Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.248.origin
- Android.Triada.373.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.159.53.238:80
- TCP(HTTP/1.1) 1####.29.74.131:80
- TCP(HTTP/1.1) 1####.92.201.20:3003
- TCP(HTTP/1.1) pg.x####.com:80
- TCP(HTTP/1.1) i####.cn.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) zvi####.v.qin####.com:80
- TCP(HTTP/1.1) 1####.159.208.192:80
- TCP(TLS/1.0) pay.v####.com.cn:443
DNS requests:
- f.up.v####.####.cn
- i####.cn.com
- pay.v####.com.cn
- pg.x####.com
- unitedp####.lemuel####.com
HTTP GET requests:
- i####.cn.com/a/39cc255f4396af00c348e34c55868f4a2
HTTP POST requests:
- pg.x####.com/api/q/a/39cc255f4396af00c348e34c55868f4a2
- pg.x####.com/api/statis/39cc255f4396af00c348e34c55868f4a2/game-8FEF2CAF0...
- zvi####.v.qin####.com/usrsys/reportUsrsys?version=####
Modified file system:
Creates the following files:
- /data/data/####/-1143945219847306209
- /data/data/####/-LAtKuhrMcHA4qIQJgjeww==
- /data/data/####/0fd337612a96bfbb.jar
- /data/data/####/39cc255f4396af00c348e34c55868f4a2|account_file.xml
- /data/data/####/4747f0cf220d534d.jar
- /data/data/####/6E_eHkaNjwSvS1im.zip
- /data/data/####/8c856da4b1f8b6ff.jar
- /data/data/####/NtvG-KsfoINfmYA0AQmfrg==.new
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/UNITEDPAYACTLIST_
- /data/data/####/cb63851f0a4dce86.jar
- /data/data/####/codex.so
- /data/data/####/codex_inner.so
- /data/data/####/codex_inner.so (deleted)
- /data/data/####/com.cjfx.xqc.vivo_preferences.xml
- /data/data/####/d4a53164244ce4fe.jar
- /data/data/####/f454a8f93ebc56c3.jar
- /data/data/####/faaebb0294533224.jar
- /data/data/####/gUrt0M6ErC11lqc04Qq7xA==.new
- /data/data/####/hxjfbg_f.zip
- /data/data/####/lemuel_security_inner.so
- /data/data/####/pref_file.xml
- /data/data/####/prefs_vivounionsdk.xml
- /data/data/####/rdata_comcjfxxqcjinli.new
- /data/data/####/talkingdata_app.db-journal
- /data/data/####/talkingdata_app_process_preferences_file
- /data/data/####/talkingdata_app_version_preferences_file
- /data/data/####/td_pefercen_profile.xml
- /data/data/####/tdid.xml
- /data/data/####/trackevents.db-journal
- /data/data/####/uT2H_CqusRQtxttv
- /data/data/####/unionuserinfo.db-journal
- /data/data/####/v941bJ8ukOHO6Z2jaAJ0Gg==
- /data/data/####/vivounionapk_v2.2.1_a1381cb_201704101737.vua
- /data/media/####/.tcookieid
- /data/media/####/sdkaccountinfo.db
- /data/media/####/sdkaccountinfo.db-journal
- /data/media/####/vivounionapk_v2.2.1_a1381cb_201704101737.vua
Miscellaneous:
Loads the following dynamic libraries:
- _lemuel_security
- codex
- codex_inner
- game
- lemuel_security_inner
- vivo_account_sdk
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
