Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.683.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(TLS/1.0) k####.onetwo####.top:443
DNS requests:
- app.onetwo####.top
- k####.onetwo####.top
HTTP GET requests:
- ti####.c####.l####.####.com/swenjian/ac
Modified file system:
Creates the following files:
- /data/data/####/8ba13845-1319-453e-8c4a-f693aa2f22be.jar
- /data/data/####/AqmService.jar
- /data/data/####/AqmService.xml
- /data/data/####/MgActivity.xml
- /data/data/####/SUBOXLOG_
- /data/data/####/bfa224c9-a658-4f7b-96f3-243b8d77dee9
- /data/data/####/ebn.xml
- /data/data/####/pqwn.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- dice_jb2
- dice_loadlibrary
- ffmpeg_dice
- sonic
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.
