Adware.Plague.572

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Plague.1.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) zhusho####.gam####.cn:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) m####.gam####.cn.####.com:80
TCP(HTTP/1.1) i####.gam####.cn.####.com:80
TCP(HTTP/1.1) aserver####.m.ta####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) mf####.gam####.cn.####.com:80

DNS requests:

chan####.s####.com
feed####.y####.com
hm.b####.com
i####.gam####.cn
m####.gam####.cn
mf####.gam####.cn
p####.dj####.com
p####.dj####.com
p####.dj####.com
pl####.y####.com
uce####.gam####.cn
zhusho####.gam####.cn

HTTP GET requests:

aserver####.m.ta####.com/jsapi
aserver####.m.ta####.com/unifull/css/unifull.min.css
gdv.a.s####.com/api/2/topic/load?page_size=####&style=####&hot_size=####...
gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?a6dafb1####
i####.gam####.cn.####.com/2015/07/23/181-150H31015320-L.jpg
i####.gam####.cn.####.com/2015/07/23/181-150H3102F60-L.jpg
i####.gam####.cn.####.com/2015/07/23/181-150H3103A00-L.jpg
i####.gam####.cn.####.com/2015/07/23/181-150H3110I90-L.jpg
i####.gam####.cn.####.com/2015/08/31/181-150S11524170-L.jpg
i####.gam####.cn.####.com/2015/08/31/181-150S11532460-L.jpg
i####.gam####.cn.####.com/2015/08/31/181-150S11550100-L.jpg
i####.gam####.cn.####.com/2015/09/02/181-150Z21423180-L.jpg
i####.gam####.cn.####.com/2015/09/02/181-150Z21440550-L.jpg
i####.gam####.cn.####.com/2015/09/02/181-150Z21452350-L.jpg
i####.gam####.cn.####.com/2015/09/02/181-150Z21505510-L.jpg
i####.gam####.cn.####.com/2015/11/23/181-1511231H9420.jpg
m####.gam####.cn.####.com/2015/07/11/269-150G1144R20.jpg
m####.gam####.cn.####.com/2015/07/15/269-150G51H4080.jpg
m####.gam####.cn.####.com/2015/07/21/269-150H11IZ40.jpg
m####.gam####.cn.####.com/2015/07/21/269-150H11JA80.jpg
mf####.gam####.cn.####.com/2015/07/15/269-150G51H4080.jpg
mf####.gam####.cn.####.com/2015/08/31/181-150S1155H50.jpg
mf####.gam####.cn.####.com/2015/09/02/181-150Z21425110.jpg
mf####.gam####.cn.####.com/avatar.php?size=####&uid=####
mf####.gam####.cn.####.com/images/noavatar_middle.gif
mf####.gam####.cn.####.com/js/jquery.min.js
zhusho####.gam####.cn/api/xdlcszeds/AppVersion.xml
zhusho####.gam####.cn/index.php?m=####&a=####&aid=####
zhusho####.gam####.cn/index.php?m=####&a=####&page=####&typeid=####&flag...
zhusho####.gam####.cn/index.php?m=####&a=####&pageSize=####&page=####&ty...

Modified file system:

Creates the following files:

/data/data/####/-10813310522058436215
/data/data/####/1003943842-1645863805
/data/data/####/1003943842-1646632506
/data/data/####/1003943842-1674431543
/data/data/####/1824952415-665504335
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/ContextData.xml
/data/data/####/__ljkib_Stat_SDK_SendRem.xml
/data/data/####/__local_ap_info_cache.json
/data/data/####/__local_last_session.json
/data/data/####/__local_stat_cache.json
/data/data/####/__send_data_1522540650578
/data/data/####/avatar.php?size=middle&uid=1046093
/data/data/####/avatar.php?size=middle&uid=1481963
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/cdi
/data/data/####/classes.jar
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dbjta-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/independefenseassist.db-journal
/data/data/####/index
/data/data/####/libcuid.so
/data/data/####/mobclick_agent_cached_com.xdlc.plkjuu660
/data/data/####/register.xml
/data/data/####/trinea_android_common.db-journal
/data/data/####/uuid.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/ybghnLocalNotificationStore.db-journal
/data/data/####/ybghn_feedback_conversations.xml
/data/data/####/ybghn_general_config.xml
/data/media/####/.confd
/data/media/####/.confd-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/.timestamp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/http___img1_gamedog_cn_2015_07_23_181_150H31015320_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_181_150H3102F60_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_181_150H3103A00_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_07_23_181_150H3110I90_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_31_181_150S11524170_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_31_181_150S11532460_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_08_31_181_150S11550100_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_02_181_150Z21423180_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_02_181_150Z21440550_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_02_181_150Z21452350_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_09_02_181_150Z21505510_L_jpg
/data/media/####/http___img1_gamedog_cn_2015_11_23_181_1511231H9420_jpg
/data/media/####/http___mimg1_gamedog_cn_2015_07_11_269_150G1144R20_jpg
/data/media/####/http___mimg1_gamedog_cn_2015_07_15_269_150G51H4080_jpg
/data/media/####/http___mimg1_gamedog_cn_2015_07_21_269_150H11IZ40_jpg
/data/media/####/http___mimg1_gamedog_cn_2015_07_21_269_150H11JA80_jpg

Miscellaneous:

Loads the following dynamic libraries:

crash_analysis

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial