Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sc.n####.jp:80
- TCP(HTTP/1.1) ca####.mo####.n####.####.net:80
- TCP(HTTP/1.1) lcs.n####.jp:80
- TCP(TLS/1.0) 2####.58.211.110:443
DNS requests:
- appno####.n####.jp
- ch.bo####.com
- ch1bo####.com
- ch2.bo####.com
- dl.mo####.n####.jp
- lcs.n####.jp
- sc.n####.jp
HTTP GET requests:
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/card/06X01en...
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/card/06X10en...
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/card/06X15en...
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/card/06X16en...
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/card/06X22en...
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/02X04en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X02en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X03en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X04en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X06en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X07en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X09en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X10en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X11en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X12en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X13en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X14en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X15en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X16en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X18en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X19en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X20en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X21en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X22en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X23en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/img/06X24en....
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/json/2/card-...
- ca####.mo####.n####.####.net/linecard-static/1/resources/en/json/2/fonte...
- lcs.n####.jp/m?u=####&E####
HTTP POST requests:
- sc.n####.jp/cca
Modified file system:
Creates the following files:
- /data/data/####/app_tjxhclasses.jar
- /data/data/####/cpkgCache.xml
- /data/data/####/dbvglrt-journal
- /data/data/####/etagCache.xml
- /data/data/####/naver_app_nstat
- /data/data/####/naver_app_nstat-journal
- /data/data/####/pvCache.xml
- /data/data/####/temp_posting_image.png
- /data/data/####/webview.db-journal
- /data/data/####/xhwai
- /data/media/####/.nomedia
- /data/media/####/02X04en.jpg
- /data/media/####/06X01en.zip
- /data/media/####/06X02en.jpg
- /data/media/####/06X03en.jpg
- /data/media/####/06X04en.jpg
- /data/media/####/06X06en.jpg
- /data/media/####/06X07en.jpg
- /data/media/####/06X09en.jpg
- /data/media/####/06X10en.jpg
- /data/media/####/06X10en.zip
- /data/media/####/06X11en.jpg
- /data/media/####/06X12en.jpg
- /data/media/####/06X13en.jpg
- /data/media/####/06X14en.jpg
- /data/media/####/06X15en.jpg
- /data/media/####/06X15en.zip
- /data/media/####/06X16en.jpg
- /data/media/####/06X16en.zip
- /data/media/####/06X18en.jpg
- /data/media/####/06X19en.jpg
- /data/media/####/06X20en.jpg
- /data/media/####/06X21en.jpg
- /data/media/####/06X22en.jpg
- /data/media/####/06X22en.zip
- /data/media/####/06X23en.jpg
- /data/media/####/06X24en.jpg
- /data/media/####/card-categories.nhn
- /data/media/####/card-templates.nhn
- /data/media/####/fontexclusion.nhn
Miscellaneous:
Loads the following dynamic libraries:
- jyax
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.
