Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.611.origin
Downloads the following detected threats from the Web:
- Android.Triada.428.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) v3.bule####.cn:7001
- TCP(HTTP/1.1) cdn.sl####.com.####.com:80
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) dn.gogo####.top:80
- TCP(HTTP/1.1) dn.tc####.com:80
- TCP(HTTP/1.1) f####.ma####.xi####.####.net:80
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(TLS/1.0) sdkco####.ad.xi####.com:443
- TCP(TLS/1.0) d####.g####.xi####.com:443
- TCP(TLS/1.0) z####.ad.xi####.com:443
DNS requests:
- cdn.sl####.com
- d####.g####.xi####.com
- dn.gogo####.top
- dn.tc####.com
- f####.ma####.xi####.com
- f1.ma####.xi####.com
- f4.ma####.xi####.com
- int.d####.s####.####.cn
- sdkco####.ad.xi####.com
- v3.bule####.cn
- w####.pcon####.com.cn
- z####.ad.xi####.com
HTTP GET requests:
- cdn.sl####.com.####.com/unitedpay_sdk/version
- dn.gogo####.top/dnfile/mp4/qqdzz3.mp4
- dn.gogo####.top/dnfile/shengjibao/kernelNoYi0615_83.jar
- dn.tc####.com/dnfile/image/qqdzz/1280-720-4.jpg
- dn.tc####.com/dnfile/image/qqdzz/720-1280-3.jpg
- f####.ma####.xi####.####.net/download/AdCenter/06245f583f7ae480e1123dd27...
- f####.ma####.xi####.####.net/download/AdCenter/07ed056dbdaa49aedaaecc182...
HTTP POST requests:
- int.d####.s####.####.cn/iplookup/iplookup.php?format=####
- v3.bule####.cn:7001/v3/api_request.aspx
- v3.bule####.cn:7001/v3/api_settings.aspx
- v3.bule####.cn:7001/verrlog.aspx
- w####.pcon####.com.cn/ip.jsp
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/64694657bff9c6cd.jar
- /data/data/####/VideoRes.apk
- /data/data/####/_m_rec.xml
- /data/data/####/abf2e77045ca50ae.jar
- /data/data/####/analytics.apk.tmp
- /data/data/####/analytics_api.xml
- /data/data/####/analytics_updater.xml
- /data/data/####/bd34609e91ef96a6.jar
- /data/data/####/codex.so
- /data/data/####/config.xml
- /data/data/####/efe725a6d048332a.jar
- /data/data/####/id6908d52a-971e-45f7-929e-0c33ef5257a7.tmp
- /data/data/####/lmvideonewad_db-journal
- /data/data/####/mimo_download.apk.tmp
- /data/data/####/plugin_updater.xml
- /data/data/####/videokernel.apk
- /data/data/####/webview.db-journal
- /data/data/####/zeus_crash_info.xml
- /data/data/####/zeus_pms.xml
- /data/media/####/-628469195
- /data/media/####/.nomedia
- /data/media/####/814369926
- /data/media/####/Videoshell.log
- /data/media/####/id16f2e90e6-e00c-41b3-86e2-d9496c39a267.tmp
- /data/media/####/id182a6c2a6-da17-49be-a8df-c867ebe7a298.tmp
- /data/media/####/id200b4a06f-7549-47b5-810f-186c9b78691a.tmp
- /data/media/####/id28bd9a9e2-77b1-4b47-b6ff-57fcb0a9ccae.tmp
- /data/media/####/kernel.dat
Miscellaneous:
Executes next shell scripts:
- cat /sys/class/net/wlan0/address
Loads the following dynamic libraries:
- _lemuel_security
- cocos2djs
- codex
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
