Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Panda.5.origin
Downloads the following detected threats from the Web:
- Adware.Panda.5.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.md####.cn:80
- TCP(HTTP/1.1) geo.q####.y####.com:80
- TCP(HTTP/1.1) f####.staticf####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) geo.y####.com:80
- TCP(HTTP/1.1) www.face####.com:80
- TCP(HTTP/1.1) cdn.zs####.cn:8080
- TCP(HTTP/1.1) b.scoreca####.com.####.net:80
- TCP(HTTP/1.1) www.fl####.com:80
- TCP(HTTP/1.1) www.iphotom####.com:80
- TCP(HTTP/1.1) c1.staticf####.com:80
- TCP(TLS/1.0) api.fl####.com:443
- TCP(TLS/1.0) s.y####.com:443
- TCP(TLS/1.0) face####.com:443
- TCP(TLS/1.0) cdn.siftsci####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) c1.staticf####.com:443
- TCP(TLS/1.0) hexagon####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
- TCP(TLS/1.0) f####.com:443
DNS requests:
- api.fl####.com
- b.scoreca####.com
- c1.staticf####.com
- cdn.siftsci####.com
- cdn.zs####.cn
- f####.com
- f####.net
- f####.staticf####.com
- f####.staticf####.com
- face####.com
- geo.q####.y####.com
- geo.y####.com
- hexagon####.com
- m.face####.com
- s.y####.com
- sconten####.xx.f####.net
- st####.xx.f####.net
- www.face####.com
- www.fl####.com
- www.go####.com
- www.google-####.com
- www.iphotom####.com
- www.md####.cn
HTTP GET requests:
- b.scoreca####.com.####.net/p2?c1=####&c2=####&c3=####&c4=####&c5=####&c6...
- b.scoreca####.com.####.net/p?c1=####&c2=####&c3=####&c4=####&c5=####&c6=...
- c1.staticf####.com/1/981/41210337114_70a377f4af.jpg
- c1.staticf####.com/5/4147/buddyicons/1573419@N23.jpg?129032####
- c1.staticf####.com/5/4281/35001160014_9ac74e178c_m.jpg
- c1.staticf####.com/5/4377/37394928251_966baa1f95_m.jpg
- cdn.zs####.cn:8080/resource/gis/45
- f####.staticf####.com/5174/buddyicons/58899320@N02.jpg
- f####.staticf####.com/5504/buddyicons/65516928@N06.jpg
- f####.staticf####.com/5704/buddyicons/43559902@N07.jpg
- f####.staticf####.com/652/buddyicons/104507056@N06.jpg
- f####.staticf####.com/964/buddyicons/60344700@N05.jpg
- geo.y####.com/p?s=####&t=####&_I=####&_AO=####&_NOL=####&_R=####&_P=####...
- www.face####.com/pages/TouchRetouch/127071470663574
- www.fl####.com/beacon_client_api_timings.gne?e=####&a=####
- www.fl####.com/beacon_page_timings.gne?timing_pageid=####&page_start=###...
- www.fl####.com/groups/1573419@N23/
- www.fl####.com/hermes_error_beacon.gne
- www.go####.com/complete/search?hl=####&client=####&q=####
- www.iphotom####.com/
- www.iphotom####.com/favicon.ico
HTTP POST requests:
- geo.q####.y####.com/v1/public/yql?yhlVer=####&yhlClient=####&yhlS=####&y...
- www.md####.cn/pservers/loadip
Modified file system:
Creates the following files:
- /data/data/####/message.zip
- /data/data/####/zbcn.zip
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /proc/cpuinfo
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES-CFB-NoPadding
Displays its own windows over windows of other applications.
