Adware.Plague.3431

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Plague.1.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 2####.30.114.54:80
TCP(TLS/1.0) us.g####.sina####.com:443
TCP(TLS/1.0) b####.b0.a####.com:443

DNS requests:

ap.ga####.com
ap1.ga####.com
ap2.ga####.com
d5.l####.cn
i1.bao####.com

File system changes:

Creates the following files:

/data/data/####/classes.jar
/data/data/####/dbzozhs-journal
/data/data/####/setting.db
/data/data/####/setting.db-journal
/data/media/####/.nomedia
/data/media/####/1126b43e6baeb76e5887835114b1e56a1d6
/data/media/####/1126b43e6baeb76e5887835114b1e56a1d6.png
/data/media/####/1258e465e796a85250b836a3a52df1dbdc19
/data/media/####/1258e465e796a85250b836a3a52df1dbdc19.jpg
/data/media/####/14252f92b343f8c24bb8a17f25fdc092d531
/data/media/####/14252f92b343f8c24bb8a17f25fdc092d531.jpg
/data/media/####/1447422f77e50f6578a220ec3e4d962f710b
/data/media/####/1447422f77e50f6578a220ec3e4d962f710b.png
/data/media/####/16853f6
/data/media/####/16853f6.png
/data/media/####/18777be96edc74b30a7668fe7085405e9c9c
/data/media/####/18777be96edc74b30a7668fe7085405e9c9c.png
/data/media/####/2377879ddbf
/data/media/####/2377879ddbf.png
/data/media/####/241850
/data/media/####/241850.png
/data/media/####/24240cf921dc13df483627b8619c98a7a3a9
/data/media/####/24240cf921dc13df483627b8619c98a7a3a9.jpg
/data/media/####/2496a0d081f753d6e8e086ef57da403ec91f
/data/media/####/2496a0d081f753d6e8e086ef57da403ec91f.jpg
/data/media/####/25176e1f4102ec6e46da49eb31dd68f25296
/data/media/####/25176e1f4102ec6e46da49eb31dd68f25296.jpg
/data/media/####/274290eb31481ed1c841a469385598d69225
/data/media/####/274290eb31481ed1c841a469385598d69225.jpg
/data/media/####/290865beb82152f6a960763fe5a3f3d76374
/data/media/####/290865beb82152f6a960763fe5a3f3d76374.png
/data/media/####/29994960f75a51a70d3a2a224623a41ef65
/data/media/####/29994960f75a51a70d3a2a224623a41ef65.jpg
/data/media/####/3005d2ba19a375c2f2f3b4d5875a56678dd0
/data/media/####/3005d2ba19a375c2f2f3b4d5875a56678dd0.jpg
/data/media/####/3424ed9fcaf581e217367749a745e7c32153
/data/media/####/3424ed9fcaf581e217367749a745e7c32153.jpg
/data/media/####/369052d7135805d79d83dd38be133ea697af
/data/media/####/369052d7135805d79d83dd38be133ea697af.jpg
/data/media/####/4228e74e4a659a936bd0ed
/data/media/####/4228e74e4a659a936bd0ed.png
/data/media/####/45785d74e822bed43995bf17324596a615cf
/data/media/####/45785d74e822bed43995bf17324596a615cf.png
/data/media/####/46606d9eeae9f12fc2a566b1302968bd49e3
/data/media/####/46606d9eeae9f12fc2a566b1302968bd49e3.png
/data/media/####/4798609398c106eb2fc781e89f12b25dfb80
/data/media/####/4798609398c106eb2fc781e89f12b25dfb80.jpg
/data/media/####/5232a329ba7692524220c0
/data/media/####/5232a329ba7692524220c0.png
/data/media/####/5320abc866
/data/media/####/5320abc866.png
/data/media/####/53669
/data/media/####/537123a81b9c49d873000f220bb2c8eb7000
/data/media/####/537123a81b9c49d873000f220bb2c8eb7000.png
