Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) box.jom####.com:80
- TCP(HTTP/1.1) www.a.sh####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) www.ta####.com:80
- TCP(HTTP/1.1) h5.m.ta####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) v.qq.com.####.net:80
- TCP(HTTP/1.1) lish####.ho####.vip:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) jq####.tc.qq.com:80
- TCP(HTTP/1.1) hpd.b####.com:80
- TCP(HTTP/1.1) c####.z####.net:80
- TCP(HTTP/1.1) m.i####.ta####.com:80
- TCP(HTTP/1.1) gd.y####.com:80
- TCP(HTTP/1.1) www.h####.com:8092
- TCP(HTTP/1.1) www.w####.cn:80
- TCP(HTTP/1.1) www.8####.cn:80
- TCP(HTTP/1.1) r####.v####.qq.com:80
- TCP(HTTP/1.1) n####.o####.qq.com:80
- TCP(HTTP/1.1) na0.bdst####.com.####.com:80
- TCP(HTTP/1.1) m.ta####.com:80
- TCP(HTTP/1.1) supermo####.jom####.com:80
- TCP(HTTP/1.1) m.t####.com.####.com:80
- TCP(TLS/1.0) sslb####.jom####.com:443
- TCP(TLS/1.0) a####.w####.tv:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) vol.t####.cn:8136
- TCP(TLS/1.0) box.jom####.com:443
- TCP(TLS/1.0) at.al####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) mbd.n.sh####.com:443
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) collect####.w####.cn:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) ti####.jom####.com:443
- TCP(TLS/1.0) wn.pos.b####.com:443
- TCP(TLS/1.0) guide-w####.m.ta####.com:443
- TCP(TLS/1.0) www.w####.cn:443
- TCP(TLS/1.0) s.w####.cn:443
- TCP(TLS/1.0) hpd.b####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.adverti####.####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) h5.m.ta####.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) s.w####.tv:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) v.qq.com.####.net:443
- TCP(TLS/1.0) na0.bdst####.com.####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.a.sh####.com:443
- TCP(TLS/1.0) m.ta####.com:443
- TCP(TLS/1.0) m.i####.ta####.com:443
- TCP(TLS/1.0) s.c####.ta####.com:443
- TCP(TLS/1.0) g####.bdst####.com:443
- TCP(TLS/1.0) g.al####.com:443
- TCP(TLS/1.0) l####.ta####.com.####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
- TCP(TLS/1.0) log.mm####.com:443
DNS requests:
- a####.w####.tv
- and####.cli####.go####.com
- at.al####.com
- c####.baidust####.com
- c####.baidust####.com
- c####.mm####.com
- c####.z####.net
- c.c####.com
- collect####.w####.cn
- de####.m.t####.com
- ext.b####.com
- f####.b####.com
- g####.bdst####.com
- g.al####.com
- gd.y####.com
- gm.mm####.com
- h####.c####.com
- h####.m.ta####.com
- h5.m.ta####.com
- hm.b####.com
- hpd.b####.com
- img.al####.com
- imgc####.g####.cn
- j####.qq.com
- j####.qq.com
- l####.ta####.com
- lish####.ho####.vip
- log.mm####.com
- m.b####.com
- m.i####.ta####.com
- m.t####.com
- m.ta####.com
- m.v.q####.com
- n####.o####.qq.com
- na0.bdst####.com
- ocser####.ta####.com
- p####.q####.cn
- pag####.googles####.com
- pi####.qq.com
- pin####.qq.com
- ping####.qq.com
- pos.b####.com
- q####.qq.com
- r####.v####.qq.com
- s.bdst####.com
- s.c####.t####.com
- s.c####.ta####.com
- s.w####.cn
- s.w####.tv
- s13.c####.com
- s9.c####.com
- sm.b####.com
- ss0.b####.com
- ss1.b####.com
- ss2.b####.com
- sv.bdst####.com
- ti####.b####.com
- timg####.b####.com
- timg####.b####.com
- timg####.b####.com
- timg####.b####.com
- timg####.b####.com
- v.q####.com
- vm.g####.cn
- vol.t####.cn
- wgo.mm####.com
- wn.pos.b####.com
- www.8####.cn
- www.b####.com
- www.h####.com
- www.ta####.com
- www.w####.cn
- z7.c####.com
HTTP GET requests:
- box.jom####.com/common/openjs/openBox.js?_v=####
- c####.z####.net/v.js?EEtxcM2LElQENcfDxS+URWl7Ooj3x7umxcvHXPtON84=####
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&web_id=####
- gd.y####.com/Code/cpcv.php?u=####&t=####
- h5.m.ta####.com/?sprefer=####
- hpd.b####.com/v.gif?tid=####&ct=####&cst=####&logFrom=####&logInfo=####&...
