Android.Click.1361

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.345.origin

Threat detection based on machine learning.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 47.1####.185.46:80
TCP(HTTP/1.1) 1####.131.113.41:443
TCP(HTTP/1.1) 47.1####.211.73:80
TCP(HTTP/1.1) res####.a####.top:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) t####.a####.top:80
TCP(HTTP/1.1) c####.zhit####.com:99
TCP(HTTP/1.1) 58.2####.92.50:808
TCP(HTTP/1.1) newap####.math####.cn:80
TCP(HTTP/1.1) www.f####.com:80
TCP(HTTP/1.1) 1####.zhit####.com:99
TCP(HTTP/1.1) p####.api.adoc####.com:80
TCP(HTTP/1.1) 35.1####.78.8:443
TCP(HTTP/1.1) 1####.zhit####.com:808
TCP(HTTP/1.1) 47.1####.22.30:443
TCP(HTTP/1.1) api.a####.ads####.cn:80
TCP(HTTP/1.1) 35.2####.244.186:443
TCP(HTTP/1.1) c####.jumen####.com:80
TCP(HTTP/1.1) 3####.13.86.8:443
TCP(HTTP/1.1) tpy.dspliul####.com:99
TCP(HTTP/1.1) 59.1####.185.120:443
TCP(HTTP/1.1) 1####.89.25.202:443
TCP(HTTP/1.1) www-new####.b0.a####.com:80
TCP(HTTP/1.1) app.a####.top:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) 35.2####.52.229:443
TCP(HTTP/1.1) filt####.a####.top:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) co####.ssp.adoc####.com:80
TCP(HTTP/1.1) 1####.55.95.108:443
TCP(HTTP/1.1) 8.1####.111.163:443
TCP(HTTP/1.1) 47.99.1####.231:443
TCP(HTTP/1.1) 1####.55.31.116:443
TCP(HTTP/1.1) 47.1####.23.182:443
TCP(TLS/1.0) 47.1####.23.182:443
TCP(TLS/1.0) 1####.139.250.238:443
TCP(TLS/1.0) 1####.131.113.41:443
TCP(TLS/1.0) 3####.13.86.8:443
TCP(TLS/1.0) s####.qq.com:443
TCP(TLS/1.0) 59.1####.185.120:443
TCP(TLS/1.0) 35.2####.52.229:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) 1####.55.31.116:443
TCP(TLS/1.0) m####.g####.com.####.com:443
TCP(TLS/1.0) u####.v.bs####.cn:443
TCP(TLS/1.0) 3.1####.140.118:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) p####.pc####.com.cn:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) 1####.89.25.202:443
TCP(TLS/1.0) s####.x####.com.cn:443
TCP(TLS/1.0) pa####.m####.qq.com:443
TCP(TLS/1.0) js.3con####.com.####.cn:443
TCP(TLS/1.0) 35.1####.78.8:443
TCP(TLS/1.0) 8.1####.111.163:443
TCP(TLS/1.0) 1####.55.95.108:443
TCP(TLS/1.0) 47.1####.22.30:443
TCP(TLS/1.0) 35.2####.244.186:443
TCP(TLS/1.0) 47.99.1####.231:443
TCP(TLS/1.2) 2####.85.233.94:443
TCP(TLS/1.2) 3.1####.140.118:443
UDP 1####.177.14.95:443

DNS requests:

1####.zhit####.com
10####.admast####.com
603.a####.top
603.a####.top.####.8
a####.a####.com
api.a####.ads####.cn
api.bamenzh####.com
api.fou####.com
api.g####.vip
api.m####.com
api.yunco####.com
app.a####.top
c####.jumen####.com
c####.mm####.com
c####.x####.com.cn
c####.zhit####.com
c.c####.com
cdp.c####.uni####.com
co####.ssp.adoc####.com
co####.uca.c####.####.com
dup.baidust####.com
filt####.a####.top
g####.face####.com
gcc.haowa####.com
hm.b####.com
hyperb####.com
i.iqt####.com
i.iqt####.com.####.8
ivy.pcon####.com.cn
js.3con####.com
js.3con####.com.####.8
lhyysdk####.oss-cn-####.aliy####.com
m####.g####.com
mg####.pcon####.com.####.8
mg####.pcon####.com.cn
ne####.x####.com.cn
newap####.math####.cn
p####.api.adoc####.com
p####.pc####.com.cn
pa####.m####.qq.com
perf-ev####.c####.uni####.com
pv.s####.com
res####.a####.top
s####.qq.com
s####.x####.com.cn
s.fou####.com
s4.c####.com
s5.c####.com
s96.c####.com
t####.a####.top
tpy.dspliul####.com
u####.a####.top
v1.c####.com
w####.pc####.com.####.8
w####.pc####.com.cn
w####.pcon####.com.cn
www.f####.com
www.new####.com
www.pc####.com.cn
www.pcon####.com.cn
z2.c####.com
z3.c####.com
z6.c####.com
z9.c####.com

