Android.Hidden.6292

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) th####.apus####.com:80
TCP(HTTP/1.1) img.apus####.com:80
TCP(HTTP/1.1) st####.ap####.edges####.net:80
TCP(HTTP/1.1) t####.down####.apus####.com:80
TCP(HTTP/1.1) cm3.apuslau####.com:80
TCP(HTTP/1.1) h####.shu####.cn:80
TCP(HTTP/1.1) ce2.apuslau####.com:80
TCP(HTTP/1.1) in1.apus####.com:80
TCP(HTTP/1.1) static-####.apus####.com:80
TCP(HTTP/1.1) cm4.apuslau####.com:80
TCP(HTTP/1.1) sea####.apuslau####.com:80
TCP(HTTP/1.1) st####.th####.apus####.com:80
TCP(HTTP/1.1) h5.apuslau####.com:80
TCP(HTTP/1.1) h7.apuslau####.com:80
TCP(HTTP/1.1) i####.apuslau####.com:80
TCP(HTTP/1.1) wid####.apuslau####.com:80
TCP(HTTP/1.1) st####.t####.apuslau####.####.net:80

DNS requests:

ce2.apuslau####.com
cm1.apuslau####.com
cm3.apuslau####.com
cm4.apuslau####.com
h####.shu####.cn
h5.apuslau####.com
h7.apuslau####.com
i####.apuslau####.com
img.apus####.com
in1.apus####.com
sea####.apuslau####.com
st####.ap####.apuslau####.com
st####.t####.apuslau####.com
st####.th####.apus####.com
static-####.apus####.com
t####.down####.apus####.com
th####.apus####.com
wid####.apuslau####.com

HTTP GET requests:

i####.apuslau####.com/activities/jquery-1.9.1.min.js
i####.apuslau####.com/theme/15f0ccfe11e6c82831f57d26bb0ae9e7.png
i####.apuslau####.com/theme/1857385cad6483163a0cffceffa12327.png
i####.apuslau####.com/theme/266c8986b36ed4092a3448e844a8c69a.png
i####.apuslau####.com/theme/26cd97afabda0dc59c181774915893b7.png
i####.apuslau####.com/theme/2fe80146ba864db0e2dcd977e1e9f4ec.png
i####.apuslau####.com/theme/95908487748a0160f14f9f24ec054773.png
i####.apuslau####.com/theme/98b206daf335b1fc8eb4adfb7c10b04a.png
i####.apuslau####.com/theme/HOT24680.png
i####.apuslau####.com/theme/apus.store.useragent.js?t=####
i####.apuslau####.com/theme/cdd3bf700f5ce662b95327496b795792.png
i####.apuslau####.com/theme/ec618baf3b47f63c1996be1fce251bfe.png
i####.apuslau####.com/theme/ff38b24ee56bdb04f79f2184644a5ae9.png
i####.apuslau####.com/updatefile/178F561C760F0F4A7062FF9C80C33A5F.prop
i####.apuslau####.com/updatefile/7fba2b6b88c485ebf01523b83c051f77.dat
i####.apuslau####.com/updatefile/9c9034b086ea417552ee5e40d7479f32.prop
img.apus####.com/news/lock/20180510/64329ecb5c66a9f27dbc9b4f9765e<SMS Ad...
st####.ap####.edges####.net/upload/100/1f6c89df79fc8176b3caac17307e738b....
st####.ap####.edges####.net/upload/100/4c05b3b4da4ce67c39a5fde7723ada82....
st####.ap####.edges####.net/upload/100/63f04272abfc2cff3e0f3a5918b0ceac....
st####.ap####.edges####.net/upload/100/66acbdad50d4659195782e72a204aa0c....
st####.ap####.edges####.net/upload/100/83957a171b35c474d9cd5ff38926c315....
st####.ap####.edges####.net/upload/100/8b73d3c652ae7427512a660fbf3238d92...
st####.ap####.edges####.net/upload/100/90daf50ba033f3e6798613b2103f0a04....
st####.ap####.edges####.net/upload/100/a5e41476f886a304c9c0476e224331cc....
st####.ap####.edges####.net/upload/100/a6b0049dd1751e2b09d8c2866957ba82....
st####.ap####.edges####.net/upload/100/b42e3ce25d0d53f3fff1ead9733f9066....
st####.ap####.edges####.net/upload/100/ec874587d5279c93d9ac250474be46d5....
st####.ap####.edges####.net/upload/fe/2016081215225402695db498.png
st####.ap####.edges####.net/upload/fe/20160812152951dcb0377abf.png
st####.ap####.edges####.net/upload/fe/20160812153001817c1e31c1.png
st####.ap####.edges####.net/upload/fe/20160812153011fe3ee2f033.png
st####.ap####.edges####.net/upload/fe/20160812153018ab967b9add.png
st####.ap####.edges####.net/upload/fe/20160812174931457851dceb.png
st####.ap####.edges####.net/upload/fe/apus.store.indexctr.js?t=####
st####.ap####.edges####.net/upload/launcher/2018082911350661e187e2d9.png
st####.t####.apuslau####.####.net/Theme_12_1_LOGO.webp
st####.t####.apuslau####.####.net/Theme_12_2_H1.webp
st####.t####.apuslau####.####.net/Theme_12_2_H2.webp
st####.t####.apuslau####.####.net/Theme_12_2_H3.webp
st####.th####.apus####.com/theme/fe/20160902171050095474c837.png
st####.th####.apus####.com/theme/fe/201609131106432cb010dc28.png
st####.th####.apus####.com/theme/fe/20160914182721dcf449c2b8.png
st####.th####.apus####.com/theme/fe/201609201213453964dbcbf6.png
st####.th####.apus####.com/theme/fe/breadcrumbs.this.ctrl.js?t=####
static-####.apus####.com/common/201806121042506a10d973a8.png
static-####.apus####.com/common/20181017122817552a30df6e.css
t####.down####.apus####.com/Theme_10_4_T.jpg
t####.down####.apus####.com/Theme_12_4_T.jpg
t####.down####.apus####.com/Theme_13_4_T.jpg
t####.down####.apus####.com/Theme_4640_4_T.jpg
t####.down####.apus####.com/Theme_4647_4_T.jpg
t####.down####.apus####.com/Theme_4722_4_T.jpg
t####.down####.apus####.com/Theme_4725_4_T.jpg
t####.down####.apus####.com/Theme_4791_4_T.jpg
t####.down####.apus####.com/Theme_4793_4_T.jpg
t####.down####.apus####.com/Theme_4873_4_T.jpg
t####.down####.apus####.com/Theme_4905_4_T.jpg
t####.down####.apus####.com/Theme_4907_4_T.jpg
t####.down####.apus####.com/Theme_4953_4_T.jpg
t####.down####.apus####.com/Theme_5088_4_T.jpg
t####.down####.apus####.com/Theme_5112_4_T.jpg
t####.down####.apus####.com/Theme_5118_4_T.jpg
t####.down####.apus####.com/Theme_5287_4_T.jpg
t####.down####.apus####.com/Theme_5367_4_T.jpg
t####.down####.apus####.com/Theme_5413_4_T.jpg
t####.down####.apus####.com/Theme_5584_4_T.jpg
t####.down####.apus####.com/Theme_5700_4_T.jpg
t####.down####.apus####.com/Theme_5754_4_T.jpg
t####.down####.apus####.com/Theme_5957_4_T.jpg
t####.down####.apus####.com/Theme_5996_4_T.jpg
t####.down####.apus####.com/Theme_6753_4_T.jpg
t####.down####.apus####.com/Theme_6764_4_T.jpg
t####.down####.apus####.com/Theme_6785_4_T.jpg
t####.down####.apus####.com/Theme_6_4_T.jpg
t####.down####.apus####.com/Theme_7069_4_T.jpg
t####.down####.apus####.com/Theme_8_4_T.jpg
t####.down####.apus####.com/Theme_9087_4_T.jpg
t####.down####.apus####.com/Theme_9095_4_T.jpg
t####.down####.apus####.com/Theme_9097_4_T.jpg
t####.down####.apus####.com/Theme_9131_4_T.jpg
t####.down####.apus####.com/Theme_9244_4_T.jpg
th####.apus####.com/en/themes/real-life-12/
th####.apus####.com/en/top-downloads/
wid####.apuslau####.com/getVg/v1?m=####&l=####&cid=####&vc=####

