Android.Hidden.12154

Technical information

Malicious functions:

Removes app icon from the screen.

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 81.69.2####.21:80
TCP(HTTP/1.1) 1####.35.212.35:80
TCP(HTTP/1.1) 1####.35.204.35:80
TCP(TLS/1.0) 1####.113.150.26:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) 1####.5.88.223:443
TCP(TLS/1.0) bea####.g####.com:443
TCP(TLS/1.0) cd.pd####.com:443
TCP(TLS/1.0) 1####.171.149.253:443
TCP(TLS/1.0) rr2---s####.g####.com:443
TCP(TLS/1.0) t####.pindu####.com:443
TCP(TLS/1.0) m####.yangk####.com.####.com:443
TCP(TLS/1.0) 1####.251.33.67:443
TCP(TLS/1.0) fu####.pd####.com.####.cn:443
TCP(TLS/1.0) api.pindu####.com:443
TCP(TLS/1.2) 1####.251.33.67:443
TCP(TLS/1.2) 64.2####.163.95:443
TCP(TLS/1.2) 1####.251.33.74:443
TCP(TLS/1.2) 1####.194.221.95:443
TCP(TLS/1.2) 1####.250.217.74:443
TCP(TLS/1.2) 1####.177.14.104:443
TCP(TLS/1.2) 1####.177.14.95:443
UDP bea####.g####.com:443
TCP api.pindu####.com:443
UDP 64.2####.162.139:443

DNS requests:

api.pindu####.com
bea####.g####.com
c####.pd####.com
cd.pd####.com
cdl.pd####.com
fu####.pd####.com
m####.yangk####.com
m.pindu####.net
p####.google####.com
rr2---s####.g####.com
t####.pindu####.com
t####.pindu####.com
www.google####.com

File system changes:

Creates the following files:

