Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) ssl.a####.com.####.net:80
- TCP(TLS/1.0) 1####.250.179.170:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.250.179.170:443
- UDP 1####.217.132.136:443
DNS requests:
- airdown####.a####.com
- and####.cli####.go####.com
- and####.google####.com
- ap.ga####.com
- ap.ga####.com.####.8
- ap1.ga####.com
- ap1.ga####.com.####.8
- ap2.ga####.com
- ap2.ga####.com.####.8
- m####.go####.com
- mobi####.a####.com
- mobi####.a####.com.####.8
HTTP GET requests:
- ssl.a####.com.####.net/air?version=####&appid=####&runtimeType=####&os=#...
File system changes:
Creates the following files:
- /data/data/####/.appInfo
- /data/data/####/.hptc.cache_bius.prisrtrfgd
- /data/data/####/AirRelease_v001a001.mp3
- /data/data/####/ArmSphere_Sprite01.atf
- /data/data/####/ArmSphere_Sprite01.xml
- /data/data/####/ArmSphere_Sprite02.png
- /data/data/####/ArmSphere_Sprite02.xml
- /data/data/####/BootUpOne_v002a002.mp3
- /data/data/####/Box_Close_v001a001.mp3
- /data/data/####/Box_Open_v001a001.mp3
- /data/data/####/Bubbles_v001a002.mp3
- /data/data/####/Bung_v001a001.mp3
- /data/data/####/ChestOpen_v001a001.mp3
- /data/data/####/ClickTiny_v001a006.mp3
- /data/data/####/Click_v001a001.mp3
- /data/data/####/ClockChimeLow_v001a001.mp3
- /data/data/####/Coin_v001a001.mp3
- /data/data/####/ComputerBeeps_V001a002.mp3
- /data/data/####/ComputerBeeps_V003a002.mp3
- /data/data/####/CreakyCabinet_v001a002.mp3
- /data/data/####/CreakyDoorOne_v001a001.mp3
- /data/data/####/CreakyDoorTwo_v001a001.mp3
- /data/data/####/Drawer_One_Close_v001a002.mp3
- /data/data/####/Drawer_One_Open_v001a002.mp3
- /data/data/####/Error_v001a001.mp3
- /data/data/####/FireBall_v001a001.mp3
- /data/data/####/FourDisc_SpriteSheet_01.atf
- /data/data/####/FourDisc_SpriteSheet_01.xml
- /data/data/####/FourDisc_SpriteSheet_02.atf
- /data/data/####/FourDisc_SpriteSheet_02.xml
- /data/data/####/FridgeClose_v001a001.mp3
- /data/data/####/FridgeOpen_v001a002.mp3
- /data/data/####/Gears_v001a002.mp3
- /data/data/####/Gears_v002a001.mp3
- /data/data/####/InvenOpen_v001a001.mp3
- /data/data/####/ItemPickUp_One_v001a001.mp3
- /data/data/####/ItemPlace_v002a001.mp3
- /data/data/####/LadderOpen_v001a001.mp3
- /data/data/####/Ladder_v001a001.mp3
- /data/data/####/LargeWheelPart_01_Sprite.atf
- /data/data/####/LargeWheelPart_01_Sprite.xml
- /data/data/####/LargeWheelPart_02_Sprite.atf
- /data/data/####/LargeWheelPart_02_Sprite.xml
- /data/data/####/LockPick_v001a001.mp3
- /data/data/####/LockedDoor_One_v001a002.mp3
- /data/data/####/LockedDoor_Two_v001a001.mp3
- /data/data/####/Machine_v001a002.mp3
- /data/data/####/MailboxDoor_One_v001a001.mp3
- /data/data/####/Main.swf
- /data/data/####/MainMenu_spriteSheet_01.atf
- /data/data/####/MainMenu_spriteSheet_01.xml
- /data/data/####/MainMenu_spriteSheet_02.atf
- /data/data/####/MainMenu_spriteSheet_02.xml
- /data/data/####/MainMenu_spriteSheet_03.atf
- /data/data/####/MainMenu_spriteSheet_03.xml
- /data/data/####/Main_Theme_2013_08_18_003.mp3
- /data/data/####/Match_v001a001.mp3
- /data/data/####/MetalSteps_v001a002.mp3
- /data/data/####/Metal_Box_Close_v001a001.mp3
- /data/data/####/Metal_Box_Open_v001a001.mp3
- /data/data/####/MidWheelPart_01_Sprite.atf
- /data/data/####/MidWheelPart_01_Sprite.xml
- /data/data/####/Ohm_v001a002.mp3
- /data/data/####/PageTurn_One_v001a002.mp3
- /data/data/####/PowerUpOne_v001a001.mp3
- /data/data/####/Reset_bg.png
- /data/data/####/SplashOut_v001a001.mp3
- /data/data/####/SplashTwo_v001a001.mp3
- /data/data/####/Splash_v001a001.mp3
- /data/data/####/StarWheel_SpriteSheet_01.atf
- /data/data/####/StarWheel_SpriteSheet_01.xml
- /data/data/####/Step_One_v001a002.mp3
- /data/data/####/StoneDragHeavy_v001a001.mp3
- /data/data/####/StoneDrag_v001a001.mp3
- /data/data/####/SuccessLow_v001a001.mp3
- /data/data/####/TelescopeHill_Hint_Save.sxx
- /data/data/####/TelescopeHill_Save.sxx
- /data/data/####/TelescopeHill_Sounds_Save.sxx
- /data/data/####/ThumpOne_v001a001.mp3
- /data/data/####/Unlock_v001a001.mp3
- /data/data/####/VolButton.png
- /data/data/####/WaterBoil_v001a002.mp3
- /data/data/####/WaterFlow_v001a002.mp3
- /data/data/####/WaterPour_v001a002.mp3
- /data/data/####/antique-wall-phone.mp3
- /data/data/####/application.xml
- /data/data/####/classes.dex
- /data/data/####/classes.dex.flock (deleted)
- /data/data/####/classes.jar
- /data/data/####/com.amphibius.prisrtrfgd.AIRSharedPref.xml
- /data/data/####/curl-ca-bundle.crt
- /data/data/####/dbozieo-journal
- /data/data/####/energyPulseOne_v001a002.mp3
- /data/data/####/gong_v001a001.mp3
- /data/data/####/javaTrustStore.tmp
- /data/data/####/plate_AirCamp_v003a001.png
- /data/data/####/plate_exterior_wide_v002a006.jpg
- /data/data/####/powmThree_v001a001.mp3
- /data/data/####/powmTwo_v001a001.mp3
- /data/data/####/powm_v011a002.mp3
- /data/data/####/proc_auxv
- /data/data/####/waterdrop_001a001.mp3
- /data/data/####/windUp_One_v001a001.mp3
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/devices/system/cpu/present
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
