Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.1007.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) kyy####.wwe####.com:17001
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.0) app.zhejian####.com:443
- TCP(TLS/1.0) 1####.217.17.106:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) oss-acc####.aliy####.com.####.com:443
- TCP(TLS/1.2) 1####.217.17.110:443
- TCP(TLS/1.2) 64.2####.161.138:443
- TCP(TLS/1.2) 1####.217.17.106:443
- TCP(TLS/1.2) p####.google####.com:443
- TCP(TLS/1.2) 1####.217.20.106:443
- TCP(TLS/1.2) 1####.194.73.94:443
DNS requests:
- app.zhejian####.com
- jinhanc####.oss-acc####.aliy####.com
- kyy####.wwe####.com
- p####.google####.com
- safebro####.google####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.8
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- tys####.wwe####.com
HTTP POST requests:
- kyy####.wwe####.com:17001/cbcvu9/
File system changes:
Creates the following files:
- /data/data/####/1edebae7d9a85d93e9990c39342a755be96f9560382a844...d845.0
- /data/data/####/1f892259ffb1bccf880b4e6b1001990c1e69f421536a810....0.tmp
- /data/data/####/2766e44c44a1104e3f849d1fdcac8ef1c71d92185a23d2f....0.tmp
- /data/data/####/394de3a3f27cd1e053f3eab50223af66cf9aa3642a8727f....0.tmp
- /data/data/####/54ea1b6f2182a2b124e8b4fe418cf9419614f106c0c9705....0.tmp
- /data/data/####/631dc19694ab714cfc2e7317fd792a044f84062603c8642....0.tmp
- /data/data/####/6e50376d2d8467efd19ec1ff310286343fbc97bd1a794f5...492b.0
- /data/data/####/9e73a12c5da88e6198388d152a8a2da1b2eb50d699d7ba9....0.tmp
- /data/data/####/a1d07e9c4ab57816a8d7e9d628a10833e83a79770caa6f6...7c55.0
- /data/data/####/bfe018dcfc11d41feb747600a804bab516c1aad915c6ffe....0.tmp
- /data/data/####/c893da25e51123ae504bfe111b8fbfee5b83bd7c5663547...0c4a.0
- /data/data/####/d2acd7b33ff917f188278c1b41bc03884b2a82bce700d45...ef0c.0
- /data/data/####/d319066f487ab701be07ef16ad14b8db7f72c9de2e4030c....0.tmp
- /data/data/####/d43f530febad30e06428589861030ce866a3aea2cf4fa5b....0.tmp
- /data/data/####/d8ec03129a76a8048f8333e7448201e7d1e7da81f5e86ee...e7df.0
- /data/data/####/d8fe3fdb09663115f06aafd3976787c09209fd0b0065184....0.tmp
- /data/data/####/dDJ.dex
- /data/data/####/dDJ.dex (deleted)
- /data/data/####/dDJ.dex.flock (deleted)
- /data/data/####/dDJ.jar
- /data/data/####/dasdasdsadsad
- /data/data/####/f29d9aae2ad8117f342f677e38ea57fa6a521e374de30ec....0.tmp
- /data/data/####/fca01feadc05b0161fe4d1f3ac18887f0b98654ef682b7e...68cc.0
- /data/data/####/getui_sp.xml
- /data/data/####/gps
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/oefb.xml
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/pushsdk.db-journal
- /data/data/####/qo.xml
- /data/data/####/sp_psmffc.xml
- /data/data/####/uz
- /data/media/####/.yobi
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=<Package Folder>/extfiles/dDJ.jar --oat-fd=33 --oat-location=<Package Folder>/extfiles/dDJ.dex --compiler-filter=speed
- cat /proc/version
- cat /sys/class/net/wlan0/address
- getprop ro.yunos.build.version
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- RSA-None-PKCS1Padding
Accesses the ITelephony private interface.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