HTTP GET requests:

1####.131.113.41:443/api/game/
1####.55.95.108:443/hwyad/yqxwap/collect.html?hwyaderid=hwy0205&hwyappid...
1####.89.25.202:443/cn/app/id1483884858?hwyaderid=hwy0205&hwyappid=50099...
1####.zhit####.com:808/1020p/index.html
1####.zhit####.com:808/1020p/yrc_001pc.js
1####.zhit####.com:99/1020yy/index.html
1####.zhit####.com:99/wap/index.html
3####.13.86.8:443/v3.2/2224360644446033/button_auto_detection_device_sel...
3####.13.86.8:443/v3.2/2224360644446033?fields=####&format=####&advertis...
47.1####.22.30:443/api/platform/v1/cloud-injection/info?terminal=####&pa...
47.1####.23.182:443/8oaRa5
59.1####.185.120:443/controlup603.json
59.1####.185.120:443/new_channl_603.json
api.a####.ads####.cn/thirdparty/sapi/callback?cid=####&adspaceid=####&mc...
app.a####.top/anshuaControl.json
app.a####.top/api.json
app.a####.top/pingpaiAD.json
c####.jumen####.com/flow_control.php
c####.jumen####.com/init.php
c####.zhit####.com:99/newcar/index.html
c####.zhit####.com:99/pctja.html
c####.zhit####.com:99/wts/index.html?1####
co####.ssp.adoc####.com/api/v2/SDKActiveConfig?version=####&channelCode=...
co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
filt####.a####.top/filter_control_603.json
gd.a.s####.com/cityjson?ie=####
newap####.math####.cn/ssp/mgm/task?taskId=####&ip=####
p####.api.adoc####.com/ip
res####.a####.top/LHYY.png
res####.a####.top/sdk13_2.png
res####.a####.top/sdk16.png
res####.a####.top/sdk18.png
res####.a####.top/sdk2.png
res####.a####.top/sdk24.png
t####.a####.top/anshua.json
t####.a####.top/req.json
tpy.dspliul####.com:99/tpy/index.html
www-new####.b0.a####.com/index1.html
www.f####.com/search/5047442d383032_1.html

HTTP POST requests:

1####.55.31.116:443/service/rest
35.1####.78.8:443/api/v2/projects/a4b88df1-a960-4864-920e-ddc8b5c3edff/r...
35.2####.244.186:443/
35.2####.52.229:443/v1/events
47.99.1####.231:443/service/rest
8.1####.111.163:443/service/rest
api.a####.ads####.cn/thirdparty/sapi/chn
api.yunco####.com/service/rest
newap####.math####.cn/titan/monitor/device_info
w####.pcon####.com.cn/ip.jsp

File system changes:

Creates the following files:

