Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) googl####.g.doublec####.net:80
- TCP(HTTP/1.1) o####.cn:80
- TCP(HTTP/1.1) fd.0####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) img.gxhx####.com.####.cn:10443
- TCP(TLS/1.0) h5.frf####.com.####.cn:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) res.mu####.xin.####.cn:443
- TCP(TLS/1.0) www.cl####.com:10443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) c.c####.com:443
DNS requests:
- ap.ga####.com
- ap1.ga####.com
- ap2.ga####.com
- api.s####.b####.com
- c####.mm####.com
- c.c####.com
- fd.0####.com
- googl####.g.doublec####.net
- h5.frf####.com
- hm.b####.com
- img.gxhx####.com
- o####.cn
- p####.zhanz####.b####.com
- res.mu####.xin
- s9.c####.com
- sh.h####.com
- www.cl####.com
- z12.c####.com
HTTP GET requests:
- fd.0####.com/youmi/tui74/?qd=####
- googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40-load...
- googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40.html
- o####.cn/?utm_source=####&utm_medium=####
- s####.jom####.com/s.gif?l=/onexs.cn/?utm_source=####&utm_medium=####
File system changes:
Creates the following files:
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ads520153865.jar
- /data/data/####/classes.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbloqvr-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
