Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Lqsoft.1.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) th####.z####.com.####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) them####.nq.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) 1####.217.20.78:443
DNS requests:
- adser####.go####.com
- ssl.gst####.com
- th####.z####.com
- them####.nq.com
- www.go####.com
- www.go####.nl
- www.gst####.com
- zx####.154####.com
- zx####.ope####.com
HTTP GET requests:
- th####.z####.com.####.com/theme/073b119d96f0335ce0854a96fb6d9b73.jpg
- th####.z####.com.####.com/theme/097c703bd882c8eb1562acdb8f8c6979.jpg
- th####.z####.com.####.com/theme/213d1f6d089e7d9d3783839af149d2a4.jpg
- th####.z####.com.####.com/theme/224827f8daa3922fec7680d297945884.jpg
- th####.z####.com.####.com/theme/2318eae417b716ed4ed106e0ea28fa6a.jpg
- th####.z####.com.####.com/theme/242ececd8d9b46fa0d8078dec0a4d7ac.jpg
- th####.z####.com.####.com/theme/369c5fc1f90f83429d9aefb1dd59af8a.jpg
- th####.z####.com.####.com/theme/3b3f7ae8ec5effd34de9550b52313c46.jpg
- th####.z####.com.####.com/theme/435c74d815c627911b45285d6f1e720e.jpg
- th####.z####.com.####.com/theme/4a1e0858c69793d223b51d855a09aa99.jpg
- th####.z####.com.####.com/theme/64f0a78b18adbcf46cc39921e33233cc.jpg
- th####.z####.com.####.com/theme/7e57350b6767d222e4db38d8e7f2935f.jpg
- th####.z####.com.####.com/theme/a0bbb92c3b49efc2f2a2f130d8e3cc0d.jpg
- th####.z####.com.####.com/theme/a505adb7246385c837b2bc7c6b23625e.jpg
- th####.z####.com.####.com/theme/adc93815339e91708d9b70e8cfe46968.jpg
- th####.z####.com.####.com/theme/b2b7923b71ac082a38f35c3afacdf23e.jpg
- th####.z####.com.####.com/theme/c3402f94224d6281067d2dce42fb05ad.jpg
- th####.z####.com.####.com/theme/ce33eca7e2fe7d03d730d084e926f0b5.jpg
- th####.z####.com.####.com/theme/dd6da76fa50ef9768988838a32502447.jpg
- th####.z####.com.####.com/theme/ed9097cc7b429787b7f9adedf06e26e2.jpg
- th####.z####.com.####.com/theme/fade15b4ad2d87efd41ccde60a36fb53.jpg
- th####.z####.com.####.com/welcome/4223a2ab2793cea4ba50eeba95eb0535.jpg
- th####.z####.com.####.com/zteBanner/43f223bc141ca58e9c91789923e365f7.png
- th####.z####.com.####.com/zteBanner/5b048ee1159fdbb43e3364c369935bd0.png
- th####.z####.com.####.com/zteBanner/8a9601465506cd5d0e7bbd35654c5512.png
- th####.z####.com.####.com/zteBanner/a69b56eabde0717b7f95698660fb9e82.png
File system changes:
Creates the following files:
- /data/data/####/-1346707922.apk
- /data/data/####/4d0fc08a23.jar
- /data/data/####/AdSDKChaping.xml
- /data/data/####/AdSDKSettings.xml
- /data/data/####/AdSDKexposed.xml
- /data/data/####/LiveSDKSettings.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/data.db-journal
- /data/data/####/ginkgo.db-journal
- /data/data/####/scroll_pos_library.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
- /data/media/####/-120703737
- /data/media/####/-120703737.tmp
- /data/media/####/-1324019202
- /data/media/####/-1324019202.tmp
- /data/media/####/-1500293960
- /data/media/####/-1500293960.tmp
- /data/media/####/-1703672779
- /data/media/####/-1703672779.tmp
- /data/media/####/-2028473470
- /data/media/####/-2028473470.tmp
- /data/media/####/-358765725
- /data/media/####/-358765725.tmp
- /data/media/####/-500298308
- /data/media/####/-500298308.tmp
- /data/media/####/-957086750
- /data/media/####/-957086750.tmp
- /data/media/####/.nomedia
- /data/media/####/1082177016
- /data/media/####/1082177016.tmp
- /data/media/####/1118820148
- /data/media/####/1118820148.tmp
- /data/media/####/1132641204
- /data/media/####/1132641204.tmp
- /data/media/####/1431646406
- /data/media/####/1431646406.tmp
- /data/media/####/1711128048
- /data/media/####/1711128048.tmp
- /data/media/####/1776537136
- /data/media/####/1776537136.tmp
- /data/media/####/1875153004
- /data/media/####/1875153004.tmp
- /data/media/####/1880439727
- /data/media/####/1880439727.tmp
- /data/media/####/2052927868
- /data/media/####/2052927868.tmp
- /data/media/####/2085038007
- /data/media/####/2085038007.tmp
- /data/media/####/22728360
- /data/media/####/22728360.tmp
- /data/media/####/361886520
- /data/media/####/361886520.tmp
- /data/media/####/484519781
- /data/media/####/484519781.tmp
- /data/media/####/587290882
- /data/media/####/587290882.tmp
- /data/media/####/799363275
- /data/media/####/799363275.tmp
- /data/media/####/949037451
- /data/media/####/949037451.tmp
- /data/media/####/968840353
- /data/media/####/968840353.tmp
- /data/media/####/crash-2019-01-22_12-54-44.log
- /data/media/####/crash-2019-01-22_12-54-51.log
- /data/media/####/crash-2019-01-22_12-54-56.log
- /data/media/####/lockfile.lock
- /data/media/####/switch_enable
- /data/media/####/uid.data
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
