Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.266.origin
- Android.Triada.38.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) ptmgtd0####.wsclou####.com:80
- TCP(HTTP/1.1) c.m.1####.com:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) and####.cli####.go####.com:443
- UDP 2####.255.255.255:67
DNS requests:
- 2.and####.p####.####.org
- and####.cli####.go####.com
- b####.52####.com
- c.m.1####.com
- cms-bu####.n####.127.net
- kst.sd####.com
- mt####.go####.com
HTTP GET requests:
- ptmgtd0####.wsclou####.com/008cda7f8b4b4e4e9f33578b510e9eca2017091017561...
- ptmgtd0####.wsclou####.com/21b8445c5e044deb85bd995a4414d3c82017091115472...
- ptmgtd0####.wsclou####.com/3276f9cc928349fc934aef726f3285cd2017091118394...
- ptmgtd0####.wsclou####.com/4336dde0ff7f492d8374508bbfcd0fae2017091115045...
- ptmgtd0####.wsclou####.com/742f95196fbb488b826e7f3878524cac2017090817403...
- ptmgtd0####.wsclou####.com/9311beb7f6e74d3cb5a9cbde43145ae12017090815200...
- ptmgtd0####.wsclou####.com/a80c8781ec364ff08233d0c1386be77d2017091207392...
- ptmgtd0####.wsclou####.com/b2ab69d5a5604ffab1d4a176fedabb342017091216065...
- ptmgtd0####.wsclou####.com/baed37d12744446886dc7106e849e6bb2017090919251...
- ptmgtd0####.wsclou####.com/d74d56820a294484ae0626e794d855d42017091121570...
- ptmgtd0####.wsclou####.com/e207d96b54b94f8085596c06bbb4d37c2017090817075...
- ptmgtd0####.wsclou####.com/edf7c64fbdb44210847e25c3dc7a359b2017091116441...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/1afa17365a068341258f3d50a2dc13261ce....0.tmp
- <Package Folder>/cache/####/2024f542cef686ddc2d11722c3e3455c924....0.tmp
- <Package Folder>/cache/####/37383fd27c8c3300e9781ee9290f4179344....0.tmp
- <Package Folder>/cache/####/4cd9fb3a64cd1195d7d71672eb870f474d0....0.tmp
- <Package Folder>/cache/####/525918d5489cf7d92aee05498248f4ebdf2....0.tmp
- <Package Folder>/cache/####/56faf03bacfdc445bd61ae16330d55eca0d....0.tmp
- <Package Folder>/cache/####/583b3d11ed29d20e50becdfee88f37aa793....0.tmp
- <Package Folder>/cache/####/639c51ecfbe24604cd4e38fe6c8ba50ad0b....0.tmp
- <Package Folder>/cache/####/6a18bcf82ea59fe9d128c6bd768574e4a92....0.tmp
- <Package Folder>/cache/####/9a48022400abb81f8f6c856ae2f50b04a16....0.tmp
- <Package Folder>/cache/####/b270a9af08420d81ecb6e7449e80981c0c2....0.tmp
- <Package Folder>/cache/####/befc207865155f6c7d7a4dfd3bca4e5a505....0.tmp
- <Package Folder>/cache/####/bfb8ac1d14f137fadc958a5545eaa16fade....0.tmp
- <Package Folder>/cache/####/e4b8617c5027f0773cdc9c570027a50c533....0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/files/nmvc
- <Package Folder>/files/nmvc.jar
- <Package Folder>/files/ru
- <Package Folder>/files/ru.apk
- <Package Folder>/files/siyz.png
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/config.xml.bak (deleted)
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/xapcinfo.xml
Miscellaneous:
Executes next shell scripts:
- conbb od2gf04pd9
- cufsdosck ac554db364f
- cufsmgr eb47495f7bb
- service call appops 0 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 1 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 10 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 11 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 15 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 16 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 17 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 18 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 19 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 2 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 3 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 4 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 5 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 6 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 7 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 8 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 9 i32 15 i32 10044 s16 <Package> i32 0
- sh
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
