Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.ys####.com:80
- TCP(HTTP/1.1) bmob-cd####.b0.upa####.com:80
- TCP(HTTP/1.1) app.w####.cn:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) api.b####.cn:443
- TCP(TLS/1.0) w.ey####.net:443
DNS requests:
- api.b####.cn
- api.ys####.com
- app.w####.cn
- bmob-cd####.b0.upa####.com
- ssl.gst####.com
- w.ey####.net
- www.go####.com
- www.gst####.com
HTTP GET requests:
- api.ys####.com/gonggao.php
- api.ys####.com/user/login_api.php?user=####&pass=####
- app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
- app.w####.cn/action/miniad/ad?app_id=####&udid=####&imsi=####&net=####&b...
- bmob-cd####.b0.upa####.com/2016/10/26/addb4295408b3ae880baa6871a16464f.dex
HTTP POST requests:
- app.w####.cn/action/user_info
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/AppSettings.xml
- /data/data/####/BmobDy.xml
- /data/data/####/CacheTime.dat
- /data/data/####/ShowAdFlag.xml
- /data/data/####/apprate_prefs.xml
- /data/data/####/com.cyhl.wjx_preferences.xml
- /data/data/####/ij.dex
- /data/data/####/libjiagu-64220060.so
- /data/data/####/z.so
- /data/media/####/.nomedia
- /data/media/####/AppPackage.dat
- /data/media/####/CacheTime.dat
- /data/media/####/UnPackage.dat
- /data/media/####/android
Miscellaneous:
Loads the following dynamic libraries:
- bmob
- libjiagu-64220060
- ovpncli
- z
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
