Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.wagbr####.ta####.####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) log.mm####.com:80
- TCP(HTTP/1.1) www.ta####.com:80
- TCP(HTTP/1.1) g.al####.com:80
- TCP(HTTP/1.1) q####.bianxia####.com:80
- TCP(HTTP/1.1) af.al####.com:80
- TCP(HTTP/1.1) wild####.al####.com.####.net:80
- TCP(HTTP/1.1) buy.bianxia####.com:80
- TCP(HTTP/1.1) acs.m.ta####.com:80
- TCP(HTTP/1.1) m.ta####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(TLS/1.0) ret####.ta####.com.####.com:443
- TCP(TLS/1.0) ad-sh-s####.wagbr####.t####.####.com:443
- TCP(TLS/1.0) sh.wagbr####.al####.com:443
- TCP(TLS/1.0) bxm-g####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) guide-w####.m.ta####.com:443
- TCP(TLS/1.0) et15-####.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) a####.wagbr####.ta####.####.com:443
- TCP(TLS/1.0) 618.t####.com:443
- TCP(TLS/1.0) af.al####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) s.c####.ta####.com:443
- TCP(TLS/1.0) zhg.ali####.com:443
- TCP(TLS/1.0) buy.bianxia####.com:443
- TCP(TLS/1.0) a####.wagbr####.t####.####.com:443
- TCP(TLS/1.0) m.ta####.com:443
- TCP(TLS/1.0) log.mm####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
DNS requests:
- 618.t####.com
- acs.m.ta####.com
- aeu.al####.com
- af.al####.com
- ai.m.ta####.com
- at.al####.com
- buy.bianxia####.com
- bxm-g####.oss-cn-####.aliy####.com
- cf.al####.com
- g.al####.com
- gm.mm####.com
- gw.al####.com
- h####.m.ta####.com
- h5.m.ta####.com
- hm.b####.com
- img.al####.com
- l####.al####.com
- log.mm####.com
- m.ta####.com
- mo.m.ta####.com
- mos.m.ta####.com
- mt####.go####.com
- p.t####.com
- phs.t####.com
- q####.bianxia####.com
- ret####.ta####.com
- s.c####.t####.com
- s.c####.ta####.com
- u####.ta####.com
- wgo.mm####.com
- www.ta####.com
- y####.al####.com
- y####.al####.org
HTTP GET requests:
- a####.wagbr####.ta####.####.com/coupon/edetail?activityId=####&itemId=##...
- acs.m.ta####.com/h5/mtop.alimama.union.hsf.coupon.get/1.0/?jsv=####&appK...
- af.al####.com/js/cj/107.js
- buy.bianxia####.com/?appKey=####&appType=####&appEntrance=####
- g.al####.com/??mtb/li####
- g.al####.com/alilog/??s/8.4.5/plugin/aplus_client.js,aplus_cplugin/0.4.1...
- g.al####.com/alilog/mlog/aplus_wap.js
- g.al####.com/cell/lib-clip/0.0.1/index.js
- g.al####.com/dt/tracker/3.4.0/tracker.Tracker.js
- g.al####.com/mm/atb/2016.09.08/??compone####
- g.al####.com/mm/sem-centre/0.10.2/ticket/index.css
- g.al####.com/mm/sem-centre/0.10.5/ticket/index.js
- g.al####.com/mtb/lib-smartbanner-plus-loader/smartbanner-loader.js?t=####
- g.al####.com/mtb/lib-smb-wake/0.0.49/wake.js
- g.al####.com/security/umscript/3.3.28/um.js
- g.al####.com/thx/cube/1.2.1/neat-min.css
- gm.mm####.com/sb.sbp.action?cache=####&gmkey=####&gokey=p####&smbSid=###...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=928&ep=3184,2220&e...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=928&ep=7086,6140&e...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=928&ep={"netAll":0...
- hm.b####.com/hm.gif?cc=0&ck=1&cl=16-bit&ds=600x800&vl=928&et=0&ja=0&ln=e...
- hm.b####.com/hm.js?a427d04####
- log.mm####.com/eg.js
- m.ta####.com/?sprefer=####
- q####.bianxia####.com/h5/img/placeholder.png
- q####.bianxia####.com/h5/js/dropload.js
- q####.bianxia####.com/img/dailysave/finBar.png
- q####.bianxia####.com/img/dailysave/priceBg.png
- q####.bianxia####.com/img/dailysave/redCoupon.png
- q####.bianxia####.com/img/dailysave/style.css
- q####.bianxia####.com/js/jquery-2.1.1.min.js
- q####.bianxia####.com/js/jquery.lazyload.min.js
- q####.bianxia####.com/share/dailysave?bd=####&appKey=####
- wild####.al####.com.####.net/imgextra/i1/2904493430/TB2po14c_qWBKNjSZFxX...
- wild####.al####.com.####.net/imgextra/i1/2934115485/TB2OuBdd7CWBuNjy0FaX...
- wild####.al####.com.####.net/imgextra/i1/3109208124/TB1wokda8yWBuNkSmFPX...
- wild####.al####.com.####.net/imgextra/i1/3698261590/TB2TQtMsCBYBeNjy0FeX...
- wild####.al####.com.####.net/imgextra/i3/469706938/TB2DvidosnI8KJjSspeXX...
- wild####.al####.com.####.net/imgextra/i3/684063648/TB2NFuJbTCWBKNjSZFtXX...
- wild####.al####.com.####.net/imgextra/i4/2250820488/TB2YLTPdP7nBKNjSZLeX...
- wild####.al####.com.####.net/imgextra/i4/2455434531/TB26zFJcN1YBuNjy1zcX...
- wild####.al####.com.####.net/imgextra/i4/2858168799/TB2Iwunz9FmpuFjSZFrX...
- wild####.al####.com.####.net/imgextra/i4/2994047523/TB2tTVfkOCYBuNkHFCcX...
- wild####.al####.com.####.net/imgextra/i4/3843582030/TB2Uzetf5AnBKNjSZFvX...
- wild####.al####.com.####.net/imgextra/i4/3851020297/TB2Tpijo79WBuNjSspeX...
- wild####.al####.com.####.net/imgextra/i4/747069567/TB2FtahbAKWBuNjy1zjXX...
- www.ta####.com/
Modified file system:
Creates the following files:
- /data/data/####/WebViewSettings.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/index
- /data/data/####/mxlub
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- mxlub
Displays its own windows over windows of other applications.
