Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) cn-bing####.cn.a-####.####.net:80
- TCP(HTTP/1.1) js.u####.51.####.com:80
- TCP(HTTP/1.1) i2.t####.com.####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) i####.c####.com:80
- TCP(HTTP/1.1) www.cfzhu####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
- TCP(HTTP/1.1) www.cx####.com:80
- TCP(HTTP/1.1) q4.q####.cn:80
- TCP(HTTP/1.1) cdn.q####.net:80
- TCP(HTTP/1.1) ds.k####.cn:80
- TCP(HTTP/1.1) www.xi####.com:80
- TCP(SSL/3.0) www.cgt####.com:443
- TCP(TLS/1.0) bj.bc####.com:443
- TCP(TLS/1.0) www.cgt####.com:443
DNS requests:
- bj.bc####.com
- c####.mm####.com
- c.c####.com
- cdn.q####.net
- cdn.static####.org
- cn.b####.com
- ds.k####.cn
- i####.51.la
- i####.c####.com
- i2.t####.com
- js.u####.51.la
- n####.yo####.com
- pco####.c####.com
- q4.q####.cn
- s11.c####.com
- www.cfzhu####.com
- www.cgt####.com
- www.cx####.com
- www.xi####.com
- z13.c####.com
HTTP GET requests:
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/z_stat.php?id=####&show=####
- cdn.q####.net/assets/img/background/4.jpg
- cn-bing####.cn.a-####.####.net/az/hprichbg/rb/RainierDawn_ZH-CN918247081...
- ds.k####.cn/
- ds.k####.cn/ajax.php?act=####
- ds.k####.cn/ajax.php?act=####&cid=####&info=####
- ds.k####.cn/assets/appui/js/app.js
- ds.k####.cn/assets/appui/js/plugins.js
- ds.k####.cn/assets/css/common.css
- ds.k####.cn/assets/img/right.png
- ds.k####.cn/assets/js/main.js?ver=####
- ds.k####.cn/assets/simple/css/main.css
- ds.k####.cn/assets/simple/css/oneui.css
- ds.k####.cn/assets/simple/css/plugins.css
- ds.k####.cn/img/favicon.png
- gl####.w.kunl####.####.com/font-awesome/4.7.0/css/font-awesome.min.css
- gl####.w.kunl####.####.com/font-awesome/4.7.0/fonts/fontawesome-webfont....
- gl####.w.kunl####.####.com/jquery-cookie/1.4.1/jquery.cookie.min.js
- gl####.w.kunl####.####.com/jquery.lazyload/1.9.1/jquery.lazyload.min.js
- gl####.w.kunl####.####.com/jquery/1.12.4/jquery.min.js
- gl####.w.kunl####.####.com/layer/2.3/layer.js
- gl####.w.kunl####.####.com/layer/2.3/skin/default/loading-2.gif
- gl####.w.kunl####.####.com/layer/2.3/skin/layer.css
- gl####.w.kunl####.####.com/modernizr/2.8.3/modernizr.min.js
- gl####.w.kunl####.####.com/twitter-bootstrap/3.3.7/css/bootstrap.min.css
- gl####.w.kunl####.####.com/twitter-bootstrap/3.3.7/fonts/glyphicons-half...
- gl####.w.kunl####.####.com/twitter-bootstrap/3.3.7/js/bootstrap.min.js
- gm.mm####.com/9.gif?abc=####&rnd=####
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- i####.c####.com/img/pic.gif
- i2.t####.com.####.com/593183/14e48f6de4319bd7.jpg
- i2.t####.com.####.com/593183/4488aca29d9c83ae.jpg
- i2.t####.com.####.com/593183/60720d1085cc86de.jpg
- i2.t####.com.####.com/593183/944ce63627983074.jpg
- i2.t####.com.####.com/593183/d6ac4e371a876944.png
- js.u####.51.####.com/18855916.js
- pco####.ta####.com/app.gif?&cna=####
- q4.q####.cn/headimg_dl?dst_uin=####&spec=####
- www.cfzhu####.com/
- www.cfzhu####.com/app
- www.cfzhu####.com/app/
- www.cfzhu####.com/app/base.css
- www.cfzhu####.com/app/bg1.jpg
- www.cfzhu####.com/app/favicon.ico
- www.cfzhu####.com/app/foot.js
- www.cfzhu####.com/app/gravity_h.png
- www.cfzhu####.com/app/logo.png
- www.cfzhu####.com/app/p1_btn3.png
- www.cfzhu####.com/app/p1_btn4.png
- www.cfzhu####.com/app/p1_cfk.png
- www.cfzhu####.com/app/parallax.js
- www.cfzhu####.com/banner1.jpg
- www.cfzhu####.com/banner_bg1.jpg
- www.cfzhu####.com/banner_bg2.jpg
- www.cfzhu####.com/base.css
- www.cfzhu####.com/cf.css
- www.cfzhu####.com/cf.txt
- www.cfzhu####.com/cf_sprites.png
- www.cfzhu####.com/changyan.js
- www.cfzhu####.com/favicon.ico
- www.cfzhu####.com/foot.js
- www.cfzhu####.com/jquery-1.9.1.min.js
- www.cfzhu####.com/logo.png
- www.cfzhu####.com/qcode.png
- www.cfzhu####.com/tongji2.html
- www.cx####.com/
- www.cx####.com/?nktork=####
- www.cx####.com/assets/appui/js/app.js
- www.cx####.com/assets/appui/js/plugins.js
- www.cx####.com/assets/css/common.css
- www.cx####.com/assets/js/main.js?ver=####
- www.cx####.com/assets/simple/css/oneui.css
- www.cx####.com/assets/simple/img/head2.png
- www.xi####.com/cf.txt
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/WebpageIcons.db-journal
- /data/data/####/com.cf.zhushou.push_sync.xml
- /data/data/####/com.cf.zhushou.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml.bak
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/index
- /data/data/####/libjiagu522225854.so
- /data/data/####/plugin-deploy.jar
- /data/data/####/plugin-deploy.key
- /data/data/####/pst.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/1c7a9xeggrj7smbjhxqntmowi.tmp
- /data/media/####/1dza8ak2f0mu9wrk3fva18ci6.tmp
- /data/media/####/4rhcq1n7rcmw0ffi7ytobl1yp.tmp
- /data/media/####/50mwsb1rv7b57e3g62ipmfueq.tmp
- /data/media/####/63n0nguq7x7u9wbvu7ut5uc61.tmp
Miscellaneous:
Loads the following dynamic libraries:
- bdpush_V2_2
- libjiagu522225854
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
