Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.564.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) hd.a####.com:80
- TCP(TLS/1.0) schedul####.w####.com:443
DNS requests:
- bcfeed####.ta####.com
- co####.w####.com
- cr####.w####.com
- dyn.w####.com
HTTP GET requests:
- hd.a####.com/proton/white-list.json
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/0a231bd8575dcf72.txt
- /data/data/####/2CD91DE9A0F1D93BFFAEF848DEF79462
- /data/data/####/8ef9c457b3bbb403.lock
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/UTCommon.xml
- /data/data/####/app_preferences.xml
- /data/data/####/caimiapp_prefile.xml
- /data/data/####/com.caimi.creditcard_preferences.xml
- /data/data/####/cpugpuinfo
- /data/data/####/dianshi.host
- /data/data/####/finance_cache_preference.xml
- /data/data/####/getui_sp.xml
- /data/data/####/init_c1.pid
- /data/data/####/kuaidai.so-journal
- /data/data/####/libexec.so
- /data/data/####/libexecmain.so
- /data/data/####/libsgmainso-5.1.81.so.tmp
- /data/data/####/lock.lock
- /data/data/####/message.db-journal
- /data/data/####/multidex.version.xml
- /data/data/####/sdk.baa.app.xml
- /data/data/####/sdk.baa.user.xml
- /data/data/####/sdk.taobao.app.xml
- /data/data/####/sdk.taobao.user.xml
- /data/data/####/sharePreferencePatch.xml
- /data/data/####/sp.lock
- /data/data/####/swbridge
- /data/data/####/umeng_general_config.xml
- /data/data/####/ut.db
- /data/data/####/ut.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
Miscellaneous:
Executes the following shell scripts:
- getprop ro.product.cpu.abi
- sh -c cat /proc/2145/wchan
- sh -c cat /proc/2255/wchan
- sh -c cat /proc/2298/wchan
- sh -c cat /proc/2402/wchan
- sh -c cat /proc/2453/wchan
- sh -c cat /proc/2548/wchan
- sh -c cat /proc/2607/wchan
- sh -c cat /proc/2715/wchan
- sh -c cat /proc/2758/wchan
- sh -c cat /proc/2882/wchan
- sh -c cat /proc/3027/wchan
- sh -c cat /proc/3068/wchan
- sh -c cat /proc/3175/wchan
- sh -c cat /proc/3216/wchan
- sh -c cat /proc/3336/wchan
- sh -c cat /proc/3479/wchan
- sh -c cat /proc/3519/wchan
- sh -c cat /proc/3625/wchan
- sh -c cat /proc/3743/wchan
- sh -c cat /proc/3784/wchan
- sh -c cat /proc/3889/wchan
- sh -c cat /proc/3930/wchan
- sh -c cat /proc/4034/wchan
- sh -c cat /proc/4210/wchan
- sh -c cat /proc/4252/wchan
Loads the following dynamic libraries:
- c++_shared
- getuiext2
- libexec
- libexecmain
- mmkv
- sgmainso-5.1
- ut_c_api
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
