Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Ninebox.4.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) 1####.217.20.110:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- and####.cli####.go####.com
Modified file system:
Creates the following files:
- /data/data/####/1539782974188.jar
- /data/data/####/1539782974218.jar
- /data/data/####/1539783009734.dex
- /data/data/####/1539783009734.jar
- /data/data/####/1539783009741.jar
- /data/data/####/1539783009809.jar
Miscellaneous:
Loads the following dynamic libraries:
- cocos2dcpp
Uses the following algorithms to decrypt data:
- DES
Displays its own windows over windows of other applications.
