Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.600.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 4####.97.95.199:88
- TCP(HTTP/1.1) 7####.pal####.net.####.com:80
DNS requests:
- 7####.pal####.net
- int.d####.s####.####.cn
HTTP GET requests:
- 7####.pal####.net.####.com/ng/201709/415/c/icon.jpg
- 7####.pal####.net.####.com/ng/201709/415/c/pic0.png
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/1d6f563cff5a3b6719b670a3f20231b5.jar
- /data/data/####/SP_REPLACE_CLASSLOADER_CLASS_NAME.xml
- /data/data/####/twsdk.db-journal
- /data/data/####/userData.xml
- /data/data/####/webview.db-journal
- /data/media/####/5cb7f3e7cfc95f18563c214b80087e6a.cach
Miscellaneous:
Loads the following dynamic libraries:
- cocos2dcpp
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
