Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Dowgin.14.origin
- Android.DownLoader.683.origin
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) dlap####.top:80
- TCP(HTTP/1.1) a####.u####.com.####.com:80
- TCP(TLS/1.0) 1####.250.153.95:443
- TCP(TLS/1.0) 74.1####.143.95:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.2) 1####.177.127.94:443
- TCP(TLS/1.2) md####.google####.com:443
- TCP(TLS/1.2) 1####.250.153.113:443
- UDP 1####.217.218.95:443
- UDP md####.google####.com:443
DNS requests:
- a####.u####.com
- dlap####.top
- m####.go####.com
- md####.google####.com
- o####.love521####.top
- o####.love521####.top.####.8
HTTP GET requests:
- dlap####.top/bapp.php?b_app_parameters=####
HTTP POST requests:
- a####.u####.com.####.com/app_logs
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/dalvik-cache/####/system@framework@am.jar@classes.dex
- /data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
- /data/data/####/.edata
- /data/data/####/.imprint
- /data/data/####/DisableService.xml
- /data/data/####/DownAppCount.xml
- /data/data/####/ShowAdCountAll.xml
- /data/data/####/ShowAdCountUnlockEveryTime.xml
- /data/data/####/ShowAdCount_dyd.xml
- /data/data/####/ShowAdCount_lk.xml
- /data/data/####/ShowAdCount_lm.xml
- /data/data/####/ShowAdCount_xsd.xml
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/appversion.xml
- /data/data/####/appversion.xml.bak
- /data/data/####/b.y2018.m02.d27.v02.dex
- /data/data/####/b.y2018.m02.d27.v02.dex.flock (deleted)
- /data/data/####/b.y2018.m02.d27.v02.jar
- /data/data/####/b.y2018.m02.d27.v02_preferences.xml
- /data/data/####/bappparameters.xml
- /data/data/####/bappparameters_2.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/classes.dex
- /data/data/####/classes.dex.flock (deleted)
- /data/data/####/classes.dve
- /data/data/####/classes.jar
- /data/data/####/com.pacedcd.az.dex
- /data/data/####/com.pacedcd.az.dex.flock (deleted)
- /data/data/####/com.pacedcd.az.jar
- /data/data/####/com.secneo.tmp3419
- /data/data/####/com.secneo.tmp3465
- /data/data/####/com.secneo.tmp3658
- /data/data/####/com.secneo.tmp3743
- /data/data/####/com.secneo.tmp3749
- /data/data/####/com.secneo.tmp4207
- /data/data/####/com.secneo.tmp5236
- /data/data/####/ebn.xml
- /data/data/####/ebn.xml.bak
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/firstTime.xml
- /data/data/####/judgeshowad.xml
- /data/data/####/metrics_guid
- /data/data/####/pqwn.db-journal
- /data/data/####/proc_auxv
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_it.cache
- /data/data/####/zd04f5365.xml
- /data/media/####/crash-2021-08-26-21-07-23-1630001243206.log
Miscellaneous:
Executes the following shell scripts:
- /system/bin/log -p d -t su /dev/com.android.settings/.socket3512
- /system/bin/log -p d -t su /dev/com.android.settings/.socket3736
- /system/bin/log -p d -t su 10065 /system/bin/app_process32 executing 0 /system/bin/sh using binary /system/bin/sh : sh
- /system/bin/log -p d -t su child exited
- /system/bin/log -p d -t su client exited 0
- /system/bin/log -p d -t su client exited 1
- /system/bin/log -p d -t su connecting client 3498
- /system/bin/log -p d -t su connecting client 3717
- /system/bin/log -p d -t su connecting client 4310
- /system/bin/log -p d -t su db allowed
- /system/bin/log -p d -t su remote args: 1
- /system/bin/log -p d -t su remote pid: 3498
- /system/bin/log -p d -t su remote pid: 3717
- /system/bin/log -p d -t su remote pid: 4310
- /system/bin/log -p d -t su remote pts_slave:
- /system/bin/log -p d -t su remote req pid: 3419
- /system/bin/log -p d -t su remote req pid: 3658
- /system/bin/log -p d -t su remote req pid: 4207
- /system/bin/log -p d -t su remote uid: 10065
- /system/bin/log -p d -t su sending code
- /system/bin/log -p d -t su starting daemon client 10065 10065
- /system/bin/log -p d -t su su invoked.
- /system/bin/log -p d -t su waiting for child exit
- /system/bin/log -p d -t su waiting for user
- /system/bin/log -p e -t su select failed with 2: No such file or directory
- /system/bin/log -p e -t su sqlite3 open /data/user_de/0/com.android.settings/databases/su.sqlite failure: 14
- /system/bin/log -p w -t su request rejected (10065->0 /system/bin/sh)
- sh
- su
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- DES
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- DES
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
