Adware.Kyview.144

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Kyview.1.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) a.dia####.com:80
TCP(HTTP/1.1) tvnow####.tv####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) msg.umengc####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) 1####.40.182.161:3553
TCP(HTTP/1.1) s.y####.net:80
TCP(HTTP/1.1) 42.1####.111.105:8085
TCP(HTTP/1.1) u####.tv####.com:80
TCP(HTTP/1.1) 1####.40.182.117:3553
TCP(HTTP/1.1) u####.umengc####.com:80
TCP(HTTP/1.1) api.m.ta####.com:80
TCP(HTTP/1.1) api.appj####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) n####.tv####.com:80
TCP 1####.205.203.84:80

DNS requests:

a####.m.ta####.com
a####.u####.com
a.dia####.com
aow.d####.com
api.appj####.com
au.u####.co
au.u####.com
feed####.u####.com
ip.ta####.com
mi.g####.qq.com
msg.umengc####.com
n####.tv####.com
oc.u####.com
s####.e.qq.com
s####.gw.y####.net
s.y####.net
tvnow####.tv####.com
u####.tv####.com
u####.umengc####.com
u####.umengc####.com

HTTP GET requests:

api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
ip.ta####.com/service/getIpInfo.php?ip=####&qq-pf-to=####
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
n####.tv####.com/list_plugin_meta.php?app_name_version=####
n####.tv####.com/tv/tvnow_andriod_init.php
s.y####.net/aos/v3/pns?s=####
s.y####.net/stat/aos/v3/init?s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
tvnow####.tv####.com/json/points_level.json
tvnow####.tv####.com/json/public_notice_yuntu_android.json
tvnow####.tv####.com/json/recommends_app_android2.json
u####.tv####.com/app_conf?version=####&nwtime=####&app=####&keys=####&si...
u####.tv####.com/get_conf?nwtime=####&keys=####&sign=####
u####.tv####.com/init_account?version=####&imei=####&nwtime=####&source=...
u####.tv####.com/login?version=####&imei=####&nwtime=####&source=####&ic...
u####.umengc####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=...
u####.umengc####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=##...
u####.umengc####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####...

HTTP POST requests:

a####.m.ta####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&s...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
a.dia####.com/dev/api/connect.php?device_id=####&imsi=####&device_name=#...
api.appj####.com/appjiagu
msg.umengc####.com/v2/launch
msg.umengc####.com/v2/register
oc.u####.com/check_config_update
s####.e.qq.com/activate?queueSize=####
s####.e.qq.com/err?queueSize=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/26c6024817ebe6cc5fe092e11921a624
/data/data/####/26c6024817ebe6cc5fe092e11921a624-journal
/data/data/####/5c2db2dcd9e8b7b0640d9401032b7ab2
/data/data/####/5c2db2dcd9e8b7b0640d9401032b7ab2-journal
/data/data/####/AGOO_CONNECT.xml
/data/data/####/AGOO_HOST.xml
/data/data/####/Alvin2.xml
/data/data/####/AppStore.xml
/data/data/####/CE94557724F842149D690D0E8CBB1CBD.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/Fungolive.db
/data/data/####/Fungolive.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/P15pKIjsm64m
/data/data/####/P15pKIjsm64m-journal
/data/data/####/PhoneUtil.xml
/data/data/####/T1oX0rhhuXWt
/data/data/####/T1oX0rhhuXWt-journal
/data/data/####/UTMCBase.xml
/data/data/####/UTMCConf916823314.xml
/data/data/####/UTMCLog916823314.xml
/data/data/####/XKwVoK0huy3R
/data/data/####/XKwVoK0huy3R-journal
/data/data/####/agoo.pid
/data/data/####/b9e8619c9efc7269969fcba9c0e9f41c-journal
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/jiagu.lock
/data/data/####/jqIqJYOT3JpT
/data/data/####/jqIqJYOT3JpT-journal
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_org.fungo.fungolive3320
/data/data/####/mobclick_agent_online_setting_org.fungo.fungolive.xml
/data/data/####/org.fungo.fungolive.xml
/data/data/####/org.fungo.fungolive_preferences.xml
/data/data/####/preferences.xml
/data/data/####/register.xml
/data/data/####/s_update.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/umeng_socialize_qq.xml
/data/data/####/uuid.xml
/data/data/####/wIU6pTyUBYWX
/data/data/####/wIU6pTyUBYWX-journal
/data/data/####/webview.db-journal
/data/data/####/wsUL1uCdKvjD
/data/data/####/wsUL1uCdKvjD-journal
/data/media/####/.nomedia
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/djaof.dll
/data/media/####/i42d45df023jnkdd93la483f9xGFKXI
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 60 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D {"package":"<Package>","appKey":"umeng:5218671c56240beed9029b0f","utdid":"W8EfgrvxA+YDAGdzx1GGKjyc","sdkVersion":"20150423"} -I 100.69.168.33 -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
getprop ro.product.cpu.abi
sh

Loads the following dynamic libraries: