Adware.Plague.670

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Plague.1.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) wx.q####.cn:80
TCP(HTTP/1.1) tinyq####.ove####.b0.####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ff.d####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.h####.koudaib####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) a####.b####.qq.com:8011
TCP(HTTP/1.1) q.q####.cn:80
TCP(TLS/1.0) 1####.217.17.46:443
TCP(TLS/1.0) i####.doub####.com:443
TCP(TLS/1.0) regi####.xm####.xi####.com:443

DNS requests:

7x####.c####.z0.####.com
a####.b####.qq.com
a####.u####.com
and####.b####.qq.com
api.h####.koudaib####.com
ff.d####.com
h####.h####.koudaib####.com
i####.doub####.com
loc.map.b####.com
q.q####.cn
regi####.xm####.xi####.com
res.h####.koudaib####.com
userapi####.uc.cn
wx.q####.cn

HTTP GET requests:

api.h####.koudaib####.com/api/common/aver?version=####&channel=####&ts=#...
api.h####.koudaib####.com/api/common/configs
api.h####.koudaib####.com/api/search/configs
api.h####.koudaib####.com/api/series/comments?sid=####&offset=####&count...
api.h####.koudaib####.com/api/series/detailV3?sid=####
api.h####.koudaib####.com/api/series/indexV2?offset=####&count=####
api.h####.koudaib####.com/api/series/itemRefV3?pid=####
api.h####.koudaib####.com/bbs/api/forum/seriesTopics?sid=####&page=####
ff.d####.com/contents/origin/6b1f14becaff4694b28ad014e3368099?biz_id=####
q.q####.cn/qqapp/1105303990/701D8C411EF3BCD142C3E1E34BF91401/100
q.q####.cn/qqapp/1105303990/B3F0C8093AF623083559FD5F6EA90FCD/100
tinyq####.ove####.b0.####.com/base_a_4d6ae438170525525ac90f3ca5acc760
tinyq####.ove####.b0.####.com/bd_a_v1
tinyq####.ove####.b0.####.com/hj_avatar/Fhuz-DxbUWagsUhQIYONL0INjhYU.jpg
tinyq####.ove####.b0.####.com/hj_avatar/ForjE5GMZAZJKreobV_5sV9_CJNo.jpg
tinyq####.ove####.b0.####.com/hj_res/Fg1va-RL1MSvn68EwnMuEUfLaEMx.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FhkySsrfjezJN8avISC_7N6n2Acg.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FiODrqQTvGB0t6vGWI4akz1cTGot.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FiV398BWWNdgACLPVSNWCIwibmuy.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FlvQoYQ_INM0z0CUnzIlmmqlmypx.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FmKS0wHvkqzZad_wZRtwWzaMWSIL.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FsvxAfkow0QhVGo6buZSyNcYrxJt.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FvFFMG1L-UAL6Flsn9gr_jPtxXt_.jpg?im...
tinyq####.ove####.b0.####.com/hj_res/FvJObgYizffjekzVfx1PXn8ezK2W.jpg?im...
tinyq####.ove####.b0.####.com/qq_a_a69d0bd9609d7f9d8af716e2e4882d62
tinyq####.ove####.b0.####.com/search_a_n_v1.js
tinyq####.ove####.b0.####.com/yk_a_ae1dc0922b9db842062515acdd8a6b8c
wx.q####.cn/mmopen/vi_32/Q0j4TwGTfTJw8uygf1dGIkp6kNVhxz30CzRbRHThtz6I9Ui...

HTTP POST requests:

a####.b####.qq.com:8011/rqd/async
a####.u####.com/app_logs
and####.b####.qq.com/rqd/async
loc.map.b####.com/offline_loc
loc.map.b####.com/sdk.php

Modified file system:

Creates the following files:

/data/data/####/-1118661919-726006901
/data/data/####/-11186619191759761614
/data/data/####/-494099951-2020110049
/data/data/####/-4940999511046383011
/data/data/####/-49409995111890136
/data/data/####/-4940999511356208455
/data/data/####/-4940999512002983739
/data/data/####/-784922308-533922678
/data/data/####/-9529348381814199803
/data/data/####/.imprint
/data/data/####/1309465357773237873
/data/data/####/333650443-121995382
/data/data/####/3336504431953378779
/data/data/####/410804788-1433676193
/data/data/####/bugly_db_-journal
/data/data/####/classes.jar
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dbarqc-journal
/data/data/####/firll.dat
/data/data/####/hanju_app_prefer.xml
/data/data/####/hanjudb.db-journal
/data/data/####/index
/data/data/####/libcuid.so
/data/data/####/local_crash_lock
/data/data/####/mipush.xml
/data/data/####/mipush.xml.bak
/data/data/####/mipush.xml.bak (deleted)
/data/data/####/mipush_extra.xml
/data/data/####/mobclick_agent_online_setting_com.hanju.oubatv.xml
/data/data/####/ofl.config
/data/data/####/ofl_location.db
/data/data/####/ofl_location.db-journal
/data/data/####/ofl_statistics.db
/data/data/####/ofl_statistics.db-journal
/data/data/####/security_info
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/webview.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/0212f0ceb24b0b1f2ca24e6cfd8c8bd0f37aca9765c1b4....0.tmp
/data/media/####/0ec6d107df1bdf13e7c76179a6b0dc4384e3c88f1ac2fe....0.tmp
/data/media/####/1ee614042a7b6aecb0491d61b9eadbfb18849f9db354c1....0.tmp
/data/media/####/1f550171fda5c6d1b6b4ddd71a6632c73bddce64a0bb69....0.tmp
/data/media/####/24c4b4cada2ab4bb020208832bca1c96.js_temp
/data/media/####/327a764c25135aa8c4ea4f1e79d17719.js_temp
/data/media/####/33a34dcd1ffd1fba740da06bb8cd49c58bdb8f8142c42b....0.tmp
/data/media/####/3d3d9c1e8fd6b01782fec3e455d13c701c04c6edbbbd0d....0.tmp
/data/media/####/3f4e89f9f6ab55ea8480d5c93af25c823969f46c6b461e....0.tmp
/data/media/####/45957d44a09478d8656cf7e9bdda52a3adb7c93f4e8ec4....0.tmp
/data/media/####/4b505a7b9e8c8777708b8f70d6e1224218d3fbe0b0abb8....0.tmp
/data/media/####/4c7182b90efe2a3cc369401d2f442bda503f5cb8ef9d7c....0.tmp
/data/media/####/508ec9acb604b534ade655d0946fae38ef2adf3c490812....0.tmp
/data/media/####/50e9a1215cfbc1a9c6b12f1d4f9532ead81ab505642cbf....0.tmp
/data/media/####/57b476d25ff47ee2892240a9278c6fcbf00360f3cb2e68....0.tmp
/data/media/####/5a53150b99c342cddfa1a2f2ef9b71ca383f7e9bb687d1....0.tmp
/data/media/####/666e5d5c241067f94c3486ed77537a0a.js_temp
/data/media/####/68f4c4f2908f4e0db3fc44818a1d727558fee2b249c76a....0.tmp
/data/media/####/8ddb88eba84eebcface62ab589cb7a3de39ba02c88f760....0.tmp
/data/media/####/8e2ca8063765d57680595e2b1cdb195e8d21cb89b97297....0.tmp
/data/media/####/900b144ca6010e74bc9c2195e4904d9c02e2e8c0940109....0.tmp
/data/media/####/9d3331dfa4713c400ec420120af4ae5ce4e5d2a5a677c6....0.tmp
/data/media/####/9ed40943cdcdd874ca7ed4bd629de3b494f8d9621f838c....0.tmp
/data/media/####/a49ed11031f54ef6e41afa680fbe15bb7c3f5d1aecb8d7....0.tmp
/data/media/####/a5b44f048637fcfdd7be5dfcecc1a05bc09d83945ee3b4....0.tmp
/data/media/####/ab66d84961b410b35bbc6f08df42bc85124ba631d468b1....0.tmp
/data/media/####/abaed7c6d8efd8d7e3de7ee44e1b05e6c836f82fdbbd09....0.tmp
/data/media/####/b350819a48b8908ef38abcfacea7789016f24976f277dd....0.tmp
/data/media/####/b709602b5a12a0eb23c2a6a836700507200d758dac9367....0.tmp
/data/media/####/baaa73608f68bf4928da626bfe75dbdabf905068da9379....0.tmp
/data/media/####/bd62e4976e19ff6b56b91db59d124b5c0af5f86da148bd....0.tmp
/data/media/####/c002ec9e82fdc9e187c0ba62f12a0e947ddc15f7649035....0.tmp
/data/media/####/c842503a8125b0bbe0c7ef8641e5931d.js_temp
/data/media/####/ca9e19213c1ca6644f5de660b205379460459c9ba99aa3....0.tmp
/data/media/####/cbc1ee65dbc170c497cd416ed7bad9bf449a9fc969ae78....0.tmp
/data/media/####/cfd06293ddc1e1bc03767a3502bfb778e42bc82257e298....0.tmp
/data/media/####/com.tencent.mobileqq_connectSdk.18.05.02.12.log
/data/media/####/conlts.dat
/data/media/####/d9360bb1ff5a2113826009492d616728bedba8de093231....0.tmp
/data/media/####/e29f3145ae800c2ef1129edf849989a927e5a90ccfba8e....0.tmp
/data/media/####/e73f839396bfed7b7677b9613276a30ae486c1ca8777a8....0.tmp
/data/media/####/eaf898f745783308f7d34916c4d59c19934aa892384855....0.tmp
/data/media/####/f45b43de74be3ed66b6164321e3a1cbec792cb423d7a3d....0.tmp
/data/media/####/f475ffec6637c42bd681e2ba6ead0ffc9276c72c236380....0.tmp
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/ller.dat
/data/media/####/log.lock
/data/media/####/log1.txt
/data/media/####/ls.db
/data/media/####/ls.db-journal
/data/media/####/search_a_n_v1.js_temp
/data/media/####/test.0
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/sh -c getprop androVM.vbox_dpi
/system/bin/sh -c getprop gsm.sim.state
/system/bin/sh -c getprop gsm.sim.state2
/system/bin/sh -c getprop qemu.sf.fake_camera
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.debuggable
/system/bin/sh -c getprop ro.genymotion.version
/system/bin/sh -c getprop ro.secure
/system/bin/sh -c type su
getprop androVM.vbox_dpi
getprop gsm.sim.state
getprop gsm.sim.state2
getprop qemu.sf.fake_camera
getprop ro.board.platform
getprop ro.debuggable
getprop ro.genymotion.version
getprop ro.secure

Loads the following dynamic libraries:

Bugly
locSDK6a
ndkbitmap

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial