Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) www.pix####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) 2.qim####.net:80
- TCP(HTTP/1.1) 1.qim####.net:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) ec####.b####.com:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) 1####.217.17.110:443
- TCP(TLS/1.0) adser####.go####.com:443
DNS requests:
- 1.qim####.net
- 2.qim####.net
- adser####.go####.com
- adser####.go####.nl
- c####.baidust####.com
- c####.mm####.com
- c.c####.com
- ch.bo####.com
- ch1bo####.com
- ch2.bo####.com
- ec####.b####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- hm.b####.com
- i####.c####.com
- mt####.go####.com
- pag####.googles####.com
- pco####.c####.com
- pos.b####.com
- s11.c####.com
- tpc.googles####.com
- www.go####.com
- www.googlet####.com
- www.pix####.com
- z13.c####.com
HTTP GET requests:
- 1.qim####.net/keimow.js
- 1.qim####.net/mhznjjwdpkon.js
- 2.qim####.net/auto_ds?in=####&qyz=####&uxn=####&iwn=####&hjh=####&jcux=#...
- 2.qim####.net/auto_ds?in=####&qyz=####&uxn=####&ux=####&iyr=####&fsy=###...
- 2.qim####.net/auto_ds?in=####&qyz=####&uxn=####&yuw=####&inx=####&uhx=##...
- c####.baidust####.com/cpro/ui/cm.js
- c####.baidust####.com/cpro/ui/pr.js
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/img/pic1.gif
- c.c####.com/stat.php?id=####&show=####
- ec####.b####.com/rs.jpg?type=####&rdm=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/h.js?1faf1e7####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20190522/r20190131/show_ads_impl.js
- pco####.ta####.com/app.gif?&cna=####
- pos.b####.com/s?hei=####&wid=####&di=####<u=####&psi=####&cfv=####&ccd...
- www.pix####.com/3gindex.html
- www.pix####.com/html/suanmingdaquan/mianxiang/2018/0511/2763.html
- www.pix####.com/images/an.png
- www.pix####.com/images/applic.png
- www.pix####.com/images/mobhome.png
- www.pix####.com/images/mobtop.jpg
- www.pix####.com/images/wnlbg.jpg
- www.pix####.com/include/dedeajax2.js
- www.pix####.com/index.html
- www.pix####.com/mobapp/wuxingcx.asp
- www.pix####.com/mobsite/images/1.png
- www.pix####.com/mobsite/images/10.gif
- www.pix####.com/mobsite/images/11.gif
- www.pix####.com/mobsite/images/12.gif
- www.pix####.com/mobsite/images/13.gif
- www.pix####.com/mobsite/images/14.gif
- www.pix####.com/mobsite/images/15.png
- www.pix####.com/mobsite/images/16.png
- www.pix####.com/mobsite/images/17.png
- www.pix####.com/mobsite/images/2.png
- www.pix####.com/mobsite/images/3.png
- www.pix####.com/mobsite/images/4.gif
- www.pix####.com/mobsite/images/5.png
- www.pix####.com/mobsite/images/6.png
- www.pix####.com/mobsite/images/7.png
- www.pix####.com/mobsite/images/8.png
- www.pix####.com/mobsite/images/9.png
- www.pix####.com/plus/count.php?view=####&aid=####&mid=####
- www.pix####.com/templets/mobdefault/images/boxoff.gif
- www.pix####.com/templets/mobdefault/images/green_skin.png
- www.pix####.com/templets/mobdefault/images/ico-2.gif
- www.pix####.com/templets/mobdefault/images/ico-3.gif
- www.pix####.com/templets/mobdefault/style/dedecms.css
- www.pix####.com/templets/mobdefault/style/layout.css
- www.pix####.com/templets/mobdefault/style/page.css
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
File system changes:
Creates the following files:
- /data/data/####/app_rartoclasses.jar
- /data/data/####/czh
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbiawjl-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- lqp
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
