Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) ub####.baidust####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) wc.find####.cc.####.com:80
- TCP(HTTP/1.1) cdn.web####.you####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) www.miitb####.gov.cn:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) pub.idq####.com.####.com:80
- TCP(HTTP/1.1) www.dou####.com:80
- TCP(HTTP/1.1) s.un####.com:80
- TCP(HTTP/1.1) nsc####.b####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) p####.kaip####.cn:80
- TCP(HTTP/1.1) i4.w####.com:80
- TCP(HTTP/1.1) go####.b####.com:80
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) m.go####.b####.com:443
- TCP(TLS/1.0) hm.b####.com:443
DNS requests:
- a####.u####.com
- api.s####.b####.com
- b####.s####.b####.com
- c####.baidust####.com
- cdn.web####.you####.com
- dup.baidust####.com
- ec####.b####.com
- go####.b####.com
- hm.b####.com
- i4.w####.com
- m.go####.b####.com
- mo####.b####.com
- mobads-####.b####.com
- nsc####.b####.com
- p####.kaip####.cn
- pos.b####.com
- pub.idq####.com
- s.un####.com
- ub####.baidust####.com
- wc.find####.cc
- www.dou####.com
- www.miitb####.gov.cn
HTTP GET requests:
- c####.baidust####.com/cpro/ui/c.js
- c####.baidust####.com/cpro/ui/noexpire/img/mob_adicon.png
- c####.baidust####.com/sync.htm?cproid=####
- cdn.web####.you####.com/webfonts/nomal/114990/46870/5a9f9848f629d800543a...
- dup.baidust####.com/tpl/ctm3.js
- go####.b####.com/
- go####.b####.com/dist/css/app.css
- go####.b####.com/dist/css/init.css
- go####.b####.com/dist/index.html
- go####.b####.com/dist/js/animateBackground-plugin.js
- go####.b####.com/dist/js/app.js
- go####.b####.com/dist/js/jquery.min.js
- go####.b####.com/dist/js/jquery.qrcode.min.js
- go####.b####.com/dist/js/main.js
- go####.b####.com/dist/js/particles.js
- go####.b####.com/dist/js/platform.js
- hm.b####.com/h.js?61eade8####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- i4.w####.com/item/1508/21/55d6af11a5296_wx.jpg
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/__pasys.apk
- mo####.b####.com/ads/pa/__pasys.php
- mo####.b####.com/ads/pa/__pasys_remote_banner.jar
- mo####.b####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####...
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525572408804=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525572439137=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1525572469789=####
- nsc####.b####.com/v.gif?pid=####&type=####&l=####&t=####&s=####&v=####&f...
- nsc####.b####.com/v.gif?pid=####&type=####&sign=####&desturl=####&linkid...
- p####.kaip####.cn/exposure/images/jiucuo.png?v=####
- p####.kaip####.cn/exposure/jiucuo.js
- pos.b####.com/scmm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/scmm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/sync_pos.htm?cproid=####
- pub.idq####.com.####.com/wpa/images/group.png
- s####.jom####.com/static/api/css/share_style1_24.css
- s####.jom####.com/static/api/img/share/icons_1_24.png?v=####
- s####.jom####.com/static/api/js/base/tangram.js?v=####
- s####.jom####.com/static/api/js/component/partners.js?v=####
- s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
- s####.jom####.com/static/api/js/share/api_base.js
- s####.jom####.com/static/api/js/share/share_api.js?v=####
- s####.jom####.com/static/api/js/trans/logger.js?v=####
- s####.jom####.com/static/api/js/view/share_view.js?v=####
- s####.jom####.com/static/api/js/view/view_base.js
- s####.jom####.com/v.gif
- ub####.baidust####.com/media/v1/0f000j1FY_bkyl3FJ2tGa6.jpg
- wc.find####.cc.####.com/2011/rio.jar
- www.dou####.com/css/doubean.css?ver=####
- www.dou####.com/face/
- www.dou####.com/face/css/face.css?ver=####
- www.dou####.com/face/js/face.js?ver=####
- www.dou####.com/js/doubean.js?ver=####
- www.dou####.com/js/jquery-1.9.1.min.js
- www.dou####.com/plugin/jquery-ui-1.11.2.custom/jquery-ui.min.css
- www.dou####.com/plugin/jquery-ui-1.11.2.custom/jquery-ui.min.js
- www.miitb####.gov.cn/
- www.miitb####.gov.cn/images/new/bg05.png
- www.miitb####.gov.cn/images/new/top03.gif
- www.miitb####.gov.cn/images/portal_0/new/logo01.png
- www.miitb####.gov.cn/images/portal_0/new/top02.gif
- www.miitb####.gov.cn/images/portal_0/portal/hotline.png
- www.miitb####.gov.cn/images/portal_0/portal/more.gif
- www.miitb####.gov.cn/images/portal_0/portal/pic_01.gif
- www.miitb####.gov.cn/images/portal_0/portal/pic_02.gif
- www.miitb####.gov.cn/images/top/0.png
- www.miitb####.gov.cn/scripts/ValidateTools.js
- www.miitb####.gov.cn/scripts/common-validate.js
- www.miitb####.gov.cn/scripts/jquery.js
- www.miitb####.gov.cn/scripts/jquery.js;jsessionid=Xekw3Ptjwf9TRbVjotwjbs...
- www.miitb####.gov.cn/scripts/maskDialog/maskDialog.css
- www.miitb####.gov.cn/scripts/maskDialog/maskDialog.js
- www.miitb####.gov.cn/state/outPortal/ipFlowDownload.action?fileName=####
- www.miitb####.gov.cn/styles/portal.css
- www.miitb####.gov.cn/styles/styles.css
HTTP POST requests:
- a####.u####.com/app_logs
- s.un####.com/cw/cp.action?requestId=####&g=####
- s.un####.com/cw/interface!u2.action?protocol=####&version=####
- www.miitb####.gov.cn/state/outPortal/loginPortal.action;jsessionid=Xekw3...
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/W_Key.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/__pasys.apk.beforesign.tm
- /data/data/####/__pasys_remote_banner.jar.beforesign.tm
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/index
- /data/data/####/mobclick_agent_online_setting_com.moon.hao2.biaoqing2.xml
- /data/data/####/st.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/3.6_rio.jar.tmp
- /data/media/####/assetstime.dat
Miscellaneous:
Loads the following dynamic libraries:
- ke
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
