Adware.Ninebox.121

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Ninebox.4.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) fc####.b####.com:80
TCP(HTTP/1.1) f####.b####.com.####.com:80
TCP(HTTP/1.1) p.nin####.cn:80
TCP(HTTP/1.1) se####.b####.com:80
TCP(HTTP/1.1) m.b####.com:80
TCP(HTTP/1.1) gm.ny####.com.####.com:80
TCP(HTTP/1.1) t####.jom####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) e####.b####.com:443
TCP(TLS/1.0) wk.b####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) fex.bdst####.com:443
TCP(TLS/1.0) wn.pos.b####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) 2####.58.212.174:443
TCP(TLS/1.0) m.b####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) w####.b####.com:443
TCP(TLS/1.0) wkst####.b####.com:443
TCP(TLS/1.0) g####.b####.com:443
TCP(TLS/1.0) edu-w####.b####.com.####.com:443
TCP(TLS/1.0) edu-y####.b####.com.####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) cambria####.cdn.bc####.####.com:443

DNS requests:

adser####.go####.com
c####.b####.com
c####.b####.com
c####.baidu####.cn
c####.baidust####.com
c.nin####.cn
cambria####.cdn.bc####.com
e####.b####.com
edu-w####.b####.com
edu-y####.b####.com
f####.b####.com
fc####.b####.com
fex.bdst####.com
g####.b####.com
gm.ny####.com
hm.b####.com
m.b####.com
p.nin####.cn
pos.b####.com
se####.b####.com
ssl.gst####.com
w####.b####.com
w####.b####.com
wk.b####.com
wkc####.b####.com
wkre####.b####.com
wkst####.b####.com
wn.pos.b####.com
www.go####.com
www.go####.nl
www.gst####.com

HTTP GET requests:

f####.b####.com.####.com/it/u=2251860373,2247641524&fm=203&src=2000
fc####.b####.com/w.gif?baiduid=####&query=####&searchid=####&osid=####&b...
gm.ny####.com.####.com/download/advert/kuaishouduanshipinguominduanshipi...
m.b####.com/error
m.b####.com/error.jsp?traceid=####
m.b####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm@0,sz@1320_1001,ta@...
m.b####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm@3,sz@1320_1001,ta@...
m.b####.com/s?word=####
m.b####.com/se/static/font/pmd/cicon_de3f1d7.ttf
m.b####.com/se/static/img/iphone/input_bearicon.png
m.b####.com/se/static/img/iphone/logo.png
m.b####.com/se/static/img/iphone/voice_new.png
m.b####.com/se/static/sf/app/amd_modules/@searchfe/assert/index_93ef523.js
m.b####.com/se/static/sf/app/amd_modules/@searchfe/assert_66e379a.js
m.b####.com/se/static/sf/app/amd_modules/@searchfe/promise/src/promise_8...
m.b####.com/se/static/sf/app/amd_modules/@searchfe/promise/src/set-immed...
m.b####.com/se/static/sf/app/amd_modules/@searchfe/promise_902d1ad.js
m.b####.com/se/static/sf/app/amd_modules/@searchfe/underscore/src/index_...
m.b####.com/se/static/sf/app/amd_modules/@searchfe/underscore_279397d.js
m.b####.com/se/static/sf/app/img/input_bearicon.png
m.b####.com/se/static/sf/app/js/fusion/b-nomore/b-nomore_4ba4664.js
m.b####.com/se/static/sf/app/js/fusion/deps/etpl_4827517.js
m.b####.com/se/static/sf/card/wenku_wap/svg/img_2398a88.svg
m.b####.com/se/static/sf/card/wenku_wap/svg/ppt_cd2e226.svg
m.b####.com/se/static/sf/card/wenku_wap/svg/word_f8f94ca.svg
m.b####.com/sf/vsearch?pd=####&word=####&tn=####&sa=####&lid=####&ms=###...
m.b####.com/static/search/clear.png
m.b####.com/static/search/image_default.png
se####.b####.com/mwb2.gif?pid=####&ts=####&lid=####&type=####&info=####
se####.b####.com/owb.gif?qid=####&did=####&q=####&fm=####&type=####&appl...
se####.b####.com/owb.gif?type=####&fm=####&data=####&qid=####&did=####&q...
t####.jom####.com/timg?wiseala####&size=####&quality=####&sec=####&di=##...

HTTP POST requests:

p.nin####.cn/admin/bcp.action?requestId=####
p.nin####.cn/admin/nbad.action

Modified file system:

Creates the following files:

/data/data/####/1526523679250.jar
/data/data/####/1526523679252.jar
/data/data/####/1526523680311.jar
/data/data/####/1526523680351.jar
/data/data/####/1526523680501.jar
/data/data/####/box_cp_all_msg.xml
/data/data/####/box_cp_states.xml
/data/data/####/boxcpdownloads
/data/data/####/boxcpdownloads-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dij.xml
/data/data/####/dim.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/index
/data/data/####/j-id.xml
/data/data/####/mid.xml
/data/data/####/pdown
/data/data/####/pdown-journal
/data/data/####/rp.xml
/data/data/####/rs.xml
/data/data/####/running_app_name.xml
/data/data/####/type.xml
/data/data/####/vs.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/1.dat
/data/media/####/12.dat
/data/media/####/2.dat
/data/media/####/3.dat
/data/media/####/7.dat
/data/media/####/MID.DAT
/data/media/####/cp0.png.dat
/data/media/####/cp1.png.dat
/data/media/####/names.dat
/data/media/####/sanzijing.db
/data/media/####/share.dat
/data/media/####/st.dat

Miscellaneous:

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

DES
DESede-CBC-PKCS7Padding

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial