Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MulDrop.1112
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
- TCP(HTTP/1.1) d.ais####.com:7777
- TCP(HTTP/1.1) www.ais####.com:80
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- a####.exc.mob.com
- aexcep####.b####.qq.com
- and####.b####.qq.com
- and####.cli####.go####.com
- d.ais####.com
- www.ais####.com
HTTP GET requests:
- d.ais####.com:7777/2017/10/17/script/2018060008023957537.png
- d.ais####.com:7777/2018/5/20/script/2018060023113222611.png
- d.ais####.com:7777/2018/5/20/script/2018070004073648417.png
- d.ais####.com:7777/2018/6/13/script/2018070013101341519.png
- d.ais####.com:7777/2018/6/13/script/2018070013101524984.png
- d.ais####.com:7777/2018/6/2/script/2018070002103038524.png
- d.ais####.com:7777/2018/6/2/script/2018070002103104433.png
- d.ais####.com:7777/2018/6/2/script/2018070002111117061.png
- d.ais####.com:7777/2018/7/25/script/2018090015082316005.png
- d.ais####.com:7777/2018/7/4/script/2018080007023304619.png
- d.ais####.com:7777/2018/8/19/script/2018090020112606051.png
HTTP POST requests:
- a####.exc.mob.com/errconf
- aexcep####.b####.qq.com:8012/rqd/async
- and####.b####.qq.com/rqd/async
- and####.b####.qq.com/rqd/async?aid=####
- www.ais####.com/client/aisApp/channel/version/updated?version=####&mark=...
- www.ais####.com/scirpt/aisapp/game/script/details?id=####
- www.ais####.com/scirpt/game/hot/search
- www.ais####.com/scirpt/game/keywords/gameType?pages=####
- www.ais####.com/script/aisapp/channel/amount?channelMark=####&deviceNo=#...
Modified file system:
Creates the following files:
- /data/data/####/.duid
- /data/data/####/.lock
- /data/data/####/.vpl_lock
- /data/data/####/1004
- /data/data/####/33739a125f2aa35a18e17b3660d0a7b0db476146e9b5043....0.tmp
- /data/data/####/54e7e51826d458c6c59627fe47fa381b0a0a602317b7618....0.tmp
- /data/data/####/5fd34af2a7d100d13b1c75657a2c25370ca2f3061d3973e....0.tmp
- /data/data/####/9140b31f3a1c286f7f8d36b5c64732c1bb2032df9b8b401....0.tmp
- /data/data/####/9bfe5f8dcd4ca80df00ad65e7607b105f0cb183290eb738....0.tmp
- /data/data/####/MultiDex.lock
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/a6e56bd57e9e6d43e63bea2f07faacfa9de51854a3b449c....0.tmp
- /data/data/####/afb4a3c00f11badbc70b6d8bfc21594a60f1fa25cb86139....0.tmp
- /data/data/####/bd44ecec313a6325cd5f52c5ada0e14377711f23a91ed2c....0.tmp
- /data/data/####/bugly_db_-journal
- /data/data/####/bugly_db_legu-journal
- /data/data/####/c5959603a6deb9fbd94adf9ffe2f2419a27008f3d45f444....0.tmp
- /data/data/####/crashrecord.xml
- /data/data/####/d7aad8298b122460f5983dbc4f42660a744d0bc03fb0f9e....0.tmp
- /data/data/####/ec4ad8e3b721593cfc3b02bdd731622eb206d12b000f179....0.tmp
- /data/data/####/foo.jar
- /data/data/####/inputMethod.xml
- /data/data/####/journal.tmp
- /data/data/####/libnfix.so
- /data/data/####/libshella-2.8.so
- /data/data/####/libufix.so
- /data/data/####/local_crash_lock
- /data/data/####/mix.dex
- /data/data/####/mob_commons_1
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/security_info
- /data/media/####/.artc_lock
- /data/media/####/.di
- /data/media/####/.dic_lock
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.lecd
- /data/media/####/.lesd_lock
- /data/media/####/.mn_-1464060969
- /data/media/####/.pkg_lock
- /data/media/####/.pkgs_lock
- /data/media/####/.rc_lock
- /data/media/####/.slw
- /data/media/####/.ss_lock
- /data/media/####/SearchContent.txt
- /data/media/####/Unlock
- /data/media/####/logo.jpg
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c type su
- app_process <Package Folder>/foo.jar com.tc.Simulation.Inject <Package Folder> 600 800 <Package>
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- chmod 700 <Package Folder>/tx_shell/libshella-2.8.so
- chmod 700 <Package Folder>/tx_shell/libufix.so
- getprop
- getprop ro.aa.romver
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.build.nubia.rom.name
- getprop ro.build.rom.id
- getprop ro.build.tyd.kbstyle_version
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.gn.gnromvernumber
- getprop ro.lenovo.series
- getprop ro.lewa.version
- getprop ro.meizu.product.model
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.build.display.id
- getprop ro.yunos.version
- logcat -d -v threadtime
- sh
- su
Loads the following dynamic libraries:
- Bugly
- libnfix
- libshella-2.8
- libufix
- nfix
- tlib
- ufix
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-NoPadding
- AES-GCM-NoPadding
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Gains access to telephone information (number, IMEI, etc.).
Displays its own windows over windows of other applications.
