Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) img.zwka####.com:80
- TCP(HTTP/1.1) api.h####.top:9000
- TCP(HTTP/1.1) b####.bianxia####.com:80
- TCP(HTTP/1.1) f####.bianxia####.com:80
- TCP(HTTP/1.1) book####.bianxia####.com:80
- TCP(TLS/1.0) o####.w####.cn:443
- TCP(TLS/1.0) cdn.ika####.cn.####.com:443
- TCP(TLS/1.0) buy.bianxia####.com:443
- TCP(TLS/1.0) s####.tc.qq.com:443
DNS requests:
- api.h####.top
- b####.bianxia####.com
- book####.bianxia####.com
- buy.bianxia####.com
- cdn.ika####.cn
- f####.bianxia####.com
- img.zwka####.com
- o####.w####.cn
- r####.wx.qq.com
HTTP GET requests:
- api.h####.top:9000/api/channel/cfg?ipv4=####&model=####&os_ver=####&vend...
- b####.bianxia####.com/api/service/wread_visitrecord.aspx?url=http://book...
- b####.bianxia####.com/images/wread/icon_arrow_down_1.png
- b####.bianxia####.com/images/wread/icon_arrow_left_b.png
- b####.bianxia####.com/images/wread/icon_arrow_left_w.png
- b####.bianxia####.com/images/wread/icon_arrow_right_c.png
- b####.bianxia####.com/images/wread/icon_author_1.png
- b####.bianxia####.com/images/wread/icon_author_2.png
- b####.bianxia####.com/images/wread/icon_author_3.png
- b####.bianxia####.com/images/wread/icon_catalog.png
- b####.bianxia####.com/images/wread/icon_footnav_jingpin0.png
- b####.bianxia####.com/images/wread/icon_footnav_jingpin1.png
- b####.bianxia####.com/images/wread/icon_footnav_shujia0.png
- b####.bianxia####.com/images/wread/icon_footnav_sousuo0.png
- b####.bianxia####.com/images/wread/icon_footnav_wode0.png
- b####.bianxia####.com/images/wread/icon_head_wode.png
- b####.bianxia####.com/images/wread/icon_head_wode_w.png
- b####.bianxia####.com/images/wread/icon_hotread.png
- b####.bianxia####.com/images/wread/icon_line_h1.png
- b####.bianxia####.com/images/wread/icon_menu_catalog_1.png
- b####.bianxia####.com/images/wread/icon_menu_home_1.png
- b####.bianxia####.com/images/wread/icon_menu_next_1.png
- b####.bianxia####.com/images/wread/icon_menu_night_1.png
- b####.bianxia####.com/images/wread/icon_menu_pre_1.png
- b####.bianxia####.com/images/wread/icon_menu_setting_1.png
- b####.bianxia####.com/images/wread/icon_refresh_2.png
- b####.bianxia####.com/images/wread/icon_search.png
- b####.bianxia####.com/images/wread/icon_title_left.png
- b####.bianxia####.com/images/wread/icon_title_right.png
- b####.bianxia####.com/js/core/template-native.js
- b####.bianxia####.com/js/core/zepto.fx.js?v=####
- b####.bianxia####.com/js/core/zepto.min.js?v=####
- b####.bianxia####.com/js/core/zepto.touch.js?v=####
- b####.bianxia####.com/json/bookshow_json.aspx?bookid=####
- b####.bianxia####.com/json/contentshow_json.aspx?bookid=####&index=####&...
- b####.bianxia####.com/json/hotbook_json.aspx?cid=####
- b####.bianxia####.com/json/searchbook_json.aspx?key=####
- b####.bianxia####.com/json/user/default_json.aspx
- b####.bianxia####.com/json/user/mybookmark_act_json.aspx?act=####&bookid...
- b####.bianxia####.com/json/zhuanti_json.aspx?zid=####&pdid=####&listcoun...
- b####.bianxia####.com/user/login_bxm.aspx?url=/book.bianxianmao.com/wrea...
- b####.bianxia####.com/wread/bxmread.htm?appType=####
- book####.bianxia####.com/redirect.htm?appKey=####&appType=####&appEntran...
- book####.bianxia####.com/static/css/global.css?v=####
- book####.bianxia####.com/static/css/iconfont.css
- book####.bianxia####.com/static/css/sm-extend.min.css
- book####.bianxia####.com/static/css/sm.min.css
- book####.bianxia####.com/static/js/bxmplatform.js
- book####.bianxia####.com/static/js/index.js?v=####
- book####.bianxia####.com/static/js/sm-extend.min.js
- book####.bianxia####.com/static/js/sm.min.js
- book####.bianxia####.com/static/js/zepto.min.js
- f####.bianxia####.com/image/book/qq.png
- f####.bianxia####.com/image/book/wb.png
- f####.bianxia####.com/image/book/wx.png
- img.zwka####.com/images/icon_gotop.png
- img.zwka####.com/images/icon_loading.gif
- img.zwka####.com/images/logo_bianxianmao1.png
Modified file system:
Creates the following files:
- /data/data/####/afe2d68942819225fd58d7d12223e2e1.0.tmp
- /data/data/####/afe2d68942819225fd58d7d12223e2e1.1.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/index
- /data/data/####/journal.tmp
- /data/data/####/lywov
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- lywov
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
