Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.714.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ia.z####.net:80
- TCP(HTTP/1.1) ic.o####.net:80
DNS requests:
- ia.xuan####.com
- ia.z####.net
- ic.o####.net
- mt####.go####.com
HTTP POST requests:
- ia.z####.net/ps/actionLog.do
- ia.z####.net/ps/appShare.do
- ia.z####.net/ps/dataPullShile.do
- ia.z####.net/ps/userMobileInfo.do
- ia.z####.net/ps/userSdkInfo.do
- ic.o####.net/domain/domainConfig.do
Modified file system:
Creates the following files:
- /data/data/####/Framework.db
- /data/data/####/Framework.db-journal
- /data/data/####/PlatformCore.db
- /data/data/####/PlatformCore.db-journal
- /data/data/####/a39f18e8ed48e90109e86ce1cc87b484.jar
- /data/data/####/app_bid
- /data/data/####/app_caller
- /data/data/####/app_mid
- /data/data/####/c3d9fff0dac7c628d45d948139eba1c6
- /data/data/####/c3d9fff0dac7c628d45d948139eba1c6.jar
- /data/data/####/com.wifi.service.pack
- /data/data/####/common
- /data/data/####/mobile_init.dat
- /data/data/####/mutex.dat
- /data/data/####/sdk_init.dat
- /data/data/####/sdk_version.dat
- /data/data/####/service_info.dat
- /data/data/####/shield_init.dat
- /data/data/####/update_script.dat
- /data/media/####/85befdaa0e677adab17a7834a12e14de
- /data/media/####/app_mutex.lock
- /data/media/####/config.dat
- /data/media/####/setting.dat
- /data/media/####/system.dat
- /data/media/####/system_meta.config
Miscellaneous:
Executes next shell scripts:
- cat /proc/meminfo
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- getprop ro.miui.ui.version.name
- getprop ro.yunos.version
- ls /sys/devices/system/cpu
- ping -c 2 113.31.86.139
- ping -c 2 ia.in6way.com
- ping -c 2 ia.xuanwu88.com
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
