Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.178.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.8####.com:80
- TCP(HTTP/1.1) v3.jia####.com:80
- TCP(HTTP/1.1) img.line####.com:80
- TCP(TLS/1.0) api.s####.1####.com:443
- TCP(TLS/1.0) 1####.217.168.206:443
DNS requests:
- api.unm####.u17888####.com
- img.line####.com
- p####.h5.mob####.cn
- v3.jia####.com
- www.8####.com
HTTP GET requests:
- img.line####.com/
- img.line####.com/js/common/touchslider.js
- img.line####.com/mobile/img/b6.png
- img.line####.com/mobile/index
- img.line####.com/mobile/js/app.js
- img.line####.com/www8864/2016/09/23/n151000027997258.jpg
- img.line####.com/www8864/2016/09/23/n151000027999456.jpg
- img.line####.com/www8864/2016/09/23/n151000028005888.jpg
- img.line####.com/www8864/2016/09/23/n151000028011793.jpg
- img.line####.com/www8864/2016/09/23/n161000028017889.jpg
- img.line####.com/www8864/2016/09/23/n161000028019197.jpg
- img.line####.com/www8864/2016/09/23/n161000028021593.jpg
- img.line####.com/www8864/2016/09/23/n171000028031306.jpg
- img.line####.com/www8864/2016/11/10/n111000028029428.jpg
- img.line####.com/www8864/2016/11/10/n111000028031498.jpg
- img.line####.com/www8864/2016/12/08/n151000027991836.png
- img.line####.com/www8864/2016/12/08/n151000028027971.jpg
- img.line####.com/www8864/2016/12/08/n151000028035111.png
- img.line####.com/www8864/2016/12/08/n151000028037513.png
- img.line####.com/www8864/2016/12/22/n111000028025109.jpg
- img.line####.com/www8864/2016/12/26/n101000028117720.jpg
- img.line####.com/www8864/2017/07/13/n171000028039143.png
- v3.jia####.com/code/jia.js
- www.8####.com/
- www.8####.com/ad/jiangli
- www.8####.com/css/newhome/home.css
- www.8####.com/css/newhome/new-style.css
- www.8####.com/css/newhome/reset.css
- www.8####.com/favicon.ico
- www.8####.com/js/newhome/home.js
- www.8####.com/js/newhome/index.js
- www.8####.com/js/newhome/jquery.min.js
- www.8####.com/js/newhome/layer.js
- www.8####.com/js/newhome/theme/default/layer.css?v=####
- www.8####.com/mobile/css/idangerous.swiper.css
- www.8####.com/mobile/css/layout.css
- www.8####.com/mobile/css/reset.css
- www.8####.com/mobile/img/b1.png
- www.8####.com/mobile/img/b2.png
- www.8####.com/mobile/img/b3.png
- www.8####.com/mobile/img/b8_02.png
- www.8####.com/mobile/img/b8_04.png
- www.8####.com/mobile/img/b8_05.png
- www.8####.com/mobile/img/b8_06.png
- www.8####.com/mobile/img/b8_07.png
- www.8####.com/mobile/img/b8_08.png
- www.8####.com/mobile/img/b8_09.png
- www.8####.com/mobile/img/b8_10.png
- www.8####.com/mobile/img/close.png
- www.8####.com/mobile/img/logo.png
- www.8####.com/mobile/index
- www.8####.com/mobile/js/jquery.min.js
- www.8####.com/mobile/js/swiper.min.js
- www.8####.com/web_footer_www_0.html
- www.8####.com/web_header.html
File system changes:
Creates the following files:
- /data/data/####/180918000156163629f2f39860bd01dabc78cf5913e6951...sp.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/external.apk
- /data/data/####/external.so
- /data/data/####/external_dex.apk
- /data/data/####/external_dex.so
- /data/data/####/index
- /data/data/####/mid.dex
- /data/data/####/moduleinfos
- /data/data/####/u3kmid.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/sub_imei.txt
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