/data/data/####/.dirty
/data/data/####/010dd128def148e494b2d29ad343c001
/data/data/####/01b717e3337b498aadda7ff4ae71af8d.7z
/data/data/####/0558c4da3d4b4e1a959c4f1d74fe3889
/data/data/####/081648ed0c094e39b657cecbdfa661b4
/data/data/####/0b3002e5c11743f5bbcfbc14429f3969.7z
/data/data/####/0b8af741483a4ac58a1da625f29bd1a3.7z
/data/data/####/0cc9a149640643ba8058921a333b7997.7z
/data/data/####/147d3234ac314b75bcbd1d470e0c5b7f
/data/data/####/1581acab07a44a04af385c14d559633f
/data/data/####/1834fa6e92a2494b9f105fc8c749023a
/data/data/####/19f92ad3285644c6b65b2cd8a260f562.7z
/data/data/####/1b345e0872d744e6a31d664148720ac3.7z
/data/data/####/1bcbb2e47e4544eab28c1e7d01e26235.7z
/data/data/####/1ca51d9f43824cabacb47e72f7ddc7cb.7z
/data/data/####/1ca9c096c3414b9fab3aa9fe3ed4802e
/data/data/####/1ceb9601accc42808c4664b5ab9e6f22
/data/data/####/1d2db37599454ba5bbc771c192042f98
/data/data/####/20210207_18a6bf73f22db7618e1a5b278fa8a464f1adbe6e
/data/data/####/20210207_18a6bf73f22db7618e1a5b278fa8a464f1adbe6e.temp
/data/data/####/20f9381305764b989355c9c198f09291
/data/data/####/21fed93a92f44770b34507d1b8f00a90
/data/data/####/251a0f5449714c69981d16c7cc819eda.7z
/data/data/####/25ed13f9e3894eea84ba458b6e5105bd
/data/data/####/2613ca0031464d17a223d975e9d89b7e
/data/data/####/2a6aba46838f40d29330134624b0dc94
/data/data/####/2bc68618e0814f18b6104839d87a1394
/data/data/####/2c1d923750d847559d332d586717ff97
/data/data/####/2c721c4d4bc94fadb7d2ffc4ae71fb20
/data/data/####/2d18ec1efa1544efbcd8b6660d87bd54
/data/data/####/2eb431332f66404ab7ff70df13534a80.7z
/data/data/####/2f25aa9303f54b6cbbb841dc31781481
/data/data/####/328e192258fc4e56885c70e8c62a6352
/data/data/####/3633173f7947499dab389ec0dc6617db
/data/data/####/36e5f57832f246d48125d4f7f638b4af
/data/data/####/3772e4ad82d04f11bdda742ade897944.7z
/data/data/####/379d41aa594024a8_0 (deleted)
/data/data/####/3868da75-ab8a-40db-8916-0abd8ad5b605.png.slim.png
/data/data/####/3868da75-ab8a-40db-8916-0abd8ad5b605.png.slim.png.temp
/data/data/####/38875327cf8847d783f25b283ddec12c.7z
/data/data/####/3a056272cf694ea68f54c285ed455e92.7z
/data/data/####/3a958003103449b6a13d09e8bcbc3e04.7z
/data/data/####/3b3374a7c1dc4947a146afa6286434c6
/data/data/####/3c379ac181cb4a1b88eda542aaf6b261
/data/data/####/3f28d68071514e20a63a47cd0a7fa2ff.7z
/data/data/####/409c9131d8ec4e12a893ef1e87014b93
/data/data/####/41133cbd76b14e68a143a4980c2dc451
/data/data/####/41f68d5197cd4a91921790bcd2a34fbc
/data/data/####/45ecf5f638bd451898727115c67516a6.7z
/data/data/####/496fd6e66d7e466fb0201fa6dff00d1f.7z
/data/data/####/4a19a22a22464acf9243a3a1aa8c6578
/data/data/####/4cb10fcecfef4f66bdcba5b25714f71b
/data/data/####/4e4e6fc8cea54d6892bf2a03aee58cf0.7z
/data/data/####/51334856f95649cbbdce5a5a222538c2
/data/data/####/537466e29b834db78f2fb18328cb534e.7z
/data/data/####/54ef63638f4c4a54b7c800192e8f85a6.7z
/data/data/####/5974cb60dc284a2fa500e7a4b8df4dca
/data/data/####/5b120f196ce844fdb76e9d2cd88f9af0
/data/data/####/5b97e1e9c30b48399d785ca1266ce74d
/data/data/####/5cfcc8d47dc4450b92ce145e61433cbe
/data/data/####/616e3e1451174e3faa626c14d1e0d037
/data/data/####/626344ff76104171b09ae94a36482b7b.7z
/data/data/####/6502e0624a884ba5a09b48a8902e535f
/data/data/####/655b0f1e527142818dc7089adbf70d75
/data/data/####/67ad34ed32b84a79bd57d419a3b86ef1
/data/data/####/69a7ba507f4c4cf093ae83b17fdb5429.7z
/data/data/####/6e838fbdbf0746c3972c7dfcfe69c325
/data/data/####/710024bfb9eb45e4b77ab01e21725a4e.7z
/data/data/####/7388f795858a4901b1a5a8b7c4b49489
/data/data/####/757d286e5080416c901a6e0224d16da2.7z
/data/data/####/784af414e6d6480196fcb439ef8583da.7z
/data/data/####/79e18b4c128a4342849b628b81b55f39.7z
