Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.414.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) nm.a####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) api.7####.cn:80
- TCP(TLS/1.0) ti####.c####.l####.####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) m####.qi####.fm:443
- TCP(TLS/1.0) bug####.com:443
- TCP(TLS/1.0) s####.tc.qq.com:443
- TCP t1.jz####.com:7101
- TCP t3.jz####.com:7103
- TCP t1.jz####.com:7102
DNS requests:
- a####.u####.com
- api.7####.cn
- bug####.com
- hm.b####.com
- img.7####.cn
- img.qi####.fm
- m####.qi####.fm
- oc.u####.com
- r####.wx.qq.com
- so####.qi####.fm
- t1.jz####.com
- t2.jz####.com
- t3.jz####.com
HTTP GET requests:
- api.7####.cn/banner/422/updateViewCount?os=####&v=####
- api.7####.cn/banners?location=####&os=####&v=####
- api.7####.cn/modules?os=####&v=####
- api.7####.cn/playlist/1/songs?maxSongId=####&os=####&v=####
- api.7####.cn/playlist/4/songs?maxSongId=####&os=####&v=####
- api.7####.cn/playlists?location=####&version=####&os=####&v=####
- api.7####.cn/radios?version=####&os=####&v=####
- api.7####.cn/splashScreens?os=####&v=####
- api.7####.cn/version/upgrade?os=####&v=####
- nm.a####.com/pic/banner/20170222/88bc16d4-cdb1-4aaa-b6ac-ef3be5244c6a.jpg
- nm.a####.com/pic/banner/20180424/2cd81a72-a67e-463a-8ffe-4f631034e710.jpg
- nm.a####.com/pic/banner/20180502/cb836fbb-5e70-4e3c-b528-bb8d04641dcd.jpg
- nm.a####.com/pic/playlist/20150428/0979ff1d-7a42-4532-acbd-032ac77b5c0f_...
- nm.a####.com/pic/playlist/20150428/12d56318-7c21-4a6f-99ca-95b674684f39_...
- nm.a####.com/pic/playlist/20150428/7ba102df-2f5e-48a2-a139-b246029bb071_...
- nm.a####.com/pic/playlist/20150906/2372e2dd-f1fe-4203-b51c-ba319c42d2eb_...
- nm.a####.com/pic/radio/v2/20150724/0b196165-bd8f-4644-b68c-4ab515ae8010_...
- nm.a####.com/pic/radio/v2/20150724/44e77086-8546-4a2b-b469-b1872b63ef45_...
- nm.a####.com/pic/radio/v2/20150724/46e0d3ac-31fc-4dd8-a585-9bca8884f519_...
- nm.a####.com/pic/radio/v2/20150724/56304366-bc28-4dd9-9b5f-04a62a42d459_...
- nm.a####.com/pic/radio/v2/20150724/57028dfe-2a2d-4afa-bca8-976e33233de7_...
- nm.a####.com/pic/radio/v2/20150724/59a4aa78-46b5-4aa4-b75a-a3759ef74713_...
- nm.a####.com/pic/radio/v2/20150724/870b065a-6bb4-4c61-8c6e-7682cc79e32c_...
- nm.a####.com/pic/radio/v2/20150724/acbed36c-6371-4563-983a-76f8a8645138_...
- nm.a####.com/pic/radio/v2/20150724/b1219216-c3cc-47e8-9536-83c05f96291a_...
- nm.a####.com/pic/radio/v2/20150724/cc12df0f-4baa-418c-804d-25d0be1d6645_...
- nm.a####.com/pic/radio/v2/20150724/d3630200-90a9-4a5e-8ffe-2a3db20bb2d7_...
- nm.a####.com/pic/radio/v2/20150813/b2de064a-c911-4760-8f66-566e57b0ebf5_...
- nm.a####.com/pic/radio/v2/20150819/451edb3b-80ca-43da-a4d6-bd31e172f465_...