HTTP POST requests:

ce2.apuslau####.com/e3
cm3.apuslau####.com/g3
cm4.apuslau####.com/g3
h####.shu####.cn//installations.json
h5.apuslau####.com/getWallPaper/v1
h7.apuslau####.com/api/v1
in1.apus####.com/v3
sea####.apuslau####.com/getEngine/v1
sea####.apuslau####.com/getWord/v1

Modified file system:

Creates the following files:

/data/data/####/1_0_0.t1
/data/data/####/1_0_0.tmp
/data/data/####/5_1_0.t1
/data/data/####/5_1_0.tmp
/data/data/####/5_2_0.t1
/data/data/####/5_2_0.tmp
/data/data/####/8_2_0.t1
/data/data/####/8_2_0.tmp
/data/data/####/EVT.tmp
/data/data/####/Lehmann.prop.sig
/data/data/####/Lehmann.prop_5836
/data/data/####/R.dat.t1
/data/data/####/R.dat.tmp
/data/data/####/ap_ct_id.db
/data/data/####/ap_ct_id.db-journal
/data/data/####/app_exit_interstitial_pr.prop.sig
/data/data/####/app_exit_interstitial_pr.prop_5836
/data/data/####/app_mor.prop.sig
/data/data/####/app_mor.prop_5836
/data/data/####/auhd.db
/data/data/####/auhd.db-journal
/data/data/####/b_r.db
/data/data/####/b_r.db-journal
/data/data/####/call_show.prop.sig
/data/data/####/call_show.prop_5836
/data/data/####/cl__charginglocker_ads.prop.sig
/data/data/####/cl__charginglocker_ads.prop_5836
/data/data/####/cloud_v2.db
/data/data/####/cloud_v2.db-journal
/data/data/####/content_reco_gadget.json
/data/data/####/crash.Tracker.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default.xml
/data/data/####/default.xml.bak
/data/data/####/dglobal.prop.sig
/data/data/####/dglobal.prop_5836
/data/data/####/dscy_pr.prop.sig
/data/data/####/dscy_pr.prop_5836
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/fc.db
/data/data/####/fsdefault.xml
/data/data/####/global.prop.sig
/data/data/####/global.prop_5836
/data/data/####/hwc.db
/data/data/####/index
/data/data/####/interlaken.xml
/data/data/####/l_s_d.db
/data/data/####/l_s_d.db-journal
/data/data/####/launcher.db-journal
/data/data/####/main
/data/data/####/nwc.db
/data/data/####/preset.zip.sig
/data/data/####/preset.zip_5835
/data/data/####/s_w_j.dat.sig
/data/data/####/s_w_j.dat_5835
/data/data/####/search_default.xml
/data/data/####/sec.db
/data/data/####/sglobal.prop.sig
/data/data/####/sglobal.prop_5835
/data/data/####/shuzilm_du_com.apusapps.launcher.xml
/data/data/####/stark_pr.prop.sig
/data/data/####/stark_pr.prop_5836
/data/data/####/stat_pref.xml
/data/data/####/theme.zip.sig
/data/data/####/theme.zip_5836
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/winch.prop.sig
/data/data/####/winch.prop_5836
/data/media/####/3b5b7e5c043e9770e79bca0d0f01539f
/data/media/####/Colorful.jpg
/data/media/####/f063a8697a98b91599ad5ac095f14509

Miscellaneous:

Loads the following dynamic libraries:

aicnt
extend

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about active device administrators.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Gains access to information about contacts from the Contact list.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial