Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) iad.daoyo####.com:80
- TCP(HTTP/1.1) ipa####.com:80
- TCP(HTTP/1.1) m.qy.u####.cn:80
- TCP(HTTP/1.1) map.b####.com:80
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) q####.daoyo####.com:80
- TCP(HTTP/1.1) st####.t####.b####.com:80
- TCP(HTTP/1.1) devel####.b####.com:80
- TCP(HTTP/1.1) img.q####.daoyo####.com:80
DNS requests:
- a####.map.b####.com
- api.map.b####.com
- bz.o####.com
- bz1.o####.com
- bz2.o####.com
- devel####.b####.com
- iad.daoyo####.com
- img.q####.daoyo####.com
- ipa####.com
- m.qy.u####.cn
- map.b####.com
- q####.daoyo####.com
- st####.t####.b####.com
HTTP GET requests:
- api.map.b####.com/?qt=####&ak=####&callback=####
- api.map.b####.com/api?v=####&ak=####
- api.map.b####.com/components?ak=####&v=####
- api.map.b####.com/getscript?v=####&ak=####&services=####&t=####
- api.map.b####.com/images/blank.gif?product=####&sub_product=####&v=####&...
- devel####.b####.com/map/jsdemo/demo/convertor.js
- img.q####.daoyo####.com/upload/18138/bottom/20140415/21052.png
- img.q####.daoyo####.com/upload/18138/bottom/20140415/21053.png
- img.q####.daoyo####.com/upload/18138/bottom/20140415/21054.png
- img.q####.daoyo####.com/upload/18138/bottom/20140415/21056.png
- img.q####.daoyo####.com/upload/18138/bottom/20140415/21057.png
- img.q####.daoyo####.com/upload/18138/bottom/20140415/21062.png
- img.q####.daoyo####.com/upload/35338/bottom/2036/5360613.png
- img.q####.daoyo####.com/upload/35338/content/2045/5500607.jpg
- img.q####.daoyo####.com/upload/35338/content/2045/5500610.jpg
- img.q####.daoyo####.com/upload/35338/procat/2015085/5006449.png
- img.q####.daoyo####.com/upload/35338/procat/2015085/5006535.png
- img.q####.daoyo####.com/upload/35338/procat/2015085/5006581.png
- img.q####.daoyo####.com/upload/mall/35338/product/20151103/5333166.jpg
- img.q####.daoyo####.com/upload/mall/35338/product/20160121/5622632.jpg
- img.q####.daoyo####.com/upload/mall/35338/product/20160121/5623326.jpg
- img.q####.daoyo####.com/upload/mall/35338/product/20160121/5623331.jpg
- img.q####.daoyo####.com/upload/mall/35338/product/20160121/5623332.jpg
- img.q####.daoyo####.com/upload/mall/35338/product/20160121/5623603.jpg
- img.q####.daoyo####.com/upload/mall/35338/product/20160121/5623628.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281898907085376.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281903246074807.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281909362029607.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281915472076713.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281922988079406.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281923109078091.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281929345006854.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281933480001579.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281937466077864.jpg
- ipa####.com/upload/ueditor/image/20151228/1451281940109054737.jpg
- m.qy.u####.cn/home/navbar/get.do?tenantid=####&clientid=####&link=####&t...
- m.qy.u####.cn/home/navbar/navNumSession.do?id=####
- m.qy.u####.cn/statics/common/font-awesome/css/font-awesome.min.css
- m.qy.u####.cn/statics/common/font-awesome/fonts/fontawesome-webfont.ttf?...
- m.qy.u####.cn/statics/common/icons/icon.css
- m.qy.u####.cn/statics/common/script/addToCart.js
- m.qy.u####.cn/statics/common/script/jquery.fly.min.js
- m.qy.u####.cn/style/mall/icons/icon.css
- m.qy.u####.cn/style/web/font-awesome.css
- m.qy.u####.cn/upload/35338/content/2045/5500607.jpg
- m.qy.u####.cn/web/info_showWebInfo.do?cid=####&manufacturer=####&appname...
- m.qy.u####.cn/web/info_showWebInfo.do?tenantid=####&link=####
- m.qy.u####.cn/web/info_wxsaoyisao.do?url=http://m.qy.u-kor.cn/web/info_s...
- m.qy.u####.cn/web/info_wxsaoyisao.do?url=http://m.qy.u-kor.cn/webmall/pr...
- m.qy.u####.cn/web/info_wxsaoyisao.do?url=http://m.qy.u-kor.cn/webmall/se...
- m.qy.u####.cn/webmall/pro_proDetail.do?tenantid=####&id=####
- m.qy.u####.cn/webmall/productList.do?tenantid=####&catid=####
- m.qy.u####.cn/webmall/productList.do?tenantid=####&catid=####&parentid=#...
- m.qy.u####.cn/webmall/search_fuzzySearch.do?tenantid=####&catid=####
- m.qy.u####.cn/webmall/search_pageJson.do?parentid=####&level=####&tenant...
- m.qy.u####.cn/webmall/search_productCateList.do?searchKeyword=####&tenan...
- m.qy.u####.cn/webmall/search_productCateList.do?tenantid=####
- m.qy.u####.cn/webmall/search_productLevel.do?keyword=####&catid=####&ten...
- map.b####.com/components?v=####&file=####&hash=####
- q####.daoyo####.com/images/440-220.png
- q####.daoyo####.com/images/640-380.png
- q####.daoyo####.com/images/h5/share_qqZone.png
- q####.daoyo####.com/images/hideBg.png
- q####.daoyo####.com/js/WeixinShare.js
- q####.daoyo####.com/js/alert.js
- q####.daoyo####.com/js/echo.min.js?a=####
- q####.daoyo####.com/js/jquery-1.7.2.min.js
- q####.daoyo####.com/js/jweixin-1.0.0.js
- q####.daoyo####.com/js/mall/product/search001.js
- q####.daoyo####.com/js/o2o/simpleSessionStorage.js
- q####.daoyo####.com/navbar/centeralNav/img/centeralMenu.png
- q####.daoyo####.com/navbar/centeralNav/js/centeralNav.js
- q####.daoyo####.com/statics/common/css/common.css
- q####.daoyo####.com/statics/common/css/global.css
- q####.daoyo####.com/statics/common/css/main.css
- q####.daoyo####.com/statics/common/css/reset.css
- q####.daoyo####.com/statics/common/css/swiper.min.css
- q####.daoyo####.com/statics/common/img/carIcon.png
- q####.daoyo####.com/statics/common/img/cartL.png
- q####.daoyo####.com/statics/common/script/foot.js?a=####
- q####.daoyo####.com/statics/common/script/head.js
- q####.daoyo####.com/statics/common/script/iscroll.js
- q####.daoyo####.com/statics/common/script/jquery-1.8.3.min.js
- q####.daoyo####.com/statics/common/script/swiper.min.js
- q####.daoyo####.com/statics/common/skin/skin_appleGreen.css
- q####.daoyo####.com/statics/private/commodityCategory/common/css/menuBox...
- q####.daoyo####.com/statics/private/commodityCategory/common/script/menu...
- q####.daoyo####.com/statics/private/commodityCategory/imgTxtCategory/css...
- q####.daoyo####.com/statics/private/grid_edit/css/model.css
- q####.daoyo####.com/statics/private/grid_edit/css/wnUniversalCell.css
- q####.daoyo####.com/statics/private/grid_edit/js/model.js
- q####.daoyo####.com/statics/private/productItem/css/businessList.css
- q####.daoyo####.com/statics/private/productItem/css/commodityDetails.css
- q####.daoyo####.com/statics/private/productItem/script/commodityDetails.js
- q####.daoyo####.com/statics/subCommon/css/commonPlus.css
- q####.daoyo####.com/statics/subCommon/css/subCommon.css
- q####.daoyo####.com/statics/subCommon/js/andriod_fixed.js
- q####.daoyo####.com/statics/subCommon/js/andriod_fixed_home.js
- q####.daoyo####.com/statics/subCommon/js/subCommon.js
- q####.daoyo####.com/style/footer.css
- q####.daoyo####.com/style/header.css
- q####.daoyo####.com/style/mall/css/css_mall.css
- q####.daoyo####.com/style/web/style.css
- st####.t####.b####.com/tb/pms/img/st.gif?ts=####&t=####&sid=####&ver=###...
HTTP POST requests:
- iad.daoyo####.com/web/display/push.do
- m.qy.u####.cn/app/getAndroidSendInfo.do
- m.qy.u####.cn/home/webContent/saveClient.do
- m.qy.u####.cn/home/webContent/saveLogForAdms.do
- m.qy.u####.cn/web/info_getBannerHeight.do
- m.qy.u####.cn/web/info_openPic.do
- m.qy.u####.cn/webmall/searchFavorites.do
Modified file system:
Creates the following files:
- /data/data/####/CookiePrefsFile.xml
- /data/data/####/DHotel.xml
- /data/data/####/DHotelService.xml
- /data/data/####/classes.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbzafw-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
