Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Locker.1274.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) chec####.cc:80
- TCP(HTTP/1.1) cloud-i####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) st####.tin####.com:80
- TCP(TLS/1.0) nt####.oss-ap-####.aliy####.com:443
- TCP(TLS/1.0) c####.tc.qq.com:443
- TCP(TLS/1.0) chec####.cc:443
- TCP(TLS/1.0) ot####.be####.qq.com:443
- TCP(TLS/1.0) 360####.org:443
- TCP(TLS/1.0) imgg####.tc.qq.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) log-re####.com:443
- TCP(TLS/1.0) vf####.g####.cn.####.com:443
- TCP(TLS/1.0) cloudin####.s3.ap-nort####.####.com:443
- TCP(TLS/1.0) i.g####.tc.####.com:443
- TCP(TLS/1.0) a####.qq.com:443
- TCP(TLS/1.0) static####.qq.com.####.com:443
- TCP(TLS/1.0) v.qq.com.####.net:443
- TCP(TLS/1.0) vm.g####.cn.####.cn:443
- TCP(TLS/1.0) p####.q####.c####.####.net:443
- TCP(TLS/1.0) pe####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) 1####.250.150.100:443
- TCP(TLS/1.0) cloud-i####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) xl####.oss-ap-####.aliy####.com:443
- TCP(TLS/1.0) rr6---s####.g####.com:443
- TCP(TLS/1.0) 1####.251.1.94:443
- TCP(TLS/1.2) 1####.251.1.94:443
- TCP(TLS/1.2) 1####.250.150.100:443
DNS requests:
- 360####.org
- a####.qq.com
- cd####.cn
- chec####.cc
- cloud-i####.oss-cn-####.aliy####.com
- cloudin####.s3.ap-nort####.####.com
- gf####.com
- gf202####.com
- i.g####.cn
- imgc####.g####.cn
- log-re####.com
- m####.g####.cn
- m####.go####.com
- m.v.q####.com
- nt####.oss-ap-####.aliy####.com
- ot####.be####.qq.com
- p####.google####.com
- p####.q####.cn
- pe####.oss-cn-####.aliy####.com
- pi####.qq.com
- pub.idq####.com
- rr6---s####.g####.com
- st####.tin####.com
- static####.qq.com
- v.q####.com
- vf####.g####.cn
- vm.g####.cn
- xl####.oss-ap-####.aliy####.com
HTTP GET requests:
- 360####.org:443/feature/config?api_version=####&app_id=####&app_version=...
- chec####.cc/test
- chec####.cc:443/jd?a=####&av=####&cv=####&d=####&p=####&v=####&vc=####
- cloud-i####.oss-cn-####.aliy####.com:443/ci/checksum.cap
- cloudin####.s3.ap-nort####.####.com:443/config/checksum.cap
- nt####.oss-ap-####.aliy####.com:443/wm/checksum.cap
- pe####.oss-cn-####.aliy####.com:443/vk/checksum.cap
- st####.tin####.com/static/ij-cloud/cs/google_analytics_6.aar
- xl####.oss-ap-####.aliy####.com:443/zb/checksum.cap
HTTP POST requests:
- log-re####.com:443/report
File system changes:
Creates the following files:
- /data/data/####/.apk
- /data/data/####/.dex
- /data/data/####/.dex.flock (deleted)
- /data/data/####/220bf89c7dda7e93_0
- /data/data/####/220bf89c7dda7e93_1
- /data/data/####/31c705f9d7b992e0_0
- /data/data/####/31c78e8b03b21a0f_0
- /data/data/####/31c78e8b03b21a0f_1
- /data/data/####/468eee3d0295059b_0
- /data/data/####/4f58ab5671db64f3_0
- /data/data/####/5b560bb9ca96577f_0
- /data/data/####/5b560bb9ca96577f_1
- /data/data/####/67cdf6a16eb223bb_0
- /data/data/####/67cdf6a16eb223bb_1
- /data/data/####/6b21a06eff7b4d5d_0
- /data/data/####/6b21a06eff7b4d5d_1
- /data/data/####/76d1f691bb9f2a70_0
- /data/data/####/76ed98fbc55c806c_0
- /data/data/####/76ed98fbc55c806c_1
- /data/data/####/7764daa9ff58fedf_0
- /data/data/####/77fd0ff195903544_0
- /data/data/####/818d26cd522e6b84_0
- /data/data/####/8c33c759ceb330d1_0
- /data/data/####/8c33c759ceb330d1_1
- /data/data/####/93e77404a4e8b0c8_0
- /data/data/####/93e77404a4e8b0c8_1
- /data/data/####/9a2ecac482ef176e_0
- /data/data/####/9f3b71a6975e3d96_0
- /data/data/####/9f3b71a6975e3d96_1
- /data/data/####/CBGr2.xml
- /data/data/####/CHLfVtqJjCYW (deleted)
- /data/data/####/CURRENT
- /data/data/####/Cookies-journal
- /data/data/####/Databases.db-journal
- /data/data/####/MANIFEST-000001
- /data/data/####/QuotaManager-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/afee0d76f5ef0caf_0
- /data/data/####/b9a031473d97e1e9_0
- /data/data/####/c193aab34a4c3653_0
- /data/data/####/c193aab34a4c3653_1
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/com.yingmf_preferences.xml
- /data/data/####/d1ad94dff6f0839d_0
- /data/data/####/eb3ae6eb5123ae0c_0
- /data/data/####/eb3ae6eb5123ae0c_1
- /data/data/####/eb4e9be94b0f86b0_0
- /data/data/####/https_m.v.qq.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/null.xml
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
- /data/media/####/crash.txt
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
- libluajava
- libygsiyu
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Displays its own windows over windows of other apps.
