Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Click.311.origin
- Android.Xiny.287.origin
- Android.Xiny.5261
- Android.Xiny.5281
Downloads the following detected threats from the Internet:
- Android.Click.311.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 5.z####.top:80
- TCP(HTTP/1.1) c####.lab####.com:80
- TCP(HTTP/1.1) api.s####.com:6262
- TCP(HTTP/1.1) www.okyes####.com:8081
- TCP(HTTP/1.1) 1####.200.19.80:80
- TCP(HTTP/1.1) api.bi####.com:80
- TCP(HTTP/1.1) 50.1####.11.47:80
- TCP(HTTP/1.1) ggg.koapk####.com:80
- TCP(HTTP/1.1) 13.2####.16.115:8081
- TCP(HTTP/1.1) www.koapk####.com:8081
- TCP(HTTP/1.1) 4####.33.37.240:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(TLS/1.0) c####.pay####.com:443
- TCP(TLS/1.0) datasta####.zhuifen####.top:443
DNS requests:
- 5.z####.top
- api.bi####.com
- api.s####.com
- c####.lab####.com
- c####.pay####.com
- datasta####.zhuifen####.top
- ggg.koapk####.com
- l####.tbs.qq.com
- www.koapk####.com
- www.okyes####.com
HTTP GET requests:
- 5.z####.top/thirdsdk/flowcashpack/11/m20200214f.jar
- api.s####.com:6262/sdk-logs/sdk-logs-control/logs/control?appId=####&off...
- c####.lab####.com/upload/ssp/DynServiceConfig_v1.0.0_offline.json
- c####.lab####.com/upload/ssp/SSP-SDK-ZV-COMM-v3.0.46-WG-202005220959_dex...
HTTP POST requests:
- 13.2####.16.115:8081/sm/sr/sdl/in
- api.bi####.com/un
- api.s####.com:6262/sdk_logs/sdk-err-log/add
- api.s####.com:6262/sdk_logs/sdk-online-log/add
- ggg.koapk####.com/pgm/sr/gm/gy
- l####.tbs.qq.com/ajax?c=####&k=####
- www.koapk####.com:8081/sm/sr/rt/ry
- www.koapk####.com:8081/sm/sr/sdl/in
- www.okyes####.com:8081/sdk/nsd.action?b=####
File system changes:
Creates the following files:
- /data/data/####/1.dex
- /data/data/####/1.dex (deleted)
- /data/data/####/1.jar
- /data/data/####/20160121.xml
- /data/data/####/201905151050.apk
- /data/data/####/201905151050.dex
- /data/data/####/2d5dfe0e959511ea9799506b4b12c760827c2fe5111b706...ae.dex
- /data/data/####/2d5dfe0e959511ea9799506b4b12c760827c2fe5111b706...rcache
- /data/data/####/318fffa52919ad944554b62c26ffdcf1
- /data/data/####/4cfdd9d73f82fa12df3c9a76704cb8de.xml
- /data/data/####/51651167.apk
- /data/data/####/51651167.dex
- /data/data/####/5328704.dex
- /data/data/####/5328704.jar
- /data/data/####/6616f972f9884e301cd740268cfdf343
- /data/data/####/DynConfig.xml
- /data/data/####/MobikokCommonConfig.xml
- /data/data/####/MobikokDeviceConfig.xml
- /data/data/####/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/VirtualAPK_Settings.xml
- /data/data/####/ag.xml
- /data/data/####/bdownloaders.db
- /data/data/####/bdownloaders.db-journal
- /data/data/####/c201905151050.apk
- /data/data/####/core_info
- /data/data/####/data.dex
- /data/data/####/data.jar
- /data/data/####/debug.conf
- /data/data/####/download_upload
- /data/data/####/iuy_data.xml
- /data/data/####/ja201908091350.data
- /data/data/####/libloaddex.hb.com.loaddex.psx.so
- /data/data/####/libnav-6mdw2z.so
- /data/data/####/lob.xml
- /data/data/####/m2019083117.apk
- /data/data/####/m2019083117.dex
- /data/data/####/mobikokdload.db
- /data/data/####/mobikokdload.db-journal
- /data/data/####/s2019083117.apk
- /data/data/####/s2019083117.dex
- /data/data/####/swith1014.db
- /data/data/####/swith1014.db-journal
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_config.xml.bak
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbs_pv_config
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/temp.zip (deleted)
- /data/data/####/uuid_data.xml
- /data/data/####/ver.ini.xml
- /data/data/####/webview.db
- /data/data/####/webview.db-journal
- /data/media/####/758154333.png.tmp
- /data/media/####/Config.txt
- /data/media/####/mobikokCacheFileInfos
- /data/media/####/tbslog.txt
- /data/media/####/test1591104294293
- /data/media/####/test1591104305132
Miscellaneous:
Executes the following shell scripts:
- app_process /system/bin com.android.commands.pm.Pm path <Package>
- awk {print $9}
- getprop ro.product.cpu.abi
- grep 2135
- grep 3057
- grep 5003
- logcat -d -v time
- md5 /data/app/<Package>-1.apk
- ps
- sh
Loads the following dynamic libraries:
- loaddex.hb.com.loaddex
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- RSA-ECB-NoPadding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