/data/data/####/.hptc.cache_yperbeard.bunny
/data/data/####/000003.log
/data/data/####/005bb92749461c36_0
/data/data/####/08f3c12a6ee4a938_0
/data/data/####/0a2fff8ea4346995_0 (deleted)
/data/data/####/10a1d1deb4cdf7f0_0
/data/data/####/10a1d1deb4cdf7f0_1
/data/data/####/13_2.dex
/data/data/####/13_2.dex.flock (deleted)
/data/data/####/13_2.jar
/data/data/####/13c0aab9eb01bb97_0 (deleted)
/data/data/####/1463224b7ca13478fb230a1e7d3e9faa.db
/data/data/####/1548865591327.jar.cur.prof
/data/data/####/1548865591327.odex
/data/data/####/1548865591327.vdex
/data/data/####/16.dex
/data/data/####/16.dex.flock (deleted)
/data/data/####/16.jar
/data/data/####/1714af51f380b9f7_0
/data/data/####/18.dex (deleted)
/data/data/####/18.dex.flock (deleted)
/data/data/####/18.jar
/data/data/####/1a028246a6f22a0d_0
/data/data/####/1a711aa9e736f760_0
/data/data/####/1a711aa9e736f760_1
/data/data/####/1fd09bfd397dcc21_0
/data/data/####/1fd09bfd397dcc21_1
/data/data/####/2.dex
/data/data/####/2.dex.flock (deleted)
/data/data/####/2.jar
/data/data/####/227aa6877f7915bc_0
/data/data/####/227aa6877f7915bc_1
/data/data/####/24.dex (deleted)
/data/data/####/24.dex.flock (deleted)
/data/data/####/24.jar
/data/data/####/246e392da9ff9736_0
/data/data/####/25a5e5df91ed7854_0
/data/data/####/2704aaeef4eeb65c_0
/data/data/####/27dac8705e581c47_0 (deleted)
/data/data/####/2fc33fe21cdd6ca5_0
/data/data/####/310637c37632c077_0
/data/data/####/310637c37632c077_1
/data/data/####/322c33edbc5b2e39_0 (deleted)
/data/data/####/32363b24414e7d62_0 (deleted)
/data/data/####/3236707ab33bbec7_0
/data/data/####/346521c14afc18a1_0 (deleted)
/data/data/####/368329eed6ed9768_0
/data/data/####/38a3f4dfa9cd6126_0
/data/data/####/38a3f4dfa9cd6126_1
/data/data/####/39178a046d923004_0 (deleted)
/data/data/####/3a2ab9ca05390b05_0
/data/data/####/3a2ab9ca05390b05_1
/data/data/####/3e2a9c70aec46994_0 (deleted)
/data/data/####/3ecc060b4f8f2e1d_0
/data/data/####/40e126d0be410ae4_0
/data/data/####/40e126d0be410ae4_1
/data/data/####/424961eba0ff4faf_0
/data/data/####/428a0be6d746398f_0
/data/data/####/428a0be6d746398f_1
/data/data/####/42ceae9a84886dda_0 (deleted)
/data/data/####/43c135500a0372f5_0 (deleted)
/data/data/####/441681f9d08bfcf0_0
/data/data/####/441681f9d08bfcf0_1
/data/data/####/4aa200d86c7e98d2_0
/data/data/####/4ddda3925d1c8ac0_0
/data/data/####/500a1541447b6b6456a0cc20194821af.db
/data/data/####/5127fc73890942ea_0 (deleted)
/data/data/####/5321d4c80d263be2_0 (deleted)
/data/data/####/5393d6bed47b9324_0
/data/data/####/584d3c99d6998f6d_0
/data/data/####/58837f87a0bc315b_0
/data/data/####/58837f87a0bc315b_1
/data/data/####/5896f9015cdeebcf_0
/data/data/####/58e08a862e9f9536f0f33b3bd115a42a.db
/data/data/####/59d5a47e598e177f528cf129f0d8998d.db
/data/data/####/5c311bbf22786822_0
/data/data/####/5c3a0a6470084aa4_0
/data/data/####/5e2924653cf56419_0 (deleted)
/data/data/####/64dc64ac182c8488_0
/data/data/####/6b1b7859e20c2ee1_0
/data/data/####/6c21fb7e93d42b1a_0
/data/data/####/6df6c637b6dade71_0 (deleted)
/data/data/####/703827f10f565f0a_0
/data/data/####/70f02b133ce32bfe_0
/data/data/####/724103452ee0114d_0
/data/data/####/74a2e7bbcf90778c_0
/data/data/####/77e7aca254798d57_0
/data/data/####/77e7aca254798d57_1
/data/data/####/7923049691207b77_0
/data/data/####/7923049691207b77_1
/data/data/####/7a4d0b9498d0833f_0 (deleted)
/data/data/####/7c99b6955eb2950a_0
/data/data/####/7e4d2a4937a371e9_0
/data/data/####/7f6af636b9e2c447_0 (deleted)
/data/data/####/82139da135b77e32_0
/data/data/####/84d345dd9cd802a6_0
/data/data/####/891991fc0e982b10_0
/data/data/####/891991fc0e982b10_1
/data/data/####/89a12f37986a2cca_0
/data/data/####/8a715f802941746e43b3e0f32694c5ae.db
/data/data/####/8be546bf03ddce82_0
/data/data/####/8ca76475489320c4_0
/data/data/####/8f6350df055a5536_0
/data/data/####/93edac7ad8a731a5_0
/data/data/####/93edac7ad8a731a5_1
/data/data/####/985958d976619751_0
/data/data/####/9a51ae6b891c1205_0 (deleted)
/data/data/####/9c4af4ca4d50754b_0
/data/data/####/9ca49eef20c5c009_0 (deleted)
/data/data/####/9d5c2f9a9cc871f1_0
/data/data/####/9ef98f07e8de0ef4_0
/data/data/####/9ef98f07e8de0ef4_1
