Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.627.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) appjoyr####.cn:7931
- TCP(HTTP/1.1) appjoyr####.cn:9336
DNS requests:
- appjoyr####.cn
HTTP POST requests:
- appjoyr####.cn:7931/at/config
- appjoyr####.cn:7931/at/pl
- appjoyr####.cn:7931/at/sevHost
- appjoyr####.cn:9336/log/biz
Modified file system:
Creates the following files:
- /data/data/####/1521216559.jar
- /data/data/####/1960785206.dex
- /data/data/####/1960785206.jar
- /data/data/####/2116827225.jar
- /data/data/####/629761508.jar
- /data/data/####/Kingplug.apk
- /data/data/####/base.so
- /data/data/####/d4ee7c208a6d8b695d0262cd232be664.jar
- /data/data/####/librarian
- /data/data/####/web2026.temp
- /data/data/####/web2038.temp
- /data/data/####/web2044.temp
- /data/data/####/web2055.temp
- /data/media/####/11bae28c3879e59e0da1aafc2b002f91.xml
- /data/media/####/189f8fcad9e1010b5342dfb3b1710d44.xml
- /data/media/####/994770e11bb1724efec284faa8b9a1ef.xml
- /data/media/####/b463d9537be6c7e70e3aec610d78b874.xml
- /data/media/####/cfg.xml
- /data/media/####/f7f9d1fbd8d22fac40a1a96a331a3468_31.f7
- /data/media/####/global.xml
- /data/media/####/webadlist_1.cache
- /data/media/####/webadlist_1.xml
- /data/media/####/webadlist_1_last.cache
- /data/media/####/webinfo.xml
Miscellaneous:
Loads the following dynamic libraries:
- base
Uses the following algorithms to encrypt data:
- DES-ECB-NoPadding
- Des-ECB-NoPadding
Uses the following algorithms to decrypt data:
- DES-ECB-NoPadding
- Des-ECB-NoPadding
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
