Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.3567
- Android.DownLoader.714.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) ia.z####.net:80
- TCP(HTTP/1.1) ic.o####.net:80
DNS requests:
- a####.u####.com
- ia.xuan####.com
- ia.z####.net
- ic.o####.net
HTTP POST requests:
- a####.u####.com/app_logs
- ia.z####.net/ps/actionLog.do
- ia.z####.net/ps/appShare.do
- ia.z####.net/ps/dataPullShile.do
- ia.z####.net/ps/userMobileInfo.do
- ia.z####.net/ps/userSdkInfo.do
- ic.o####.net/domain/domainConfig.do
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/058a4aba15f56899ce041359aeb21bd0
- /data/data/####/058a4aba15f56899ce041359aeb21bd0.jar
- /data/data/####/49d44446-a21b-3829-8e4f-c569fd9da7f1.cpo
- /data/data/####/49d44446-a21b-3829-8e4f-c569fd9da7f1.dex
- /data/data/####/49d44446-a21b-3829-8e4f-c569fd9da7f1.inf
- /data/data/####/49d44446-a21b-3829-8e4f-c569fd9da7f1.jar
- /data/data/####/51a08048-9528-3351-99f8-10ff9eeeb043.cpo
- /data/data/####/51a08048-9528-3351-99f8-10ff9eeeb043.dex
- /data/data/####/51a08048-9528-3351-99f8-10ff9eeeb043.inf
- /data/data/####/51a08048-9528-3351-99f8-10ff9eeeb043.jar
- /data/data/####/65dbb9168ad4b5bf2cc1f888166d0e82.jar
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/Framework.db
- /data/data/####/Framework.db-journal
- /data/data/####/PlatformCore.db
- /data/data/####/PlatformCore.db-journal
- /data/data/####/app_bid
- /data/data/####/app_caller
- /data/data/####/app_mid
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.instant.pro
- /data/data/####/common
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/mobile_init.dat
- /data/data/####/mutex.dat
- /data/data/####/sdk_init.dat
- /data/data/####/sdk_version.dat
- /data/data/####/service_info.dat
- /data/data/####/shield_init.dat
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_script.dat
- /data/media/####/49d44446a21b6829ce4fc569fd9da7f1
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app_mutex.lock
- /data/media/####/config.dat
- /data/media/####/setting.dat
- /data/media/####/system.dat
- /data/media/####/system_meta.config
Miscellaneous:
Executes next shell scripts:
- cat /proc/meminfo
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- getprop ro.miui.ui.version.name
- getprop ro.yunos.version
- ls /sys/devices/system/cpu
- ping -c 2 ia.in6way.com
- ping -c 2 ia.xuanwu88.com
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