/data/data/####/BmCloudPlugin.apk
/data/data/####/BmCloudPlugin.dex
/data/data/####/BmCloudPlugin.dex.flock (deleted)
/data/data/####/CURRENT
/data/data/####/Cookies
/data/data/####/Cookies-journal
/data/data/####/CunDang.xml
/data/data/####/LOCK
/data/data/####/LOG
/data/data/####/LOG.old
/data/data/####/MANIFEST-000001
/data/data/####/Mediation_Shared_Preferences.xml
/data/data/####/UnityAdsStorage-private-data.json
/data/data/####/UnityAdsStorage-public-data.json
/data/data/####/Web Data
/data/data/####/Web Data-journal
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/XkdjsIx132mMcomm.xml
/data/data/####/XkdjsIx132mMskey1.xml
/data/data/####/XkdjsIx132mMtasks.xml
/data/data/####/XkdjsIx132mMtasks.xml.bak
/data/data/####/a3040ee97e2a049c_0 (deleted)
/data/data/####/a4e24c45beb2f915_0 (deleted)
/data/data/####/aa42fae6e714f296_0
/data/data/####/aabd5a60157972d1_0 (deleted)
/data/data/####/admob.xml
/data/data/####/ahq_spu_ti.xml
/data/data/####/b3f1c2ce6f1f84dc_0
/data/data/####/b5a490ef70c2ecf8_0 (deleted)
/data/data/####/be34ff59610e630b_0
/data/data/####/bm_sp_file.xml
/data/data/####/c58499f2c088385e_0 (deleted)
/data/data/####/c5c59e456023874c_0
/data/data/####/c6e46e9f83bd96f1_0
/data/data/####/cb4fe77d7f247e2c_0 (deleted)
/data/data/####/cf3f599869d1190d_0
/data/data/####/cf8329b67b72ea31_0
/data/data/####/cf8329b67b72ea31_1
/data/data/####/com.applovin.sdk.1.xml
/data/data/####/com.applovin.sdk.preferences.7stRITDp21hNW_V6cH...wT.xml
/data/data/####/com.facebook.internal.SKU_DETAILS.xml
/data/data/####/com.hyperbeard.bunny.v2.playerprefs.xml
/data/data/####/com.hyperbeard.bunny_preferences.xml
/data/data/####/countIp.xml
/data/data/####/d07444cce2869831_0 (deleted)
/data/data/####/d4158f5934faeaca_0
/data/data/####/d4219fff9a178666_0 (deleted)
/data/data/####/d468a3da61a4707f_0
/data/data/####/d5a5db71556467c7_0
/data/data/####/d6abf5061d55d220_0
/data/data/####/ddfd15f8c069bf74_0
/data/data/####/dfe6b2497a7513ba_0
/data/data/####/e06cc44686ac5311_0
/data/data/####/e652b74f8b83c480_0
/data/data/####/e763d8b3a3bf6286_0 (deleted)
/data/data/####/e7aeec34673c3ecb_0 (deleted)
/data/data/####/ea4b105559ea6579_0
/data/data/####/ea4b105559ea6579_1
/data/data/####/eca4f009b5b912d3_0 (deleted)
/data/data/####/ee497c9f4f3d9af8_0
/data/data/####/ee497c9f4f3d9af8_1
/data/data/####/ef3c178b16b5d90c_0
/data/data/####/ef3c178b16b5d90c_1
/data/data/####/efe0232fcaa5e56d_0
/data/data/####/efe0232fcaa5e56d_1
/data/data/####/f038e94cb33282ab_0
/data/data/####/f60e87e7777d1e81_0
/data/data/####/f60e87e7777d1e81_1
/data/data/####/http_1020p.zhitouip.com_808.localstorage-journal
/data/data/####/http_1020yy.admasterto.com_99.localstorage-journal
/data/data/####/index
/data/data/####/jokeFile.xml
/data/data/####/metrics_guid
/data/data/####/np-saved-notification-keys-data.xml
/data/data/####/pref_store
/data/data/####/proc_auxv
/data/data/####/settings.dat
/data/data/####/spu_gz.xml
/data/data/####/supersonic_sdk.db
/data/data/####/supersonic_shared_preferen.xml
/data/data/####/tempAssets.apk
/data/data/####/the-real-index
/data/data/####/umengDB.db
/data/data/####/umengDB.dex
/data/data/####/umengDB.dex.flock (deleted)
/data/data/####/umengDB.jar
/data/data/####/unbiasedTime.xml
/data/data/####/variations_seed
/data/data/####/variations_stamp
/data/data/####/webview_data.lock
/data/media/####/.jokeID
/data/media/####/.nomedia
/data/media/####/9b95fbd5506caffcfbcdc4ececa3604e
/data/media/####/Compat.browser
/data/media/####/DefaultWsdlHelpGenerator.aspx
/data/media/####/SymbolMap-ARM64
/data/media/####/SymbolMap-ARMv7
/data/media/####/browscap.ini
/data/media/####/c
/data/media/####/config
/data/media/####/config.xml
/data/media/####/d
/data/media/####/d_tmp (deleted)
/data/media/####/e
/data/media/####/g
/data/media/####/global-metadata.dat
/data/media/####/last-btime
/data/media/####/machine.config
/data/media/####/mscorlib.dll-resources.dat
/data/media/####/s
/data/media/####/settings.map
/data/media/####/values
/data/media/####/web.config
/data/misc/####/primary.prof

Miscellaneous:

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней