t####.com
- pay.v####.com.cn
- ssl.gst####.com
- unitedp####.lemuel####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
HTTP GET requests:
- i.t####.com/a/39cc255f4396af00c348e34c55868f4a2
HTTP POST requests:
- zvi####.v.bsc####.cn/usrsys/reportUsrsys?version=####
Modified file system:
Creates the following files:
- /data/data/####/-1143945219847306209
- /data/data/####/0406f746562c3b7d32bd829f14df7d7c|account_file.xml
- /data/data/####/1524645514647_2076
- /data/data/####/1524645515155_2076
- /data/data/####/1524645515534_2076
- /data/data/####/1524645516247_2076
- /data/data/####/1524645516400_2076
- /data/data/####/1524645516823_2076
- /data/data/####/1524645517025_2076
- /data/data/####/1524645517226_2076
- /data/data/####/2171c1261a460735.jar
- /data/data/####/2965231173988718.jar
- /data/data/####/2f38b4e5f4aae1ee.jar
- /data/data/####/3999c096056ba6eb.jar
- /data/data/####/5a68a5445b68e4db.jar
- /data/data/####/9UZPZXV_PGAQipnN2nsxig==.new
- /data/data/####/Archimedes_p4
- /data/data/####/Archimedes_p5
- /data/data/####/D3woW1ormDuSNW-GGL8tSA==.new
- /data/data/####/ETDxSyw0QvWE8ggO3GzC6A==
- /data/data/####/Et2NJtqi6NAOwXpD
- /data/data/####/Pythagoras_phase.xml
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_cloudcontrol3.xml
- /data/data/####/TDpref_game.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime3.xml
- /data/data/####/UNITEDPAYACTLIST_
- /data/data/####/codex.so
- /data/data/####/codex_inner.so
- /data/data/####/com.cqwx.hcrss.vivo.v2.playerprefs.xml
- /data/data/####/com.cqwx.hcrss.vivo_preferences.xml
- /data/data/####/dHkUeVTaU2K36Pxjv6k-dQ==
- /data/data/####/fb3d53bd85df9f35.jar
- /data/data/####/lemuel_security_inner.so
- /data/data/####/mPBE.xml
- /data/data/####/prefs_vivounionsdk.xml
- /data/data/####/rdata_comcqwxhcrsshuawei.new
- /data/data/####/tdid.xml
- /data/data/####/trackevents.db-journal
- /data/data/####/tuzva_f.zip
- /data/data/####/uWQ2X_p7xxFbGw_x.zip
- /data/data/####/unionuserinfo.db-journal
- /data/data/####/vivounionapk_v2.2.1_a1381cb_201704101737.vua
- /data/media/####/.tcookieid
- /data/media/####/sdkaccountinfo.db
- /data/media/####/sdkaccountinfo.db-journal
- /data/media/####/vivounionapk_v2.2.1_a1381cb_201704101737.vua
Miscellaneous:
Executes next shell scripts:
- getprop
Loads the following dynamic libraries:
- AudioPluginOculusSpatializer
- _lemuel_security
- codex
- codex_inner
- lemuel_security_inner
- libAudioPluginOculusSpatializer
- main
- vivo_account_sdk
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