/data/data/####/7b23da11-daec-44cc-ba0f-1aefca04a28c.png
/data/data/####/7b23da11-daec-44cc-ba0f-1aefca04a28c.png.temp
/data/data/####/7f16e6380bd34b12ad6b733415cad39e
/data/data/####/80848f387a6f4302af4ce344c449d496
/data/data/####/80dd0f982aef4268b9b4bd2bd4a6f35a
/data/data/####/846af0e0519c43e1a91517290a38290b
/data/data/####/8541241daf7f4e81b068d076322cea9a
/data/data/####/89fa1335663c46c2bdcc7896b1a1805e
/data/data/####/8c509e72-ad4b-4796-8d6a-6acca8450b93.png.temp
/data/data/####/9287b48017454b28b0210177ba7f5115
/data/data/####/97ee5ac5e77e4cfebcd96e7110d1384c
/data/data/####/988a9ca4aee6472e8ff8986226663f93.7z
/data/data/####/98f5bd0fd536474fb8f5459e2558a3a8
/data/data/####/9bddd61521d84cdcaf94e6f89dd3e9f0.7z
/data/data/####/9c99c218cf5e43c998dfd014a2d23f82
/data/data/####/B1490213E616C66A92AAED0B5EA747B6.0
/data/data/####/BS_mango-config-kv
/data/data/####/BS_mango_ab
/data/data/####/Cookies-journal
/data/data/####/HX_titan_memory_monitor
/data/data/####/HX_titan_memory_wrapper
/data/data/####/Vita
/data/data/####/Web Data
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/Web_AbCompRelease
/data/data/####/a2f1e9aa077949618f0c1ad5ecb13da1.7z
/data/data/####/a3117816fee54c8d94e4908442d5b258
/data/data/####/a61be7c07a6743579cecad9e36a28d0e
/data/data/####/a6fe6cc3374e4204b8181293cb2d447a
/data/data/####/a7a3ed4a904d400185c8d67def261870
/data/data/####/aa889e3c807748b58a6222eb1ad96fa7
/data/data/####/ab3e18a3719a487887f3bb705387f3f1
/data/data/####/ab_net_update_lock_prefix
/data/data/####/ab_update_lock
/data/data/####/abtest
/data/data/####/adfff98338de401a9aa546d7bafd3f05.7z
/data/data/####/ae9484d0642a4ba5b2cfbaa9120c930a
/data/data/####/aed5386bebe04917ab2fa5c5d2f80142.7z
/data/data/####/b417bd63835140729e2f78db993d01e5.7z
/data/data/####/b43b6a9dbc96496cbc13df42daf58012
/data/data/####/b45f272f47ff4a9aaf1f1cff6869eaa7
/data/data/####/b805cb5c02714d098e55a20a16048ac4.7z
/data/data/####/ba523a17a7bc46479c6d367e928d6f10
/data/data/####/backup_info
/data/data/####/bd22e2a828c34399b9c404b0454ac76f.7z
/data/data/####/be78d8be0f4043a3a2a512327fc26d78
/data/data/####/bot_plu_ver
/data/data/####/c0e19e43f7d24f9f8aecb1c47bb4596b.7z
/data/data/####/c288aee89df3467fad35fd8961ee509e
/data/data/####/c31af12804fe47848d97ee760b6c7b95.7z
/data/data/####/c5c88ab114fc41ee8de4921521e53da0
/data/data/####/c5f5a04a29784e5a8c1c5b8c7f9a9a86
/data/data/####/c78a580684874fd489067544f91559f9
/data/data/####/c849c1b3bbe0497b8850655f784cb208
/data/data/####/cb5f250f-beb7-4d39-84af-795f513f4f2a.png.temp
/data/data/####/ccfd75998869451e8ab6e7f03dfdda7a.7z
/data/data/####/cdn_blank_file_2D86F9A8-EB69-4591-9905-2454088A14BF
/data/data/####/cdn_blank_file_2D86F9A8-EB69-4591-9905-2454088A14BF.temp
/data/data/####/cf251c8bbeb74f1bafaccc4c52d69f87
/data/data/####/com.xunmeng.pinduoduo.AliveBaseAbility-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.AliveBaseAbility.manifest
/data/data/####/com.xunmeng.pinduoduo.AliveBaseAbility.manifest.temp
/data/data/####/com.xunmeng.pinduoduo.AliveBaseAbility.md5checker
/data/data/####/com.xunmeng.pinduoduo.AliveBaseAbility.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.AliveBaseAbility.vlock
/data/data/####/com.xunmeng.pinduoduo.android.config-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.android.config.manifest.temp
/data/data/####/com.xunmeng.pinduoduo.android.config.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.android.config.vlock
/data/data/####/com.xunmeng.pinduoduo.remote.LiveRedbox-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.remote.LiveRedbox.manifest
/data/data/####/com.xunmeng.pinduoduo.remote.LiveRedbox.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.remote.LiveRedbox.vlock
/data/data/####/com.xunmeng.pinduoduo.remote.cdnimage-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.remote.cdnimage.manifest
/data/data/####/com.xunmeng.pinduoduo.remote.cdnimage.manifest.temp
/data/data/####/com.xunmeng.pinduoduo.remote.cdnimage.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.remote.cdnimage.vlock
/data/data/####/com.xunmeng.pinduoduo.remote.weather-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.remote.weather.manifest
/data/data/####/com.xunmeng.pinduoduo.remote.weather.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.remote.weather.vlock
/data/data/####/com.xunmeng.pinduoduo.secdtbase-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.secdtbase.manifest
/data/data/####/com.xunmeng.pinduoduo.secdtbase.manifest.temp
/data/data/####/com.xunmeng.pinduoduo.secdtbase.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.secdtbase.vlock
/data/data/####/com.xunmeng.pinduoduo.v7alibNovaAdaptor-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.v7alibNovaAdaptor.manifest
/data/data/####/com.xunmeng.pinduoduo.v7alibNovaAdaptor.manifest.temp
/data/data/####/com.xunmeng.pinduoduo.v7alibNovaAdaptor.md5checker
/data/data/####/com.xunmeng.pinduoduo.v7alibNovaAdaptor.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.v7alibNovaAdaptor.vlock
/data/data/####/com.xunmeng.pinduoduo.v7alibpxing_android-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.v7alibpxing_android.manifest
/data/data/####/com.xunmeng.pinduoduo.v7alibpxing_android.manifest.temp
/data/data/####/com.xunmeng.pinduoduo.v7alibpxing_android.md5checker.temp
/data/data/####/com.xunmeng.pinduoduo.v7alibpxing_android.vlock
/data/data/####/com.xunmeng.pinduoduo.web-patch.vlock
/data/data/####/com.xunmeng.pinduoduo.web.manifest
/data/data/####/com.xunmeng.pinduoduo.web.md5checker
/data/data/####/com.xunmeng.pinduoduo.web.vlock
/data/data/####/com.xunmeng.pinduoduo_preferences.xml
/data/data/####/comp_resource_visit_ratio
/data/data/####/config_update_lock_file
/data/data/####/cookie_prefs.xml
/data/data/####/cs_tracker.db-journal
/data/data/####/cs_tracker_titan.db-journal
/data/data/####/d073d22b57824314a118bf1dd25c6a34
/data/data/####/d173b9b3084843d9ad44da541cf9dfe2
/data/data/####/d23c4746929e41ac9d34cc9f857f902b.7z
/data/data/####/d31bcb428ccb4a53a82605afd634f40e
/data/data/####/d68662f0-5d45-456c-8ddc-756009d67e36.png
/data/data/####/d68662f0-5d45-456c-8ddc-756009d67e36.png.temp
/data/data/####/d7b053234f2c414cb9e12e04b6b2ca01.7z
/data/data/####/d7fc01450d384edb81b290c9283a47d0.7z
/data/data/####/d81fd53ab8594c48a3ed9f15a0a6b1e0
/data/data/####/daily_report_lock_file
/data/data/####/data_for_nss
/data/data/####/dc1e813539b0412688c9d83652e743ff
/data/data/####/dc533980e3f54a9aa1e5226e8b9d32ed
/data/data/####/e21a8255cc0142498a226c57b631e4c6
/data/data/####/e2be410a6e945019d71e81021894d072c69a30ac6299155....0.tmp
/data/data/####/e2be410a6e945019d71e81021894d072c69a30ac6299155...a79f.0
/data/data/####/e3dd5025bcfe4507984b6e74b96fd222
/data/data/####/e4ce20abd1854348ab84c0cfb7083a08
/data/data/####/e5aa071eb7e048ceb817d88fbddf6755
/data/data/####/e7080793ed164f9ea1b5f826d0977d7c.7z
/data/data/####/e897906a4f8f4b5db50e5ad37f10c972.7z
/data/data/####/e904073031a743abb9a1fdb140d30bb6
/data/data/####/e9911f2f94ff4b579bcb506952132da2
/data/data/####/ed40341767ea46dbad5cb447e72f82ad
/data/data/####/ee494115de4743d1863310b9620c21df
/data/data/####/event_data.db-journal
/data/data/####/event_data_titan.db-journal
/data/data/####/exp_ab_update
/data/data/####/exp_net_update_lock_prefix
/data/data/####/extra_info.json
/data/data/####/extra_info.json.temp
/data/data/####/f3af7aa9bb064300b9e8acd2b29121d5
/data/data/####/f4840de6fc13433ea8d2164bb23b7996.7z
/data/data/####/f733b73b9e80424c8b9cab0da74d6af1.7z
/data/data/####/f79d83d69efd406e9f23d9d265314c9d
/data/data/####/fa67a5a15a224a2ea1eeef65a8aab6b1.7z
/data/data/####/fb19e99a5ee244b78e242dae0ae37b99
/data/data/####/fc7bea25ce3747729f15f72fff90d41a
/data/data/####/fef25a8122dd43868741475e49e4dd6f
/data/data/####/force_permission
/data/data/####/gc.vlock
/data/data/####/get_config.lego
/data/data/####/get_config.lego.temp
/data/data/####/index
/data/data/####/iris_downloader_main_v12.db-journal
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/json.config
/data/data/####/json.config.temp
/data/data/####/libNovaAdaptor.zip
/data/data/####/libNovaAdaptor.zip.temp
/data/data/####/libNovaAdaptor_1669810165386_42da2b87_main17311...20.tmp
/data/data/####/libpxing_android.zip.temp
/data/data/####/libpxing_android_1637827816870_5e4b6d90_main173...57.tmp
/data/data/####/main_sp
/data/data/####/metrics_guid
/data/data/####/mmkv.vlock
/data/data/####/mobile_weather_83b650ec6a2647cfbed8f677d27704e4.txt
/data/data/####/mobile_weather_83b650ec6a2647cfbed8f677d27704e4.txt.temp
/data/data/####/mpid
/data/data/####/multi_process_cold_start
/data/data/####/mw1.bin
/data/data/####/mw1.bin.temp
/data/data/####/nw0.bin.temp
/data/data/####/okdownload-breakpoint.db-journal
/data/data/####/placeholder_00001731136853029001.dirty.xcrash
/data/data/####/placeholder_00001731136853039002.clean.xcrash
/data/data/####/placeholder_00001731136853039003.dirty.xcrash
/data/data/####/placeholder_00001731136853047004.clean.xcrash
/data/data/####/placeholder_00001731136857908001.dirty.xcrash
/data/data/####/placeholder_00001731136857922002.clean.xcrash
/data/data/####/placeholder_00001731136857922003.dirty.xcrash
/data/data/####/placeholder_00001731136857935004.clean.xcrash
/data/data/####/proc_auxv
/data/data/####/raw_ab_data.json
/data/data/####/raw_ab_data.json.temp-1731136905120
/data/data/####/raw_config_data.json
/data/data/####/raw_config_data.json.temp-1731136888530
/data/data/####/raw_exp_ab_data.json
/data/data/####/raw_exp_ab_data.json.temp-1731136867490
/data/data/####/save_config_lock_file
/data/data/####/save_config_to_mmkv
/data/data/####/secure
/data/data/####/stat_cookie_prefs.xml
/data/data/####/storage_permission_check_com.xunmeng.pinduoduo
/data/data/####/storage_permission_check_com.xunmeng.pinduoduo;titan
/data/data/####/temp-index
/data/data/####/the-real-index
/data/data/####/thread_abcom.xunmeng.pinduoduo;titan
/data/data/####/thread_pool_size_config
/data/data/####/titan_sp
/data/data/####/upgrade_picture.png
/data/data/####/ut_sp.xml
/data/data/####/uuid_57c2e8e29c5fc71f4a02018f12e6023a
/data/data/####/uuid_eeb0e038ef93114fc3d1d44c84b32479
/data/data/####/uuid_lock
/data/data/####/version_0.12.1
/data/data/####/version_1.43.0
/data/data/####/vita-database-journal (deleted)
/data/data/####/vita_database.vlock
/data/data/####/vita_version_block_fake_info
/data/data/####/vita_version_block_info
/data/data/####/web-416061da86f89b0454b71f6f88c1497a
/data/data/####/webview_data.lock
/data/misc/####/primary.prof

Miscellaneous:

Loads the following dynamic libraries:

libANIBase
libANICore
libUserEnv
libbytehook
libc++_shared
libcrashAvoid
libmanwe-lib
libmmkv
libpcrash
libpdd_sa_hook
libpdd_secure
libpvss_tailor
libxdl

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
DES-ECB-PKCS5Padding
RSA-ECB-PKCS1Padding

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Displays its own windows over windows of other apps.

Intercepts notifications.

Requests the system alert window permission.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial