Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.weigua####.com:10080
- TCP(HTTP/1.1) www.wif####.net:80
- TCP(HTTP/1.1) js.u####.51.la:80
- TCP(HTTP/1.1) se####.com:80
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) www.wif####.net:443
DNS requests:
- ab####.52sha####.com
- api.s####.b####.com
- av1.x####.com
- i####.51.la
- i.t####.com
- js.u####.51.la
- p####.zhanz####.b####.com
- se####.com
- www.talking####.net
- www.weigua####.com
- www.wif####.net
HTTP GET requests:
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- js.u####.51.la/19287857.js
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?l=####
- s####.jom####.com/s.gif?r=http://sex8dt.com/&l=/sex8dt.com/bbs/view.aspx...
- s####.jom####.com/s.gif?r=http://sex8dt.com/album/view.aspx?id=10&l=/sex...
- s####.jom####.com/s.gif?r=http://sex8dt.com/bbs/book_list.aspx?siteid=10...
- s####.jom####.com/s.gif?r=http://sex8dt.com/bbs/view.aspx?id=30246&l=/se...
- s####.jom####.com/s.gif?r=http://sex8dt.com/wapindex.aspx?siteid=1000&l=...
- se####.com/
- se####.com/Games/chuiniu/dh.gif
- se####.com/Games/egg/egg.gif
- se####.com/Games/horse/2.gif
- se####.com/Games/stone/st.gif
- se####.com/Games/touzi/sz.gif
- se####.com/Games/war/jt.gif
- se####.com/NetCSS/KL_common.js
- se####.com/NetImages/egg.gif
- se####.com/NetImages/flower.gif
- se####.com/NetImages/off0.gif
- se####.com/NetImages/vip.gif
- se####.com/NetImages/vipx.gif
- se####.com/Template/default/default.css?v=####
- se####.com/Template/default/img/android.png
- se####.com/Template/default/img/bbsht.png
- se####.com/Template/default/img/bbsre.png
- se####.com/Template/default/img/dt.gif
- se####.com/Template/default/img/facebg_1.png
- se####.com/Template/default/img/huifu.png
- se####.com/Template/default/img/ico-bbs.gif
- se####.com/Template/default/img/live.png
- se####.com/Template/default/img/logo.jpg
- se####.com/Template/default/img/subtitle.gif
- se####.com/Template/default/img/xk_new.png
- se####.com/Template/default/img/yue.png
- se####.com/Template/default/js/common.js?v=####
- se####.com/Template/default/v11.2/bg_forum.png
- se####.com/Template/default/v11.2/game.png
- se####.com/Template/default/v11.2/shouji.png
- se####.com/XinZhang/Images/18.gif
- se####.com/XinZhang/Images/20.gif
- se####.com/album/
- se####.com/album/book_list.aspx?siteid=####&classid=####&page=####
- se####.com/album/list.aspx?classid=####
- se####.com/album/upload/1000/2015/03/13/S1000_2037140.jpg
- se####.com/album/upload/1000/2015/03/13/S1000_2037350.jpg
- se####.com/album/upload/1000/2015/03/13/S1000_2037560.jpg
- se####.com/album/upload/1000/2015/03/13/S1000_2038120.jpg
- se####.com/album/upload/1000/2015/03/13/S1000_2038350.jpg
- se####.com/album/upload/1000/2017/09/13/S1000_1830420.gif
- se####.com/album/upload/1000/2018/02/06/S1847_1032090.jpg
- se####.com/album/upload/1000/2018/03/24/1000_0622070.png
- se####.com/album/view.aspx?id=####
- se####.com/bbs/book_list.aspx?siteid=####&classid=####&page=####
- se####.com/bbs/medal/43.gif
- se####.com/bbs/medal/44.gif
- se####.com/bbs/medal/t1.gif
- se####.com/bbs/view.aspx?id=####
- se####.com/css/全局顶部.css
- se####.com/css/底部友联.css
- se####.com/wapindex.aspx?siteid=####
- se####.com/wapindex.aspx?siteid=####&classid=####
- www.weigua####.com:10080/cps/adview_pic1.asp?u=####&k=####&p=####&ad=####
- www.weigua####.com:10080/wap/adview_pic1.asp?id=####&xxf=####&ad=####
- www.wif####.net/d11ff1abbbb3f2c7b14b104e7f08fae7.jpg
HTTP POST requests:
- se####.com/ajax_ubb.aspx
Modified file system:
Creates the following files:
- /data/data/####/1527260393857_2074
- /data/data/####/1527260393886_2074
- /data/data/####/1527260393963_2074
- /data/data/####/1527260394082_2074
- /data/data/####/1527260394175_2074
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/TDpref_shorttime.xml
- /data/data/####/TDpref_shorttime0.xml
- /data/data/####/data_0
- /data/data/####/data_0 (deleted)
- /data/data/####/data_1
- /data/data/####/data_1 (deleted)
- /data/data/####/data_2
- /data/data/####/data_2 (deleted)
- /data/data/####/data_3
- /data/data/####/data_3 (deleted)
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/index
- /data/data/####/index (deleted)
- /data/data/####/tdid.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yyc.app.aumrolgn_preferences.xml
Miscellaneous:
Executes next shell scripts:
- getprop
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
