Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.699.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) ff.t####.com.####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP so1.yo####.com:7701
- TCP so3.yo####.com:7703
- TCP so2.yo####.com:7702
DNS requests:
- a####.u####.com
- feed####.u####.com
- ff.t####.com
- oc.u####.com
- so1.yo####.com
- so2.yo####.com
- so3.yo####.com
HTTP GET requests:
- ff.t####.com.####.com/d/41vy.jpg
HTTP POST requests:
- a####.u####.com/app_logs
- oc.u####.com/check_config_update
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/a.jar
- /data/data/####/mobclick_agent_online_setting_du.loyal.cstudy.xml
- /data/data/####/umeng_feedback_conversations.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/yoo_fs_download.db-journal
- /data/data/####/yoo_fsappInfo_pre.xml
- /data/data/####/yoo_fsconf_pre.xml
- /data/data/####/yoo_fsinfo_pre.xml
- /data/data/####/yoo_fstrategy_pre.xml
- /data/media/####/41vy.jpg.data
Miscellaneous:
Uses the following algorithms to decrypt data:
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
