Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.1274.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) 1.h.1####.cn:80
- TCP(TLS/1.0) www.lo####.com:443
- TCP(TLS/1.0) s####.cn:443
- TCP(TLS/1.0) i0.h####.com:443
- TCP(TLS/1.0) v####.weib####.com.####.net:443
- TCP(TLS/1.0) and####.google####.com:443
DNS requests:
- 1.h.1####.cn
- and####.google####.com
- hui612####.lo####.com
- i0.h####.com
- r####.com
- s####.cn
- t####.sin####.cn
HTTP GET requests:
- 1.h.1####.cn/yc.txt
- i0.h####.com:443/bfs/album/0aa667d1255da8a1f29772f32f0bd6f1b2b79291.png
- i0.h####.com:443/bfs/album/0d6161ec0960d6bb5e0f0fdcb4870d87ef29aea5.png
- i0.h####.com:443/bfs/album/1cbb80d6fd7de51265992b9f8b48d2623006e236.png
- i0.h####.com:443/bfs/album/3b383da295544bc3f79e56e122eb21f5ff831a0d.png
- i0.h####.com:443/bfs/album/3e6b82c19415478d697943980d0fe87986d4c2b8.png
- i0.h####.com:443/bfs/album/5ec1a9e3129b1340ddc79550bc78f73877110688.png
- i0.h####.com:443/bfs/album/62a0b250656c0564897f1400258b7ce0ae578813.png
- i0.h####.com:443/bfs/album/6ceddb109ad82947063a897c386f4050a327443a.png
- i0.h####.com:443/bfs/album/8288fe5f6a4563300cd7ba2f3d313e36f0f22ab2.png
- i0.h####.com:443/bfs/album/b6fd852d2d3652accbde3579057d28586e570f94.png
- i0.h####.com:443/bfs/album/b998ec55266b05a96aff2bc0fc1c4e66b4ae69e3.png
- i0.h####.com:443/bfs/album/bd407c7c4e81f610e72834a2c2af3ac0aabc328d.png
- i0.h####.com:443/bfs/album/c79d773b965ae512479ad27cbb1b631caefec8a3.png
- i0.h####.com:443/bfs/album/da301bf9d1a84af0e40f6b3acecc6878637369ae.png
- i0.h####.com:443/bfs/album/e291ed0e3f89ad7b9b8caaeb66f375e9c8d791cd.png
- i0.h####.com:443/bfs/album/ef7ad2af09a2830d49dbfe9f2d2e268c7a78347c.png
- i0.h####.com:443/bfs/album/fb07350663eb5d30d638a14b3bc56265ed3f8c17.png
- s####.cn:443/7N3FHK
- s####.cn:443/SEp4pL
- s####.cn:443/VVs2XY
- s####.cn:443/kS64St
- v####.weib####.com.####.net:443/large/e6c9d24ely1h0v8dni3hzj205c05c3yb.jpg
- v####.weib####.com.####.net:443/large/e6c9d24ely1h0xz0u9tl9j205c05cwea.jpg
- v####.weib####.com.####.net:443/large/e6c9d24ely1h0zt0qbc8nj205c05cq2s.jpg
- v####.weib####.com.####.net:443/large/e6c9d24ely1h24rev5s8jj205c05cq2s.jpg
- www.lo####.com:443/post/73fd3793_2b50ca70a
- www.lo####.com:443/post/73fd3793_2b50caf14
- www.lo####.com:443/post/73fd3793_2b5610e78
File system changes:
Creates the following files:
- /data/data/####/.cl
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/09a19fcbe3f54270_0
- /data/data/####/0bd26812ce9d9b51_0
- /data/data/####/14e2480c1741969d_0
- /data/data/####/1aa04971ec7ec44c_0
- /data/data/####/1b412fa73862b008_0
- /data/data/####/2e5ef3683176ae5c_0
- /data/data/####/2f5095bdeaa9e144_0
- /data/data/####/368e1f92781d454f_0
- /data/data/####/3912b6b5a00c3b09_0
- /data/data/####/3e2b2d03653404a5_0
- /data/data/####/408eb79de938dbff_0
- /data/data/####/42b79bddb5a969db_0
- /data/data/####/43ed1dea37ef5cce_0
- /data/data/####/4ca6bb5592041a17_0
- /data/data/####/55ceb9d3fe118c56_0
- /data/data/####/568863054f076228_0
- /data/data/####/5b8d73b5d803d89b_0
- /data/data/####/5f3e10ae99cb5f83_0
- /data/data/####/61608b2863835424_0
- /data/data/####/704d72838ad82314_0
- /data/data/####/716b70e17519e71d_0
- /data/data/####/77d5d66cfaacf94e_0
- /data/data/####/786a8ca5cee9b0b4_0
- /data/data/####/7d7235b87669f03a_0
- /data/data/####/82787437229d837d_0
- /data/data/####/8999d58a821f4672_0
- /data/data/####/942fe1ff46a1f23c_0
- /data/data/####/9fbbbf9ca1bfeb97_0
- /data/data/####/Classes.dex
- /data/data/####/Classes.dex.flock (deleted)
- /data/data/####/Compression.dex
- /data/data/####/Compression.dex.flock (deleted)
- /data/data/####/Cookies-journal
- /data/data/####/Path.ini
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a0af3121e1c8f866_0
- /data/data/####/b1b5057b26d351e3_0
- /data/data/####/b6d01590d1a3bd7a_0
- /data/data/####/ba31aab695126426_0
- /data/data/####/bd594813e7b162a7_0
- /data/data/####/bfc4fc6c116d9378_0
- /data/data/####/c41227cc790d68c7_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/ee47e4ed0dc33259_0
- /data/data/####/f7432f8578f38d50_0
- /data/data/####/fbbdfbe404302a6b_0
- /data/data/####/fda09f5955f77530_0
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
- /data/data/####/ztk8.com_preferences.xml
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libArmEpicVm
- libjiagu
- libluajava
- libpl_droidsonroids_gif
- libygsiyu
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Displays its own windows over windows of other apps.
