Technical information
Malicious functions:
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) tj.ff####.com:80
- TCP(HTTP/1.1) www.youhu####.com:80
- TCP(HTTP/1.1) wild####.al####.com.####.net:80
- TCP(HTTP/1.1) cmsst####.dat####.com:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) g####.al####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(TLS/1.0) s####.we####.com:443
- TCP(TLS/1.0) tj.ff####.com:443
- TCP(TLS/1.0) sharec####.qq.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
DNS requests:
- cmsst####.dat####.com
- g####.al####.com
- g####.al####.com
- g####.al####.com
- img.al####.com
- pi####.qq.com
- ping####.qq.com
- s####.dat####.com
- s####.we####.com
- sharec####.qq.com
- tj.ff####.com
- tj.qua####.com
- www.youhu####.com
HTTP GET requests:
- cmsst####.dat####.com//wap_new/common/common.css?v=####
- cmsst####.dat####.com//wap_new/common/common.js?v=####
- cmsst####.dat####.com//wap_new/common/iconfont/iconfont.ttf?t=####
- cmsst####.dat####.com//wap_new/common/models/models-jsencrypt.js?v=####
- cmsst####.dat####.com//wap_new/lib/JSBridge.js?v=####
- cmsst####.dat####.com//wap_new/lib/jquery.js?v=####
- cmsst####.dat####.com//wap_new/lib/lazyload.js?v=####
- cmsst####.dat####.com//wap_new/lib/md5.js?v=####
- cmsst####.dat####.com//wap_new/lib/wui/js/modules/layer.js?v=####
- cmsst####.dat####.com//wap_new/lib/wui/js/modules/swiper.js?v=####
- cmsst####.dat####.com//wap_new/lib/wui/plugin/layer/layer.js?v=####
- cmsst####.dat####.com//wap_new/lib/wui/plugin/layer/skin/default/layer.c...
- cmsst####.dat####.com//wap_new/lib/wui/plugin/swiper/js/swiper.js?v=####
- cmsst####.dat####.com//wap_new/lib/wui/plugin/swiper/swiper.css?v=####
- cmsst####.dat####.com//wap_new/lib/wui/wui.js?v=####
- cmsst####.dat####.com//wap_new/main/main.css?v=####
- cmsst####.dat####.com//web/images/rolling.gif
- cmsst####.dat####.com//web/js/cms_ggw_wap.js?v=####
- cmsst####.dat####.com/wap_new/common/models/models-goods-classify.js?v=#...
- cmsst####.dat####.com/wap_new/common/models/models-up-app.js?v=####
- cmsst####.dat####.com/wap_new/home/js/models-home.js?v=####
- g####.al####.com/tps/i2/1979806058243885885/TB22Lu8vZtnpuFjSZFvXXbcTpXa_...
- g####.al####.com/tps/i2/O1CN01BYnciR1jsDZCjUSIf_!!0-juitemmedia.jpg_480x...
- g####.al####.com/tps/i3/6000000002277/O1CN01X1Pice1SguKdAGlmd_!!60000000...
- g####.al####.com/tps/i4/O1CN012AQjPjNy3ZMyqva_!!0-juitemmedia.jpg_480x48...
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=r=i####&ty=#...
- ping####.qq.com/pingd?dm=www.youhui445.com&pvi=82641550714680509&si=s730...
- s####.tc.qq.com/h5/stats.js?v2####
- tj.ff####.com/_utm.gif?z=1550714680327&tid=xc-dtk-cms-664795&at=pageview...
- tj.ff####.com/_utm.gif?z=1550714680775&tid=xc-dtk-cms-664795&at=pageview...
- wild####.al####.com.####.net/imgextra/i4/1695057015/O1CN018lhgXa21gutfUD...
- www.youhu####.com/index.php?r=####
- www.youhu####.com/index.php?r=####&callback=####&_=####
- www.youhu####.com/index.php?r=####&page=####
- www.youhu####.com/touch-icon-iphone.png
HTTP POST requests:
- www.youhu####.com/index.php?r=####
- www.youhu####.com/index.php?r=####&type=####
Miscellaneous:
Loads the following dynamic libraries:
- luajava
- ygsiyu
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Displays its own windows over windows of other apps.
