Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.243.origin
- Android.Hmad.1
- Android.Hmad.1.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) f####.guan####.com:7012
- TCP(HTTP/1.1) p####.apk.apt####.com:80
- TCP(HTTP/1.1) nagano-####.herok####.com:80
- TCP(TLS/1.0) a####.app####.com:443
- TCP(TLS/1.0) 1####.217.20.78:443
DNS requests:
- a####.app####.com
- api.i####.org
- e####.7####.com
- e####.h####.com
- ecup####.h####.com
- epup####.h####.com
- f####.guan####.com
- hgup####.e####.com
- hgup####.h####.com
- p####.apk.apt####.com
- ve####.ip####.com
HTTP GET requests:
- f####.guan####.com:7012/getSSPDownUrl.do?cid=####
- nagano-####.herok####.com/?format=####
- p####.apk.apt####.com/topsappsandroide/com-kwislyc-terraria-1-11148830-3...
Modified file system:
Creates the following files:
- /data/data/####/ca.zip
- /data/data/####/dfp.jar
- /data/data/####/dfx.jar
- /data/data/####/flowapp_shared.xml.xml
- /data/data/####/fp.db-journal
- /data/data/####/fpdown.db-journal
- /data/data/####/fpksp.xml
- /data/data/####/fpssp.xml
- /data/data/####/fxkit.xml
- /data/data/####/fxlock.db-journal
- /data/data/####/fxssp.xml
- /data/data/####/right_core.jar.tmp
- /data/data/####/tfp.jar (deleted)
- /data/data/####/tfx.jar
- /data/media/####/.UUID
- /data/media/####/.nomedia
- /data/media/####/FP.txt
- /data/media/####/journal.tmp
Miscellaneous:
Loads the following dynamic libraries:
- skin
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