- nm.a####.com/pic/radio/v2/20150901/607ecbca-cc49-437d-aa52-1f51e8a73012_...
- nm.a####.com/pic/radio/v2/20150922/673045ff-6ca4-4c7a-aa92-bbca860aefcb_...
- nm.a####.com/pic/radio/v2/20150930/c340a38e-c454-4975-b417-f373e59ce840_...
- nm.a####.com/pic/radio/v2/20151019/ebf28658-7af9-4a36-bb57-3279dcdc4695_...
- nm.a####.com/pic/radio/v2/20151026/af5eaa94-b62c-41d9-a68e-5d0a049eb175_...
- nm.a####.com/pic/radio/v2/20151111/296cc933-88d5-4437-83c7-05275b6a9e0b_...
- nm.a####.com/pic/radio/v2/20151120/91f72087-868a-4f92-83ed-210a60f26b01_...
- nm.a####.com/pic/radio/v2/20151127/3b032381-0315-4556-ac4e-2f2bd2f3584a_...
- nm.a####.com/pic/radio/v2/20160620/9c5e905a-4361-4f50-a7c8-f91b166cc97a_...
- nm.a####.com/pic/radio/v2/20160914/3a4f8788-489e-4511-b919-ba8baf2792f6_...
- nm.a####.com/pic/radio/v2/20161206/e195817c-646e-4d70-9e7d-dab9944237a6_...
- nm.a####.com/pic/radio/v2/20170612/2b0066ea-ea7a-43d0-a415-6b415bd15ddc_...
HTTP POST requests:
- a####.u####.com/app_logs
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/00356507059351895.db-journal
- /data/data/####/1522754794539s.jar
- /data/data/####/1523768983-2038975501
- /data/data/####/Alvin2.xml
- /data/data/####/AppStore.xml
- /data/data/####/ContextData.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/fappInfo_f_356507059351895.xml
- /data/data/####/fconf_f_356507059351895.xml
- /data/data/####/first_login_file.xml
- /data/data/####/ftrategy_f_356507059351895.xml
- /data/data/####/i.xml
- /data/data/####/index
- /data/data/####/mobclick_agent_cached_com.sdf.kjkljlk20
- /data/data/####/mobclick_agent_online_setting_com.sdf.kjkljlk.xml
- /data/data/####/qmtt.db
- /data/data/####/qmtt.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/x-com.bugtags.library-UserInfo.xml
- /data/data/####/xUtils.db-journal
- /data/media/####/-1019719286.tmp
- /data/media/####/-1180330255.tmp
- /data/media/####/-1328152987.tmp
- /data/media/####/-1459910904.tmp
- /data/media/####/-1553690544.tmp
- /data/media/####/-1607094884.tmp
- /data/media/####/-1631117644.tmp
- /data/media/####/-1653643099.tmp
- /data/media/####/-1682490658.tmp
- /data/media/####/-1918377857.tmp
- /data/media/####/-224759802.tmp
- /data/media/####/-364599716.tmp
- /data/media/####/-581070964.tmp
- /data/media/####/-596385646.tmp
- /data/media/####/-642168507.tmp
- /data/media/####/-686232136.tmp
- /data/media/####/-887239296.tmp
- /data/media/####/-928544035.tmp
- /data/media/####/-941221363.tmp
- /data/media/####/1078619242.tmp
- /data/media/####/1429153314.tmp
- /data/media/####/1474897725.tmp
- /data/media/####/1564296678.tmp
- /data/media/####/193327850.tmp
- /data/media/####/2106853046.tmp
- /data/media/####/308161249.tmp
- /data/media/####/317557831.tmp
- /data/media/####/337237694.tmp
- /data/media/####/470328885.tmp
- /data/media/####/511961014.tmp
- /data/media/####/71081044.tmp
- /data/media/####/855429329.tmp
- /data/media/####/877440653.tmp
- /data/media/####/921531196.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Uses the following algorithms to decrypt data:
- DES
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