- jq####.tc.qq.com/cdn_dianjiliu.js?a=####
- lish####.ho####.vip/
- lish####.ho####.vip/images/10.jpg
- lish####.ho####.vip/images/11.jpg
- lish####.ho####.vip/images/12.jpg
- lish####.ho####.vip/images/13.jpg
- lish####.ho####.vip/images/14.jpg
- lish####.ho####.vip/images/15.jpg
- lish####.ho####.vip/images/16.jpg
- lish####.ho####.vip/images/17.jpg
- lish####.ho####.vip/images/18.jpg
- lish####.ho####.vip/images/19.jpg
- lish####.ho####.vip/images/20.jpg
- lish####.ho####.vip/images/21.jpg
- lish####.ho####.vip/images/22.jpg
- lish####.ho####.vip/images/8.png
- lish####.ho####.vip/images/9.jpg
- lish####.ho####.vip/images/favicon.ico
- lish####.ho####.vip/images/loading.gif
- lish####.ho####.vip/index.html
- lish####.ho####.vip/js/jquery.js
- lish####.ho####.vip/meitu.html
- lish####.ho####.vip/mobile/css/style.css
- lish####.ho####.vip/mobile/images/sprite.png
- lish####.ho####.vip/mobile/images/tj/1.jpg
- lish####.ho####.vip/mobile/images/tj/2.jpg
- lish####.ho####.vip/mobile/images/tj/3.jpg
- lish####.ho####.vip/mobile/images/tj/4.jpg
- lish####.ho####.vip/mobile/images/tj/5.jpg
- lish####.ho####.vip/mobile/images/tj/6.jpg
- lish####.ho####.vip/mobile/images/tj/7.jpg
- lish####.ho####.vip/mobile/js/common.js
- lish####.ho####.vip/mobile/js/jquery.masonry.min.js
- lish####.ho####.vip/mobile/js/load.js
- m.i####.ta####.com/detail/detail.html?id=####&ali_trackid=####&pvid=####...
- m.t####.com.####.com/hao/2.gif
- m.ta####.com/?sprefer=####
- n####.o####.qq.com/video/getVideoIntroduction.php?type=####
- na0.bdst####.com.####.com/static/cover/static/shoubaiWapAds/nativeAds_8a...
- p####.tc.qq.com/tencentvideo_v1/vstyle/mobile/v2/style/img/common/pic_h....
- p####.tc.qq.com/tencentwap/script/txmv.base.simplify_v3.js?v=####&max_ag...
- ping####.qq.com/pingd?dm=####&url=####&hottag=####&hotx=####&hoty=####&r...
- ping####.qq.com/pingd?dm=####&url=####&rdm=####&rurl=####&rarg=####&pvid...
- r####.v####.qq.com/pv_report?refer=####&ptag=####&itype=####&str1=####&s...
- s####.tc.qq.com/cdn_djl.js
- s####.tc.qq.com/favicon.ico
- s####.tc.qq.com/index.html?ptag=####&
- s####.tc.qq.com/tcss.ping.js
- supermo####.jom####.com/static/wiseindex/amd_modules/@searchfe/assert/in...
- supermo####.jom####.com/static/wiseindex/amd_modules/@searchfe/assert_e6...
- supermo####.jom####.com/static/wiseindex/amd_modules/@searchfe/promise/s...
- supermo####.jom####.com/static/wiseindex/amd_modules/@searchfe/promise_e...
- supermo####.jom####.com/static/wiseindex/amd_modules/@searchfe/underscor...
- supermo####.jom####.com/static/wiseindex/amd_modules/@searchfe/user-agen...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/action...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/config...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/dispat...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/doc_d8...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/index_...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/lang/m...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/resour...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/router...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/servic...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/transi...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir/src/utils/...
- supermo####.jom####.com/static/wiseindex/amd_modules/ralltiir_d136210.js
- supermo####.jom####.com/static/wiseindex/iconfont/iconfont_2681c2d.ttf
- supermo####.jom####.com/static/wiseindex/img/baiduappAdClose2_487e9e9.png
- supermo####.jom####.com/static/wiseindex/img/baiduappLogo_603e1ff.png
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/component/backgro...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/component/btmBann...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/component/dialog_...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/component/firstCa...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/fnProvider_6015d1...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/invokeBox_1b7c9e6...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/invokeSecr_13c5fe...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/serverDataFactory...
- supermo####.jom####.com/static/wiseindex/js/lib/invoke/setInvokeCookie_b...
- supermo####.jom####.com/static/wiseindex/js/package/newsActivity_366b387...
- supermo####.jom####.com/static/wiseindex/js/package/superframe_5b7bdae.js
- supermo####.jom####.com/static/wiseindex/js/plugin/baiduappButton_83b553...
- supermo####.jom####.com/static/wiseindex/js/plugin/safariicon_6bd009a.js
- v.qq.com.####.net/p/hollywood/search_keyword.json
- v.qq.com.####.net/tencentvideo/vstyle/mobile/v2/style/img/common/icon_ba...
- v.qq.com.####.net/tencentvideo/vstyle/mobile/v2/style/img/common/imghold...
- v.qq.com.####.net/tencentvideo/vstyle/mobile/v2/style/img/logo_black.svg
- v.qq.com.####.net/tencentvideo/vstyle/mobile/v2/style/index_v3.css?v=###...
- v.qq.com.####.net/tv/0/30773465_498280/0
- v.qq.com.####.net/tv/0/30818428_498280/0
- v.qq.com.####.net/tv/0/30818903_1080607/0
- v.qq.com.####.net/tv/0/30831004_498280/0
- v.qq.com.####.net/tv/0/30875146_498280/0
- v.qq.com.####.net/tv/0/30877614_498280/0
- www.8####.cn//images/close.png
- www.8####.cn/a/2018-07-30/15329640405850.jpg
- www.8####.cn/c.php?s=Jnpvb####&p=####
- www.8####.cn/c.php?s=Jnpvb####&p=aj0wJ####
- www.8####.cn/images/b-3.png
- www.8####.cn/vs.php?id=####
- www.a.sh####.com/
- www.a.sh####.com/?action=####&ms=####&version=####&callback=####&r=####&...
- www.a.sh####.com/?action=####&sid=####&ssid=####&from=####&pu=####&qid=#...
- www.a.sh####.com/his?callback=####&type=####&pic=####&lid=####&ishome=##...
- www.a.sh####.com/se/static/img/iphone/logo.png
- www.a.sh####.com/se/static/img/iphone/tab_loading__bg_logo.png
- www.a.sh####.com/se/static/js/bundles/ala-util_4d03c97.js
- www.a.sh####.com/se/static/js/bundles/atom_9c4f39b.js
- www.a.sh####.com/se/static/js/service/index_polymer_b8e99cc.js
- www.a.sh####.com/se/static/js/service/index_seloader_release.js?v=####
- www.a.sh####.com/static/index/plus/public/icon_police.png
- www.a.sh####.com/static/index/plus/public/tab_news.png
- www.a.sh####.com/static/search/clear.png
- www.a.sh####.com/static/tj.gif?time=####
- www.a.sh####.com/tc?tcreq4log=####&r=####&logid=####&from=####&pu=####&c...
- www.a.sh####.com/tcbox?service=####&action=####&ctv=####&cen=####&data={...
- www.h####.com:8092//images/b-1.png
- www.h####.com:8092//images/close.png
- www.h####.com:8092/images/b-3.png
- www.h####.com:8092/vs.php?id=####
- www.ta####.com/
- www.w####.cn/
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/CachedGeoposition.db
- /data/data/####/CachedGeoposition.db-journal
- /data/data/####/GeolocationPermissions.db-journal
- /data/data/####/WebpageIcons.db
- /data/data/####/WebpageIcons.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/f_00003c
- /data/data/####/f_00003d
- /data/data/####/f_00003e
- /data/data/####/f_00003f
- /data/data/####/f_000040
- /data/data/####/f_000041
- /data/data/####/f_000042
- /data/data/####/f_000043
- /data/data/####/f_000044
- /data/data/####/f_000045
- /data/data/####/f_000046
- /data/data/####/f_000047
- /data/data/####/f_000048
- /data/data/####/f_000049
- /data/data/####/f_00004a
- /data/data/####/f_00004b
- /data/data/####/f_00004c
- /data/data/####/f_00004d
- /data/data/####/f_00004e
- /data/data/####/f_00004f
- /data/data/####/f_000050
- /data/data/####/f_000051
- /data/data/####/f_000052
- /data/data/####/f_000053
- /data/data/####/f_000054
- /data/data/####/f_000055
- /data/data/####/f_000056
- /data/data/####/f_000057
- /data/data/####/f_000058
- /data/data/####/f_000059
- /data/data/####/f_00005a
- /data/data/####/f_00005b
- /data/data/####/f_00005c
- /data/data/####/f_00005d
- /data/data/####/f_00005e
- /data/data/####/f_00005f
- /data/data/####/f_000060
- /data/data/####/f_000061
- /data/data/####/f_000062
- /data/data/####/f_000063
- /data/data/####/f_000064
- /data/data/####/f_000065
- /data/data/####/f_000066
- /data/data/####/http_www.baidu.com_0.localstorage-journal
- /data/data/####/https_m.baidu.com_0.localstorage-journal
- /data/data/####/https_m.intl.taobao.com_0.localstorage-journal
- /data/data/####/https_www.wasu.cn_0.localstorage-journal
- /data/data/####/index
- /data/data/####/libjiagu625449352.so
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Executes next shell scripts:
- app_process /system/bin com.android.commands.input.Input tap 10.0 704.0
- app_process /system/bin com.android.commands.input.Input tap 216.0 704.0
- chmod 755 <Package Folder>/.jiagu/libjiagu625449352.so
- input tap 10.0 704.0
- input tap 216.0 704.0
Loads the following dynamic libraries:
- libjiagu625449352
Uses special library to hide executable bytecode.
Displays its own windows over windows of other applications.
