Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Loki.48.origin
- Android.Mixi.34.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.s####.co:80
- TCP(HTTP/1.1) cp####.mobisma####.com:80
- TCP(HTTP/1.1) s####.l####.com:80
- TCP(HTTP/1.1) j.bay####.com:8888
- TCP(HTTP/1.1) overt####.com:80
- TCP(HTTP/1.1) c####.clou####.tech:80
- TCP(HTTP/1.1) api.migh####.com:80
- TCP(HTTP/1.1) c.cliikyn####.com:80
- TCP(HTTP/1.1) trk.gl####.com:80
- TCP(HTTP/1.1) trac####.acek####.com:80
- TCP(HTTP/1.1) c####.shar####.com:80
- TCP(HTTP/1.1) atracki####.appf####.com:80
- TCP(HTTP/1.1) trac####.suma####.com:80
- TCP(HTTP/1.1) duc####.b####.com:80
- TCP(HTTP/1.1) t.api.y####.net:80
- TCP(HTTP/1.1) trk.vision-####.com:80
- TCP(HTTP/1.1) t####.iches####.net:80
- TCP(HTTP/1.1) bg.hatch####.com:8080
- TCP(HTTP/1.1) s####.adin####.com:80
- TCP(HTTP/1.1) l.a####.com:80
- TCP(HTTP/1.1) real####.icec####.org:80
- TCP(HTTP/1.1) c####.wo####.com:80
- TCP(HTTP/1.1) clk.hope####.net:80
- TCP(HTTP/1.1) c####.gowa####.com:80
- TCP(HTTP/1.1) c####.u.appco####.com:80
- TCP(HTTP/1.1) st####.icec####.org:80
- TCP(SSL/3.0) par####.g####.in:443
- TCP(TLS/1.0) clk.tap####.com:443
- TCP(TLS/1.0) par####.g####.in:443
DNS requests:
- api.migh####.com
- atracki####.appf####.com
- bg.hatch####.com
- c####.clou####.tech
- c####.gowa####.com
- c####.shar####.com
- c####.u.appco####.com
- c####.wo####.com
- c.cliikyn####.com
- c.s####.co
- cl####.ads####.com
- clk.hope####.net
- clk.tap####.com
- cp####.mobisma####.com
- duc####.b####.com
- j.bay####.com
- l.a####.com
- offers####.adflush####.com
- overt####.com
- par####.g####.in
- real####.icec####.org
- s####.adin####.com
- s####.l####.com
- sdk.appsf####.tk
- st####.icec####.org
- t####.iches####.net
- t.api.y####.net
- trac####.acek####.com
- trac####.suma####.com
- trk.gl####.com
- trk.vision-####.com
HTTP GET requests:
- api.migh####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=###...
- atracki####.appf####.com/transaction/post_click?offer_id=####&aff_id=###...
- bg.hatch####.com:8080/ads/getJarVersion/zhuoyian/23/cn
- c####.clou####.tech/index.php?m=####&p=####&app_id=####&offer_id=####&cl...
- c####.gowa####.com/click?transaction_id=wadogo_WAdv5208API_401606_102e2c...
- c####.gowa####.com/click?transaction_id=wadogo_WAdv5417API_358146_1029e0...
- c####.gowa####.com/click?transaction_id=wadogo_WAdv5727API_383757_1021f5...
- c####.shar####.com/click/index?tp_id=####&tp_placementid=####&tp_aaid=##...
- c####.u.appco####.com/v1/click?oid=####&affid=####&tid=####&sub_affid=##...
- c####.wo####.com/index.php?m=####&p=####&app_id=####&offer_id=####&click...
- c.cliikyn####.com/click?o=####&c=####&s1=####&s2=####&gaid=####
- c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
- clk.hope####.net/click?id=####&aff=####&ost=####&click=####&aff_sub=####...
- cp####.mobisma####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
- duc####.b####.com/click/affClick?aff_sub=####&aff_sub19=####&aff_sub2=##...
- j.bay####.com:8888/imm?p=####
- overt####.com/d/46801059bf4cd8312d4?sub=####&source=####
- real####.icec####.org/module?platform=####&os_version=####&package_name=...
- s####.adin####.com/click/ssp/click?channel=####&uuid=####&id=####&aoid=#...
- s####.l####.com/redirect?s=####&at=####&rt=####&s1=####&s2=####&s3=####&...
- t####.iches####.net/click?id=####&aff=####&ost=####&click_id=####&gaid=#...
- t.api.y####.net/v1/click/f?ad=####&app_id=####&pid=####&api_type=####&s=...
- trac####.acek####.com/click/44922033?app_key=69b42e34e06060b9a061e4e3c94...
- trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_click_id=####&...
- trac####.suma####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_s...
- trac####.suma####.com/aff_r?offer_id=387914&aff_id=6076&url=http://click...
- trac####.suma####.com/aff_r?offer_id=426828&aff_id=5728&url=http://click...
- trac####.suma####.com/aff_r?offer_id=443903&aff_id=6076&url=http://click...
- trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAIOCw8-TaIZ0/CF?subid1=####&m.andro...
- trk.vision-####.com/api/public/click?pub_id=####&ad_id=####&campaign_id=...
HTTP POST requests:
- l.a####.com/l.php
- s####.adin####.com/track/ds?sdk_version=####&platform=####&app_version=#...
- s####.adin####.com/track/uc?sdk_version=####&platform=####&app_version=#...
- st####.icec####.org/setting
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/.do.jar
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/ak.salvia.sdk.xml
- /data/data/####/arrkii.asa.sdk.db-journal
- /data/data/####/as.jar
- /data/data/####/classes.dex
- /data/data/####/classes10.dex
- /data/data/####/com.zhuoyian.beauty.poker;co.growing.db
- /data/data/####/com.zhuoyian.beauty.poker;co.growing.db-journal
- /data/data/####/dayupdate.xml
- /data/data/####/growing_persist_data.xml
- /data/data/####/growing_profile.xml
- /data/data/####/husky.tmp
- /data/data/####/husky_10804.jar
- /data/data/####/lib.zip
- /data/data/####/libcocos2dcpp.so
- /data/data/####/libcom.njbm.gyedu.nuwv.so
- /data/data/####/libgetuiext2.so
- /data/data/####/libyelpx.so
- /data/data/####/ljtq.xml
- /data/data/####/mc_cache.db-journal
- /data/data/####/sdk_scl_pid_config.xml
- /data/data/####/settingsLog.xml
- /data/data/####/v71.xml
- /data/data/####/webview.db-journal
- /data/data/####/x
- /data/media/####/.libx2coas
- /data/media/####/com.zhuoyian.beauty.poker
Miscellaneous:
Executes next shell scripts:
- cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Loads the following dynamic libraries:
- com_zhuoyian_beauty_poker
- yelpx
Uses the following algorithms to encrypt data:
- AES
- AES-CBC-NoPadding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-NoPadding
- AES-ECB-PKCS5Padding
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
