Adware.DownLoader.1712

Technical information

Malicious functions:

Downloads the following detected threats from the Internet:

Adware.Waps.5.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) c####.ggdawa####.com:80
TCP(HTTP/1.1) ev####.ggdawa####.com:80
UDP(NTP) 1.cn.p####.####.org:123
TCP(TLS/1.0) av1.x####.com:443
TCP(TLS/1.0) c####.x####.com:443
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) bbs.ggzhu####.cn:443

DNS requests:

1.cn.p####.####.org
av1.x####.com
bbs.ggzhu####.cn
c####.ggdawa####.com
c####.ggdawa####.com
c####.x####.com
ev####.ggdawa####.com
i####.cn
is.sn####.com
l####.tbs.qq.com
sf3-ttc####.ps####.com

HTTP GET requests:

c####.ggdawa####.com/ceshizu/plugins/20191119/novel-风云爬虫MOD-com.reader.p...
c####.ggdawa####.com/ceshizu/plugins/20191119/笔趣爬虫MOD-com.reader.plugin....
c####.ggdawa####.com/ceshizu/plugins/20191122/novel-追书爬虫MOD-com.reader.p...
c####.ggdawa####.com/ceshizu/test/2019.02.22/番茄爬虫MOD-com.reader.plugin.f...
c####.ggdawa####.com/ceshizu/test/2019.02.22/笔趣爬虫MOD(读)-com.reader.plugi...
c####.ggdawa####.com/ceshizu/test/2019.03.26/笔趣爬虫MOD(新)-com.reader.plugi...
c####.ggdawa####.com/ceshizu/test/2019.04.10/picture-2717图片MOD-com.pictu...
c####.ggdawa####.com/ceshizu/test/2019.04.10/picture-彼岸图MOD-com.reader.p...
c####.ggdawa####.com/ceshizu/test/2019.05/2019.05.16/novel-轻小说爬虫MOD-com....
c####.ggdawa####.com/ceshizu/test/20190723/novel-起点爬虫MOD-com.reader.plug...
c####.ggdawa####.com/ggziyuan3/moniqi/ApkIDE_My Boy!V1.8.0_89.apk
c####.ggdawa####.com/ggziyuan3/moniqi/ApkIDE_liu_122.apk
c####.ggdawa####.com/ggziyuan3/moniqi/FBA4-1.74_535.apk
c####.ggdawa####.com/ggziyuan3/moniqi/MAME4droid 0.139u1-1.12.5_53.apk
c####.ggdawa####.com/ggziyuan3/moniqi/ppsspp13.apk

HTTP POST requests:

ev####.ggdawa####.com/ggdawanjia/event/put
l####.tbs.qq.com/ajax?c=####&k=####

File system changes:

Creates the following files:

/data/data/####/-5998622401067643521
/data/data/####/0476fd1b42140858892175f2ebbb576c
/data/data/####/1021689741840853517
/data/data/####/122.apk
/data/data/####/18000013.apk
/data/data/####/20150535.apk
/data/data/####/53.apk
/data/data/####/90089.apk
/data/data/####/MultiDex.lock
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/TDCloudSettingsConfig339AFDF1983840A6BC357B1535878A65.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/box_launch_mode_key
/data/data/####/com.iplay.assistant-1.apk.classes2.zip.tmp
/data/data/####/com.iplay.assistant-1.apk.classes3.zip.tmp
/data/data/####/com.iplay.assistant_preferences.xml
/data/data/####/com.yyhd.tracker.api
/data/data/####/com.yyhd.tracker.api-journal
/data/data/####/com.yyhd.tracker.api.com.iplay.assistant.xml
/data/data/####/com.yyhd.tracker.db
/data/data/####/com.yyhd.tracker.db-journal
/data/data/####/configuration.xml
/data/data/####/core_info
/data/data/####/dependence_app.xml
/data/data/####/downloader.db-journal
/data/data/####/gg_version
/data/data/####/localgame
/data/data/####/macAddress
/data/data/####/multidex.version.xml
/data/data/####/okdownload-breakpoint.db-journal
/data/data/####/packages.ini
/data/data/####/packages_cache.ini
/data/data/####/plugin-center.apk
/data/data/####/plugin-controller.apk
/data/data/####/plugin-loader.apk
/data/data/####/plugin-lvl.apk
/data/data/####/sp_push_time.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/tdlock.txt
/data/data/####/timeLineFile
/data/data/####/tmp-com.iplay.assistant-1.apk.classes-137468305.zip
/data/data/####/tmp-com.iplay.assistant-1.apk.classes902992619.zip
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopenadsdk.xml.bak
/data/data/####/ttopensdk.db-journal
/data/data/####/yy_download.db-journal
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/0d5346a81701c18ac917d2f151837a95.tmp
/data/media/####/1.apk
/data/media/####/a3dd56ef78e0ce5aea65cdbb36b08a4f.tmp
/data/media/####/com.picture.plugin.biantu.apk
/data/media/####/com.picture.plugin.meitu.apk
/data/media/####/com.reader.plugin.biqu.apk
/data/media/####/com.reader.plugin.biqu.du.apk
/data/media/####/com.reader.plugin.biqu.xin.apk
/data/media/####/com.reader.plugin.fanqie.apk
/data/media/####/com.reader.plugin.fengyun.apk
/data/media/####/com.reader.plugin.qidian.apk
/data/media/####/com.reader.plugin.qinxiaoshuo.apk
/data/media/####/com.reader.plugin.zhuishu.apk
/data/media/####/temp_pkg_info.json

Miscellaneous:

Executes the following shell scripts:

getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.product.cpu.abi
getprop ro.vivo.os.build.display.id

Loads the following dynamic libraries:

c++_shared
mmkv
sandbox

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
RSA-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial