Adware.Kyview.207

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Kyview.1.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) api.to####.today:8883
TCP(HTTP/1.1) pay.h####.com:8860
TCP(HTTP/1.1) apic####.mob.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) c.g####.qq.com:80
TCP(HTTP/1.1) v.g####.qq.com:80
TCP(HTTP/1.1) bmob-cd####.b0.upa####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(TLS/1.0) 3####.tc.qq.com:443

DNS requests:

a####.u####.com
and####.b####.qq.com
api.to####.today
apic####.mob.com
bmob-cd####.b0.upa####.com
c.g####.qq.com
imgc####.qq.com
mi.g####.qq.com
oc.u####.com
p####.ugd####.com
pay.h####.com
qzones####.g####.cn
s####.e.qq.com
s.b####.m####.com
v.g####.qq.com

HTTP GET requests:

apic####.mob.com/v1/weather/query?key=####&city=####
bmob-cd####.b0.upa####.com/2017/10/30/589fab3e40e8d9cb8031ab3e6539fb75.jpg
c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
s####.tc.qq.com/gdt/0/DAAidTWAQ4AeAABgBcgOAhDOFKMJRg.jpg/0?ck=####
s####.tc.qq.com/gdt/0/DAAiiAjAQ4AeAAB3Bb5j-6CJdlbvxR.jpg/0?ck=####
s####.tc.qq.com/gdt/0/transformer_16688033349592119752_1552007163_80.jpg...
s####.tc.qq.com/gdt/0/transformer_16688033349592119752_1552007173_80.jpg...
s####.tc.qq.com/gdt/0/transformer_17176376324627418588_1551868690_80.jpg...
v.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&gap=####

HTTP POST requests:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async
and####.b####.qq.com/rqd/async?aid=####
api.to####.today:8883/v2/statistics
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
pay.h####.com:8860/pay/update
s####.e.qq.com/activate
s####.e.qq.com/msg

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/1002
/data/data/####/1004
/data/data/####/4b138b40314b203dbeaedd028020369c.temp
/data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
/data/data/####/73c563a7e37f2bb0c6c488b85554a366.temp
/data/data/####/80925becd19f2aafc78632a4d72ec6c2.temp
/data/data/####/816765344.dex
/data/data/####/816765344.z
/data/data/####/83624088c2c2b25f44b911eec93c9638.temp
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/SP.xml
/data/data/####/Test.xml
/data/data/####/bdbb0915c6462cc041b4111201df3fdd.temp
/data/data/####/bmob_sp.xml
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_legu-journal
/data/data/####/c
/data/data/####/cache
/data/data/####/com.chenghui.study.c.BETA_VALUES.xml
/data/data/####/com.chenghui.study.c.BETA_VALUES.xml.bak
/data/data/####/crashrecord.xml
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/exchangeIdentity.json
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/ij.dex
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.5.7.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/mobclick_agent_cached_com.chenghui.study.c1033
/data/data/####/mobclick_agent_user_com.chenghui.study.c.xml
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/onlineconfig_agent_online_setting_com.chenghui.study.c.xml
/data/data/####/p.dex
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/security_info
/data/data/####/um_cache_1552080363478.env
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/update_lc
/data/data/####/user_info.txt
/data/data/####/user_info.txt-journal
/data/data/####/user_info.txt-journal (deleted)
/data/media/####/.nomedia
/data/media/####/comchenghuistudyc_4.8.6_622956a9-85a6-53c2-8ee...cc.apk

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.5.7.so
chmod 700 <Package Folder>/tx_shell/libufix.so
chmod 777 /storage/emulated/0/Download/<Package>/.beta/apk/comchenghuistudyc_4.8.6_622956a9-85a6-53c2-8eec-898b23aeafcc.apk
getprop
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime