Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.477.origin
- Android.Triada.481.origin
- Android.Triada.491.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) cdn.dd####.com:8080
- TCP(HTTP/1.1) cdn.dn####.com:8080
- TCP(HTTP/1.1) cdn.dc####.com:8080
- TCP(HTTP/1.1) fff.abcdse####.com:8666
- TCP(HTTP/1.1) cdn.lk####.com:8080
- TCP(TLS/1.0) abc.lk####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) s.m####.com:7777
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) bcd.lk####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) log.lk####.com:443
- TCP(TLS/1.0) 1####.217.168.206:443
- TCP(TLS/1.2) 2####.58.211.106:443
DNS requests:
- abc.lk####.com
- and####.google####.com
- bcd.lk####.com
- cdn.dc####.com
- cdn.dd####.com
- cdn.dn####.com
- cdn.lk####.com
- f####.gst####.com
- fff.abcdse####.com
- instant####.google####.com
- log.lk####.com
- p####.google####.com
- s.m####.com
- safebro####.google####.com
HTTP GET requests:
- cdn.dc####.com:8080/group1/M01/00/05/ChmjBl1o5leAZlGPAAFY1kE560I.plugin
- cdn.dd####.com:8080/group1/M00/00/05/ChmjBl2Eu0eAMMdWAAOiSGCe0Jc.plugin
- cdn.dn####.com:8080/group1/M01/00/04/ChmjBl01et-ACTmDAAHkSxW2dOE.plugin
- cdn.lk####.com:8080/nicro/cc63848124767307d2960e1b2fd4534f
HTTP POST requests:
- fff.abcdse####.com:8666/bd/getIp
File system changes:
Creates the following files:
- /data/data/####/130455b1b9f2d304cc66393c7d3faade.temp
- /data/data/####/1398047660
- /data/data/####/1bad335bbc45f511ee5c21740ec55e1e.temp
- /data/data/####/3271142.dex
- /data/data/####/3271142.dex.flock (deleted)
- /data/data/####/3271142.jar
- /data/data/####/36565a8e7975fdaf18b554ccb5e10d29_2.36
- /data/data/####/397f0f93190168b647cbc6d304c02993_66.39
- /data/data/####/47ece9563c8774e2af3cd38ddf3e8b46.temp (deleted)
- /data/data/####/51d76ac20ff8256575147c67be1bd36a.chche
- /data/data/####/57490a0700d9cea0687a58ad9a5bdf45.chche
- /data/data/####/57521ec0684ea4ee7fe8123dd6f45366.dex
- /data/data/####/57521ec0684ea4ee7fe8123dd6f45366.dex.flock (deleted)
- /data/data/####/57521ec0684ea4ee7fe8123dd6f45366.jar
- /data/data/####/6d24828c
- /data/data/####/70b0fbda286d17c7584e84b29e55383a.chche
- /data/data/####/71eb001c.dex
- /data/data/####/71eb001c.dex.flock (deleted)
- /data/data/####/71eb001c.jar
- /data/data/####/880a373910190bfd327bc241322b1f92.xml
- /data/data/####/909b7d049a4dd78a934d414403acb0f1.temp
- /data/data/####/9fb432c629636ba383ea39e46c7407de.dex
- /data/data/####/9fb432c629636ba383ea39e46c7407de.dex.flock (deleted)
- /data/data/####/9fb432c629636ba383ea39e46c7407de.jar
- /data/data/####/GuuSDK.xml
- /data/data/####/ca445c1317b8e23f94ca27f4c3501dfd.temp
- /data/data/####/ccfe7737.xml
- /data/data/####/cf53b0457a0e48b6c661e8cde49d4069.dex
- /data/data/####/cf53b0457a0e48b6c661e8cde49d4069.dex.flock (deleted)
- /data/data/####/cf53b0457a0e48b6c661e8cde49d4069.jar
- /data/data/####/dataCollect.apk
- /data/data/####/ddf289fdd10daaec4660df47bee03fd2.chche
- /data/data/####/ef630c67bf7119794bb7bb049173cf7e.temp
- /data/data/####/fd3bd3ea02c93211c7056eb0b9faf161_84.fd
- /data/data/####/global.xml
- /data/data/####/global.xml.bak
- /data/data/####/pfg.xml
- /data/data/####/plcfg.xml
- /data/data/####/plcfg.xml.bak
- /data/data/####/selfrun.apk
- /data/data/####/use.xml
- /data/data/####/web.apk
- /data/data/####/webadlist_1.cache
- /data/data/####/webadlist_1.xml
- /data/data/####/webadlist_1_last.cache
- /data/data/####/webinfo.xml
- /data/data/####/work_sp.xml
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/0557c4/cf53b0457a0e48b6c661e8cde49d4069.jar --oat-fd=53 --oat-location=/data/user/0/<Package>/files/0557c4/cf53b0457a0e48b6c661e8cde49d4069.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/498192810/3271142.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/files/498192810/3271142.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/71eb001c.jar --oat-fd=47 --oat-location=/data/user/0/<Package>/files/71eb001c.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/7b7acd/57521ec0684ea4ee7fe8123dd6f45366.jar --oat-fd=60 --oat-location=/data/user/0/<Package>/files/7b7acd/57521ec0684ea4ee7fe8123dd6f45366.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86_64 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86_64 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/9eaf82/9fb432c629636ba383ea39e46c7407de.jar --oat-fd=54 --oat-location=/data/user/0/<Package>/files/9eaf82/9fb432c629636ba383ea39e46c7407de.dex --compiler-filter=speed
- ls -l /system/bin/su
Uses the following algorithms to encrypt data:
- DES-ECB-NoPadding
- DESede
- Des-ECB-NoPadding
Uses the following algorithms to decrypt data:
- DES-ECB-NoPadding
- DESede
- Des-ECB-NoPadding
- RSA-ECB-PKCS1Padding
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
