Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) gw.al####.com:443
- TCP(TLS/1.0) c####.im.ta####.com:443
- TCP(TLS/1.0) h5.m.ta####.com:443
- TCP(TLS/1.0) sh.wagbr####.ali####.com:443
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) pco####.ta####.com:443
- TCP(TLS/1.0) g.al####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) log.mm####.com:443
DNS requests:
- and####.cli####.go####.com
- c####.e####.com
- c####.im.ta####.com
- fou####.ali####.com
- g.al####.com
- gw.al####.com
- h5.m.ta####.com
- i####.ww.ta####.com
- log.mm####.com
- mt####.go####.com
- p####.f####.com
- p####.f####.com
- p####.f####.com
- pco####.ta####.com
Modified file system:
Creates the following files:
- /data/data/####/1473052185766
- /data/data/####/1473052188616
- /data/data/####/1473052190191
- /data/data/####/1473052192374
- /data/data/####/1473052195461
- /data/data/####/1473052197507
- /data/data/####/1473052201362
- /data/data/####/1473052203077
- /data/data/####/1473052207185
- /data/data/####/1473052208701
- /data/data/####/1473052210286
- /data/data/####/1473052211662
- /data/data/####/1473052213855
- /data/data/####/1473052216111
- /data/data/####/1473052217448
- /data/data/####/1473052219219
- /data/data/####/1473052220829
- /data/data/####/1473052223041
- /data/data/####/1473052226429
- /data/data/####/1473052228059
- /data/data/####/1473052229816
- /data/data/####/1473052231608
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/app_epubclasses.jar
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/configs.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbvoue-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/https_h5.m.taobao.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/mobclick_agent_cached_com.xw.ywfu455
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/ywPrefsTools.xml
- /data/media/####/LocalTemplate.zip
Miscellaneous:
Executes next shell scripts:
- unzip /storage/emulated/0/Android/data/<Package>/cache/LocalTemplate.zip -d <Package Folder>/files/template
Loads the following dynamic libraries:
- ahj
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.
