Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Panda.5.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) req####.a####.cn:80
- TCP(HTTP/1.1) cd####.md####.cn.####.cn:80
- TCP(TLS/1.0) sett####.pic####.com:443
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) cd####.pic####.com:443
- TCP(TLS/1.0) 1####.217.17.46:443
- TCP(TLS/1.0) api.pic####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
DNS requests:
- api.pic####.com
- cd####.md####.cn
- cd####.pic####.com
- g####.face####.com
- req####.a####.cn
- sett####.pic####.com
- ssl.google-####.com
HTTP GET requests:
- cd####.md####.cn.####.cn/resource/gis/45
- req####.a####.cn/pservers/loadgis?token=####
File system changes:
Creates the following files:
- /data/data/####/1d51eaf1d24bb3384df98b6867a16cb09e4b00778fb4c76....0.tmp
- /data/data/####/2375cc8f7bcf297b29b12294b02ad91dbfb07124045108b....0.tmp
- /data/data/####/2c2b911ebeae79da9eb45a548a63445aa4fbae42ba29a73....0.tmp
- /data/data/####/348f81e13f14f8c0b61aeb3c54a87b5674dab9d3c1f5a5e....0.tmp
- /data/data/####/35de656de13fb112f561e599e1d813f5ca3a7074fbfc424....0.tmp
- /data/data/####/3a26b9698d0ac43d8a12474cab2f76ddecad32d7a13f3f9....0.tmp
- /data/data/####/3cb275befbe28992d5835ffb32e40100ae0106d7473dbe2....0.tmp
- /data/data/####/5a98f6b857bcda8b2f4867ddc5f2fd91.0.tmp
- /data/data/####/5a98f6b857bcda8b2f4867ddc5f2fd91.1.tmp
- /data/data/####/60fdbc75d5c60bb6e5508f43ba83fc6284a73600c51da3a....0.tmp
- /data/data/####/694beea7ecdfbb778210ac6582e86b66b476b832fe6801e....0.tmp
- /data/data/####/77b84c82f5157ce1e2de2c0611a01902.0.tmp
- /data/data/####/77b84c82f5157ce1e2de2c0611a01902.1.tmp
- /data/data/####/77bbfa0c6309890b3322fdc9647ccd360a312ae8ad25467....0.tmp
- /data/data/####/7aba14b2fc12fe75da371847eb99c745c187766b5f345cc....0.tmp
- /data/data/####/8c1bf7e9b0c5d8f83c9d7071e157d11d0358e14cb4a0f31....0.tmp
- /data/data/####/9e20f20c51df1ae1767cb2d4b7c5fedf886a2cc52dd5a68....0.tmp
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/KAs.zip
- /data/data/####/a84fa74061e7ddc84b49617951a71e98a81c8d136475831....0.tmp
- /data/data/####/af062f4ce2bd119e776d1fd07fbad8ff51093bb7b64e5a0....0.tmp
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.picsart.analytics.xml
- /data/data/####/com.picsart.animator.ui.activity.myAppName.xml
- /data/data/####/com.picsart.br.deviceid.key.xml
- /data/data/####/com.picsart.br.zip
- /data/data/####/com.picsart.br_preferences.xml
- /data/data/####/d4b280765585e2fca4940fb5e5ad86e96e8b68168f10739....0.tmp
- /data/data/####/d74e9001269d3c522b53edca254020be.0.tmp
- /data/data/####/d74e9001269d3c522b53edca254020be.1.tmp
- /data/data/####/eventBatcher
- /data/data/####/eventBatcher-journal
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/journal.tmp
- /data/media/####/drafts_meta.json
- /data/media/####/exponent.dat
- /data/media/####/extension.dat
- /data/media/####/info.dat
- /data/media/####/mantissa.dat
- /data/media/####/meta.json
- /data/media/####/models.zip
- /data/media/####/pics-1509976967655.png
- /data/media/####/pics-1510065599647.png
- /data/media/####/pics-1510065599713.png
- /data/media/####/pics-1510065599761.png
- /data/media/####/pics-1510065599791.png
- /data/media/####/pics-1510065599826.png
- /data/media/####/pics-1510065599860.png
- /data/media/####/pics-1510065599897.png
- /data/media/####/pics-1510065599931.png
- /data/media/####/pics-1543824041096
- /data/media/####/pics-1543824041125
- /data/media/####/pics-1543824047764
- /data/media/####/pics-1543824047811
- /data/media/####/pics-1543824047825
- /data/media/####/pics-1543824047860
- /data/media/####/pics-1543824047889
- /data/media/####/pics-1543824047904
- /data/media/####/pics-1543824047931
- /data/media/####/pics-1543824047949
- /data/media/####/pics-1543824047968
- /data/media/####/proj_config.json
- /data/media/####/project_1510233679862.gif
- /data/media/####/remote_stickers_meta.json
- /data/media/####/stickers_meta.json
- /data/media/####/thumb-1543824041120
- /data/media/####/thumb-1543824041144
- /data/media/####/thumb-1543824047773
- /data/media/####/thumb-1543824047817
- /data/media/####/thumb-1543824047846
- /data/media/####/thumb-1543824047871
- /data/media/####/thumb-1543824047896
- /data/media/####/thumb-1543824047922
- /data/media/####/thumb-1543824047937
- /data/media/####/thumb-1543824047955
- /data/media/####/thumb-1543824047979
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
Loads the following dynamic libraries:
- imageopcommon
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Accesses camera interface.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
