Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.248.origin
- Android.Triada.464.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) st-onli####.v####.com.####.com:443
DNS requests:
- l.ace####.com
- st-onli####.v####.com.cn
File system changes:
Creates the following files:
- /data/data/####/2ewfXHNaRZO3ACpqHImVy_11CDI=.new
- /data/data/####/80a6BizkSrqTXFWYrM2lgw==
- /data/data/####/Ew7e5XPMrw0P7QzdF0VZekt8ED8=.new
- /data/data/####/LcAKZV1oEWgTqbNN6vupsPcLEfY=.new
- /data/data/####/MmKq34sTMxFq0F3ySOoo_Q==.new
- /data/data/####/OcNOdrIXZkwaMuLZ.new
- /data/data/####/Ra2P6rOFiuPaKQgTmauLhQ==.new
- /data/data/####/RkdAFTJH6CIA5MaSBP151pSVX7MniN1v_IidOH7nuGPxdJ18j-journal
- /data/data/####/TPy3XXZuuL2nFKbqDWOvix9wnoM=.new
- /data/data/####/UQihJhxQ8Q3FBZ-B490R1-lx9q8=.new
- /data/data/####/XX22I0JYdNflcdvjXg-33IkeDzm0IdFn.new
- /data/data/####/Zu_NFRAuuU2FQdFF.zip
- /data/data/####/com.igame.hsjs.vivo.v2.playerprefs.xml
- /data/data/####/com.igame.hsjs.vivo_preferences.xml
- /data/data/####/dbb6cRp0qzn2ihYtWaZ1ag==.new
- /data/data/####/hrvyxq_f.zip
- /data/data/####/k1Hb0ClykvapmEoicG5vIw==.new
- /data/data/####/prefs_vivounionsdk.xml
- /data/data/####/rdata_comfenbuyzm.new
- /data/data/####/runner_info.prop.new
- /data/data/####/sJxnsNly_96pfz0m
- /data/data/####/umeng_general_config.xml
- /data/data/####/vivounionsdk.res
- /data/data/####/w_dsGCtkgslrpyiW-1zDfQ==
- /data/data/####/wdXND86EN31wFaUUkB_vVF1ylJo=.new
- /data/media/####/.uunique.new
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- getprop ro.build.version.emui
- getprop ro.build.version.opporom
- getprop ro.miui.ui.version.name
- getprop ro.vivo.os.version
- getprop ro.yunos.version
Loads the following dynamic libraries:
- main
- vivo_account_sdk
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
