Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Ninebox.4.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) u####.v.tr####.net:80
- TCP(HTTP/1.1) c.nin####.cn:80
- TCP(HTTP/1.1) s.nin####.cn:80
DNS requests:
- c.nin####.cn
- mi.ny####.com
- s.nin####.cn
HTTP GET requests:
- u####.v.tr####.net/download/sci/4.png
HTTP POST requests:
- c.nin####.cn/admin/bcp.action?requestId=####
- s.nin####.cn/admin/sc.action?requestId=####
File system changes:
Creates the following files:
- /data/data/####/1542951779346.jar
- /data/data/####/1542951779414.jar
- /data/data/####/1542951779450.jar
- /data/data/####/1542951779473.jar
- /data/data/####/1542951779552.jar
- /data/data/####/1542951783777.jar
- /data/data/####/1542951783918.jar
- /data/data/####/1542951783936.jar
- /data/data/####/1542951784131.jar
- /data/data/####/1542951784405.jar
- /data/data/####/1542951784738.jar
- /data/data/####/1542951788360.jar
- /data/data/####/1542951788386.jar
- /data/data/####/1542951788495.jar
- /data/data/####/1542951788613.jar
- /data/data/####/1542951788858.jar
- /data/data/####/1542951789040.jar
- /data/data/####/1542951789408.jar
- /data/data/####/1542951792177.jar
- /data/data/####/1542951792184.jar
- /data/data/####/1542951792260.jar
- /data/data/####/1542951792305.jar
- /data/data/####/1542951792401.jar
- /data/data/####/1542951795931.jar
- /data/data/####/1542951795958.jar
- /data/data/####/1542951796019.jar
- /data/data/####/1542951796069.jar
- /data/data/####/1542951796090.jar
- /data/data/####/1542951798353.jar
- /data/data/####/1542951798375.jar
- /data/data/####/1542951798423.jar
- /data/data/####/1542951798489.jar
- /data/data/####/1542951798552.jar
- /data/data/####/1542951798905.jar
- /data/data/####/1542951802092.jar
- /data/data/####/1542951802101.jar
- /data/data/####/1542951802151.jar
- /data/data/####/1542951802198.jar
- /data/data/####/1542951802235.jar
- /data/data/####/1542951805729.jar
- /data/data/####/1542951805766.jar
- /data/data/####/1542951805823.jar
- /data/data/####/1542951805903.jar
- /data/data/####/1542951806246.jar
- /data/data/####/1542951806438.jar
- /data/data/####/1542951810111.jar
- /data/data/####/1542951810160.jar
- /data/data/####/1542951810163.jar
- /data/data/####/1542951810177.jar
- /data/data/####/1542951810328.jar
- /data/data/####/1542951813795.jar
- /data/data/####/1542951813815.jar
- /data/data/####/1542951813828.jar
- /data/data/####/1542951813915.jar
- /data/data/####/1542951814021.jar
- /data/data/####/1542951817772.jar
- /data/data/####/1542951817833.jar
- /data/data/####/1542951817905.jar
- /data/data/####/1542951817919.jar
- /data/data/####/1542951817961.jar
- /data/data/####/1542951821534.jar
- /data/data/####/1542951821536.jar
- /data/data/####/1542951821656.jar
- /data/data/####/1542951821671.jar
- /data/data/####/1542951822040.jar
- /data/data/####/1542951822231.jar
- /data/data/####/1542951826419.jar
- /data/data/####/1542951826448.jar
- /data/data/####/1542951826487.jar
- /data/data/####/1542951826581.jar
- /data/data/####/1542951826606.jar
- /data/data/####/1542951831315.jar
- /data/data/####/1542951831317.jar
- /data/data/####/1542951831372.jar
- /data/data/####/1542951831444.jar
- /data/data/####/1542951831523.jar
- /data/data/####/1542951834127.jar
- /data/data/####/1542951834135.jar
- /data/data/####/1542951834267.jar
- /data/data/####/1542951834271.jar
- /data/data/####/1542951834397.jar
- /data/data/####/1542951834594.jar
- /data/data/####/1542951837487.jar
- /data/data/####/1542951837519.jar
- /data/data/####/1542951837528.jar
- /data/data/####/1542951837557.jar
- /data/data/####/1542951837600.jar
- /data/data/####/1542951837943.jar
- /data/data/####/1542951844107.jar
- /data/data/####/1542951844287.jar
- /data/data/####/1542951844943.jar
- /data/data/####/1542951845075.jar
- /data/data/####/1542951845238.jar
- /data/data/####/LocationType.xml
- /data/data/####/SIDEBAR_PRESENTS.xml
- /data/data/####/bigPoins.xml
- /data/data/####/box_cp_states.xml
- /data/data/####/boxcpdownloads
- /data/data/####/boxcpdownloads-journal
- /data/data/####/dij.xml
- /data/data/####/dim.xml
- /data/data/####/j-id.xml
- /data/data/####/mid.xml
- /data/data/####/running_app_name.xml
- /data/data/####/short_create.xml
- /data/data/####/shortoutnamesha.xml
- /data/data/####/type.xml
- /data/data/####/xy.xml
- /data/media/####/1.dat
- /data/media/####/12.dat
- /data/media/####/MID.DAT
- /data/media/####/com.iqinbao.android.oversizeer.png
- /data/media/####/names.dat
- /data/media/####/share.dat
- /data/media/####/st.dat
Miscellaneous:
Loads the following dynamic libraries:
- main
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Displays its own windows over windows of other apps.
