Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SpyMax.42.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) ddd.6####.cc:80
- TCP(HTTP/1.1) 64.2####.161.94:80
- TCP(TLS/1.0) 1####.250.150.94:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) k####.vip:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) 74.1####.205.100:443
- TCP(TLS/1.0) img.swtuchu####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) rr18---####.g####.com:443
- TCP(TLS/1.2) 64.2####.165.106:443
- TCP(TLS/1.2) p####.google####.com:443
- TCP 1####.245.11.6:7771
- UDP p####.google####.com:443
DNS requests:
- 6.11.245.####.arpa
- and####.a####.go####.com
- and####.google####.com
- ddd.6####.cc
- gmscomp####.google####.com
- img.swtuchu####.com
- k####.vip
- m####.go####.com
- p####.google####.com
- rr18---####.g####.com
- rr2---s####.g####.com
HTTP GET requests:
- ddd.6####.cc/
- ddd.6####.cc/favicon.ico
- ddd.6####.cc/static/images/logo.jpg
- ddd.6####.cc/static/js/home.js
- ddd.6####.cc/static/js/jquery.autocomplete.js
- ddd.6####.cc/template/default_pc/ads/foot_b1.js
- ddd.6####.cc/template/default_pc/ads/foot_b2.js
- ddd.6####.cc/template/default_pc/ads/foot_b3.js
- ddd.6####.cc/template/default_pc/ads/foot_b4.js
- ddd.6####.cc/template/default_pc/ads/head_1_gg.js
- ddd.6####.cc/template/default_pc/ads/head_2_gg.js
- ddd.6####.cc/template/default_pc/ads/navady_index.js
- ddd.6####.cc/template/default_pc/ads/navadz_index.js
- ddd.6####.cc/template/default_pc/ads/sj_foot.js
- ddd.6####.cc/template/default_pc/ads/sj_gg.js
- ddd.6####.cc/template/default_pc/ads/sy_sp_gg.js
- ddd.6####.cc/template/default_pc/ads/sy_tp_gg.js
- ddd.6####.cc/template/default_pc/ads/sy_xs_gg.js
- ddd.6####.cc/template/default_pc/ads/top_gg.js
- ddd.6####.cc/template/default_pc/ads/yc_gg.js
- ddd.6####.cc/template/default_pc/ads/zc_gg.js
- ddd.6####.cc/template/default_pc/html/style/css/style.css
- ddd.6####.cc/template/default_pc/html/style/images/V1_P1_PC_J777_1200-14...
- ddd.6####.cc/template/default_pc/html/style/images/V1_P2-P3_PC_J777_1200...
- ddd.6####.cc/template/default_pc/html/style/images/V1_P4_PC_J777_290-116...
- ddd.6####.cc/template/default_pc/html/style/images/V1_P5-P6_PC_J777_160-...
- ddd.6####.cc/template/default_pc/html/style/images/bg_icon.png
- ddd.6####.cc/template/default_pc/html/style/images/img/bg_icon.png
- ddd.6####.cc/template/default_pc/html/style/images/sj_gg_750x300_JSMN2_M...
- ddd.6####.cc/template/default_pc/html/style/img/an.png
- ddd.6####.cc/template/default_pc/html/style/img/fy.png
- ddd.6####.cc/template/default_pc/html/style/img/lazylitpic.gif
- ddd.6####.cc/template/default_pc/html/style/js/clipboard.min.js
- ddd.6####.cc/template/default_pc/html/style/js/jquery.SuperSlide.2.1.1.js
- ddd.6####.cc/template/default_pc/html/style/js/jquery.lazyload.min.js
- ddd.6####.cc/template/default_pc/html/style/js/jquery.min.js
- ddd.6####.cc/template/default_pc/html/style/js/main.js
- ddd.6####.cc/template/default_pc/js/jquery.base.js
- k####.vip:443/index/webview_valid/101?t=####
File system changes:
Creates the following files:
- /data/data/####/05965e850322c875_0
- /data/data/####/069bb0941ea9fed0_0
- /data/data/####/0773a3fdfb1e7f80_0
- /data/data/####/0773a3fdfb1e7f80_1
- /data/data/####/0c7b93b87ff36cbc_0
- /data/data/####/147f530105463539_0
- /data/data/####/14b7ad30f636d3a1_0
- /data/data/####/1d15fc5497415639_0
- /data/data/####/1fe39c7fda48c7bf_0
- /data/data/####/2a0c6601cbe27de3_0
- /data/data/####/2a0c6601cbe27de3_1
- /data/data/####/2a4c6c11c211d141_0
- /data/data/####/2bad5ebffdbe968a_0
- /data/data/####/2fa411a13fbe40f4_0
- /data/data/####/2fa411a13fbe40f4_1
- /data/data/####/33b1773f587aa136_0
- /data/data/####/347850d0fd9c0d0c_0
- /data/data/####/50b1870c875f4a2f_0
- /data/data/####/550270e925b29f4d_0
- /data/data/####/550270e925b29f4d_1
- /data/data/####/55cef474b0df3d92_0
- /data/data/####/5df0c612d9d8fe74_0
- /data/data/####/5fd7e2c2ceaa00c3_0
- /data/data/####/69623448f64bee3e_0
- /data/data/####/6f7cdb2f3235bfda_0
- /data/data/####/73ab4e62eb4b31b5_0
- /data/data/####/76f3fa177e81a863_0
- /data/data/####/76f3fa177e81a863_1
- /data/data/####/7ba3cd15eda148fc_0
- /data/data/####/7ba3cd15eda148fc_1
- /data/data/####/7f0df8f0e9338273_0
- /data/data/####/7f0df8f0e9338273_1
- /data/data/####/81161299104e85b4_0
- /data/data/####/8b66864890c30d2b_0
- /data/data/####/9175de1550d8b43c_0
- /data/data/####/957e4c7e3156ae58_0
- /data/data/####/96d79dd26d7c2a8e_0
- /data/data/####/9c7445d95bc55ed1_0
- /data/data/####/AppDex_1.dex
- /data/data/####/AppDex_1.dex.flock (deleted)
- /data/data/####/AppDex_1.zip
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a0025139f9fff8df_0
- /data/data/####/a04a5ac3e7005e7d_0
- /data/data/####/a81ad5251e064e81_0
- /data/data/####/ac12a4a8312c1428_0
- /data/data/####/af6f91f6b18a3c01_0
- /data/data/####/b15a4b37f4c838d1_0
- /data/data/####/b15a4b37f4c838d1_1
- /data/data/####/b94e2cb5dc16928f_0
- /data/data/####/bb695a79d5b3cd53_0
- /data/data/####/bbbc31f257fd8ce4_0
- /data/data/####/bc6a3da9e2aad09d_0
- /data/data/####/bufandata.xml
- /data/data/####/c0d39f5cbda53c1a_0
- /data/data/####/c26a164c615c45e7_0
- /data/data/####/c56aa6bb51d4f83e_0
- /data/data/####/c93f4909275b6e80_0
- /data/data/####/com.xuanfeng.labv.xml
- /data/data/####/com.xuanfeng.labv_preferences.xml
- /data/data/####/d625a9e3d24d3527_0
- /data/data/####/d7d1d87abf9c59bd_0
- /data/data/####/d913f6ffa91e7f56_0
- /data/data/####/dba1716037c3c619_0
- /data/data/####/e5198a64159e1a95_0
- /data/data/####/ef354c752a6858b7_0
- /data/data/####/fa93e390b250358d_0
- /data/data/####/index
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
Miscellaneous:
Loads the following dynamic libraries:
- libtbs
Gets information about network.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
