Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) www.miib####.gov.cn:80
- TCP(HTTP/1.1) www.sus####.com.cn:80
DNS requests:
- a####.u####.com
- p####.kaip####.cn
- www.go####.com
- www.miib####.gov.cn
- www.sus####.com.cn
HTTP GET requests:
- www.go####.com/complete/search?hl=####&client=####&q=####
- www.miib####.gov.cn/
- www.miib####.gov.cn/getNavigationCode?
- www.miib####.gov.cn/images/new/bg05.png
- www.miib####.gov.cn/images/new/top03.gif
- www.miib####.gov.cn/images/portal_0/dialog/00.gif
- www.miib####.gov.cn/images/portal_0/dialog/bg_bottom_l.gif
- www.miib####.gov.cn/images/portal_0/dialog/bg_bottom_r.gif
- www.miib####.gov.cn/images/portal_0/dialog/bg_top_l.gif
- www.miib####.gov.cn/images/portal_0/dialog/bg_top_r.gif
- www.miib####.gov.cn/images/portal_0/new/logo01.png
- www.miib####.gov.cn/images/portal_0/new/mima.gif
- www.miib####.gov.cn/images/portal_0/new/modifymima.gif
- www.miib####.gov.cn/images/portal_0/new/pic_31.gif
- www.miib####.gov.cn/images/portal_0/new/pic_32.gif
- www.miib####.gov.cn/images/portal_0/new/pic_34.gif
- www.miib####.gov.cn/images/portal_0/new/top02.gif
- www.miib####.gov.cn/images/portal_0/portal/1px.gif
- www.miib####.gov.cn/images/portal_0/portal/6px.gif
- www.miib####.gov.cn/images/portal_0/portal/an4.gif
- www.miib####.gov.cn/images/portal_0/portal/android.png
- www.miib####.gov.cn/images/portal_0/portal/androidDownload.png
- www.miib####.gov.cn/images/portal_0/portal/download.png
- www.miib####.gov.cn/images/portal_0/portal/hotline.png
- www.miib####.gov.cn/images/portal_0/portal/icpDownload.png
- www.miib####.gov.cn/images/portal_0/portal/ios.png
- www.miib####.gov.cn/images/portal_0/portal/iosDownload.png
- www.miib####.gov.cn/images/portal_0/portal/line.gif
- www.miib####.gov.cn/images/portal_0/portal/more.gif
- www.miib####.gov.cn/images/portal_0/portal/more01.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_01.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_02.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_03.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_04.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_05.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_06.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_07.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_08.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_10.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_11.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_12.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_23.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_24.gif
- www.miib####.gov.cn/images/portal_0/portal/pic_25.gif
- www.miib####.gov.cn/images/portal_0/portal/sign01.gif
- www.miib####.gov.cn/images/portal_0/portal/sign02.gif
- www.miib####.gov.cn/images/support.png
- www.miib####.gov.cn/images/top/0.png
- www.miib####.gov.cn/scripts/ValidateTools.js
- www.miib####.gov.cn/scripts/common-validate.js
- www.miib####.gov.cn/scripts/jquery.js
- www.miib####.gov.cn/scripts/jquery.js;jsessionid=-7wKEvNRK_5lKm3RKm3JGUT...
- www.miib####.gov.cn/scripts/maskDialog/maskDialog.css
- www.miib####.gov.cn/scripts/maskDialog/maskDialog.js
- www.miib####.gov.cn/state/outPortal/images/portal_0/portal/6px.gif
- www.miib####.gov.cn/styles/portal.css
- www.miib####.gov.cn/styles/styles.css
- www.sus####.com.cn/
- www.sus####.com.cn/101.jpg
- www.sus####.com.cn/102.jpg
- www.sus####.com.cn/103.jpg
- www.sus####.com.cn/104.jpg
- www.sus####.com.cn/105.jpg
- www.sus####.com.cn/106.jpg
- www.sus####.com.cn/107.jpg
- www.sus####.com.cn/108.jpg
- www.sus####.com.cn/109.jpg
- www.sus####.com.cn/110.jpg
- www.sus####.com.cn/base.css
- www.sus####.com.cn/favicon.ico
- www.sus####.com.cn/img/logo.png
- www.sus####.com.cn/side-wave.gif
- www.sus####.com.cn/templets/default/images/bg.jpg
- www.sus####.com.cn/templets/default/images/mala-text-bg.gif
HTTP POST requests:
- a####.u####.com/app_logs
- www.miib####.gov.cn/state/outPortal/loginPortal.action;jsessionid=-7wKEv...
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/o.apk
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
Miscellaneous:
Loads the following dynamic libraries:
- qyhomeProtect
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
