Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.397.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) www.ligongj####.cn:9090
DNS requests:
- www.ligongj####.cn
- www.m####.org
HTTP GET requests:
- ti####.c####.l####.####.com/hui_cdn_config.json
HTTP POST requests:
- www.ligongj####.cn:9090/admin.php?s=####
Modified file system:
Creates the following files:
- <Package Folder>/app_libs/0dn
- <Package Folder>/app_libs/1dn
- <Package Folder>/app_libs/dn
- <Package Folder>/app_zip/classes.jar
- <Package Folder>/app_zip/libus.so
- <Package Folder>/files/0xP
- <Package Folder>/files/1xP
- <Package Folder>/files/xP
- <Package Folder>/libus.lock
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/virtual/####/0.xml
- <Package Folder>/virtual/####/base.apk
- <Package Folder>/virtual/####/com.klsm.comss_preferences.xml
- <Package Folder>/virtual/####/data@app@com.klsm.comss-1@base.ap...es.dex
- <Package Folder>/virtual/####/device-info.ini
- <Package Folder>/virtual/####/package.ini
- <Package Folder>/virtual/####/packages.ini
- <Package Folder>/virtual/####/signature.ini
- <Package Folder>/virtual/####/uid-list.ini
- <Package Folder>/virtual/####/userlist.xml
- <Package Folder>/virtual/####/wifiMacAddress
Miscellaneous:
Loads the following dynamic libraries:
- libus
- va++
Uses the following algorithms to decrypt data:
- AES
Displays its own windows over windows of other applications.