/data/media/####/562605484d4764725beba1afb35b066e9725
/data/media/####/562605484d4764725beba1afb35b066e9725.jpg
/data/media/####/56545bbb5f495f191393801806595c700f8b
/data/media/####/56545bbb5f495f191393801806595c700f8b.jpg
/data/media/####/5669f21263703b8a542e19ff08f199f04551
/data/media/####/5669f21263703b8a542e19ff08f199f04551.jpg
/data/media/####/6436afbe57e9de47e2f9981ee40bab0ec47c
/data/media/####/6436afbe57e9de47e2f9981ee40bab0ec47c.jpg
/data/media/####/64492619401ab526471058fbd65a73b8bbe9
/data/media/####/64492619401ab526471058fbd65a73b8bbe9.png
/data/media/####/6874754f91d64eb9805734088ddbe796efd5
/data/media/####/6874754f91d64eb9805734088ddbe796efd5.png
/data/media/####/7241f8b6cbd9d19fc36
/data/media/####/7241f8b6cbd9d19fc36.png
/data/media/####/72503c67d7ab3c2390d
/data/media/####/72503c67d7ab3c2390d.jpg
/data/media/####/733927717a90a5cf37a5c1e5d456bc546a28
/data/media/####/733927717a90a5cf37a5c1e5d456bc546a28.png
/data/media/####/7513c21993b8cb44664f89efae76af425053
/data/media/####/7513c21993b8cb44664f89efae76af425053.png
/data/media/####/7762553a1d1d07eb05f0ba4eab57b810b298
/data/media/####/7762553a1d1d07eb05f0ba4eab57b810b298.png
/data/media/####/77669d50b122aef0af954db6a125c3f5665a
/data/media/####/77669d50b122aef0af954db6a125c3f5665a.jpg
/data/media/####/77807b6466daecae7d874e0d39d443f8c944
/data/media/####/77807b6466daecae7d874e0d39d443f8c944.png
/data/media/####/79686c2bc0ede54027239f44b49fc6b9c8e1
/data/media/####/79686c2bc0ede54027239f44b49fc6b9c8e1.png
/data/media/####/8636b39e2c159fe1f924e352510cac5f6ad7
/data/media/####/8636b39e2c159fe1f924e352510cac5f6ad7.png
/data/media/####/91564ff0c8eeb77023ed7a27215acc4e7d93
/data/media/####/91564ff0c8eeb77023ed7a27215acc4e7d93.jpg
/data/media/####/9214bd51101ac38075de5c29e93ade827f0
/data/media/####/9214bd51101ac38075de5c29e93ade827f0.png
/data/media/####/9417ba077ee3a1a2ac93601a0bd950a79859
/data/media/####/9417ba077ee3a1a2ac93601a0bd950a79859.jpg
/data/media/####/944189e
/data/media/####/944189e.png
/data/media/####/96969ceeee78807915c384d0a9ac81edf912
/data/media/####/96969ceeee78807915c384d0a9ac81edf912.jpg
/data/media/####/9802a16330ec747fc33f140917f72e76887c
/data/media/####/9802a16330ec747fc33f140917f72e76887c.jpg
/data/media/####/984106459a8cf4b19
/data/media/####/984106459a8cf4b19.jpg
/data/media/####/baoruan.com_73326ebd1ab7b2e41de2a342a63d930d3c55
/data/media/####/baoruan.com_73326ebd1ab7b2e41de2a342a63d930d3c55.jpg
/data/media/####/哔哩哔哩动画
/data/media/####/哔哩哔哩动画.apk
/data/media/####/开心消消乐
/data/media/####/火柴人联盟

Miscellaneous:

Executes the following shell scripts:

chmod 777 /storage/emulated/0/baoruan_download/shangcheng/livewallpaperApk/ .apk
chmod 777 /storage/emulated/0/baoruan_download/shangcheng/livewallpaperApk/ .apk
chmod 777 /storage/emulated/0/baoruan_download/shangcheng/livewallpaperApk/哔哩哔哩动画.apk
chmod 777 /storage/emulated/0/baoruan_download/shangcheng/livewallpaperApk/火柴人联盟.apk

Uses the following algorithms to encrypt data: