Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ca####.traffic####.net:80
- TCP(HTTP/1.1) www2-bi####.dual-a-####.a-ms####.net:80
- TCP(HTTP/1.1) b####.com:80
- TCP(HTTP/1.1) www.c####.xyz:80
- TCP(HTTP/1.1) 1.p####.ms####.net:80
- TCP(HTTP/1.1) im####.vi####.nl:80
- TCP(HTTP/1.1) 7.p####.ms####.net:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) develo####.goldc####.net:80
- TCP(HTTP/1.1) api.goldc####.net:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) www.vi####.nl:443
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) l####.msa.msiden####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) www2-bi####.dual-a-####.a-ms####.net:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) www.mbsuper####.com:443
DNS requests:
- 15e124a####.clo.footpri####.com
- 615c550####.clo.footpri####.com
- a####.u####.com
- api.goldc####.net
- b####.com
- c842bb8####.clo.footpri####.com
- develo####.goldc####.net
- f####.google####.com
- f####.gst####.com
- fp.ms####.net
- g####.face####.com
- im####.vi####.nl
- l####.l####.com
- ssl.google-####.com
- t####.mm.b####.net
- w####.b####.com
- www.b####.com
- www.c####.xyz
- www.go####.com
- www.go####.nl
- www.gst####.com
- www.mbsuper####.com
- www.vi####.nl
HTTP GET requests:
- 1.p####.ms####.net/apc/trans.gif
- 1.p####.ms####.net/apc/trans.gif?15e124a####
- 1.p####.ms####.net/r.gif?&MonitorID=####&rid=####&w3c=####&prot=####&v=#...
- 7.p####.ms####.net/apc/trans.gif
- 7.p####.ms####.net/apc/trans.gif?c842bb8####
- b####.com/Passport.aspx?popup=####
- b####.com/fd/ls/GLinkPing.aspx?IG=AA56D50A244A4247B594FA50B3854359&CID=3...
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- b####.com/ipv6test/test?FORM=####
- b####.com/rb/16/cj,nj/1b7dfb88/cc8437ad.js?bu=####
- b####.com/rb/5n/cj,nj/13153932/ee9f5ae1.js?bu=####
- b####.com/rs/32/2B/cj,nj/d9d4493a/ac151446.js
- b####.com/rs/32/2i/cj,nj/8d784342/dbeb434c.js
- b####.com/rs/5n/1b0/cj,nj/a39998e4/6798a322.js
- b####.com/rs/5n/1cC/cj,nj/19b9f8d9/60895148.js
- b####.com/rs/6m/l2/cj,nj/6240f061/6fb5e8ee.js
- b####.com/rs/6m/ln/cj,nj/54603a84/41886d99.js
- b####.com/rs/6m/mL/cj,nj/656c2153/f08ce0bf.js
- b####.com/rs/6m/mY/cj,nj/a39a5113/359dc660.js
- b####.com/rs/6m/n4/cj,nj/439f7fcf/b771e748.js
- b####.com/rs/6o/zg/cj,nj/01de8cec/248ada4c.js
- b####.com/s/bnp/bingLogo.png
- b####.com/sa/simg/SharedSpriteMobile_2018_07_12.png
- b####.com/search?q=####&PC=####
- b####.com/th?id=####&w=####&h=####&c=####&pid=####
- b####.com/th?id=####&w=####&h=####&c=####&pid=####&bw=####&bc=####
- b####.com/th?id=####&w=####&h=####&c=####&rs=####&qlt=####&pid=####&rm=#...
- ca####.traffic####.net/apc/trans.gif
- ca####.traffic####.net/apc/trans.gif?615c550####
- develo####.goldc####.net/q.php?sub=####
- im####.vi####.nl/logo_vindennl_a.png
- www.c####.xyz/autojs.js
- www2-bi####.dual-a-####.a-ms####.net/ipv6test/test
HTTP POST requests:
- a####.u####.com/app_logs
- api.goldc####.net/index.php?r=####&brand=####&os=####&appId=####&osVer=#...
- b####.com/fd/ls/lsp.aspx
- b####.com/fd/ls/lsp.aspx?
File system changes:
Creates the following files:
- /data/data/####/-9553007861234962704
- /data/data/####/.imprint
- /data/data/####/822637889-578266405
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/com.concise.ime.xml
- /data/data/####/com.concise.ime_preferences.xml
- /data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/config.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/index
- /data/data/####/smt.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Gets information about network.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
