Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Was.1.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) digital####.google####.com:443
- TCP(TLS/1.0) trac####.m####.com:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) sdkco####.ad.xi####.com:443
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) acc####.m####.g.####.com:443
- TCP(TLS/1.2) md####.google####.com:443
- TCP(TLS/1.2) 1####.194.73.105:443
- TCP(TLS/1.2) connect####.gst####.com:443
- TCP(TLS/1.2) 74.1####.131.113:443
- TCP(TLS/1.2) 1####.194.220.101:443
- UDP md####.google####.com:443
- UDP digital####.google####.com:443
DNS requests:
- acc####.m####.g.####.com
- and####.cli####.go####.com
- connect####.gst####.com
- digital####.google####.com
- hysdkse####.g.mi.com
- m####.go####.com
- md####.google####.com
- pla####.googleu####.com
- rr9---s####.g####.com
- sdkco####.ad.xi####.com
- trac####.m####.com
HTTP POST requests:
- acc####.m####.g.####.com:443/migc-sdk-init/accountInit
- acc####.m####.g.####.com:443/sdkservice/api/sdkconfig/init
- sdkco####.ad.xi####.com:443/api/v4/detail/config
- sdkco####.ad.xi####.com:443/api/v4/detail/config_common
- trac####.m####.com:443/track/key_get
- trac####.m####.com:443/track/v4
File system changes:
Creates the following files:
- /data/data/####/1334.xml
- /data/data/####/516fd4004d2f3daf20129615da9fab27
- /data/data/####/MultiDex.lock
- /data/data/####/SessionConfig.xml
- /data/data/####/base.apk.classes1.dex
- /data/data/####/base.apk.classes1.dex.flock (deleted)
- /data/data/####/base.apk.classes1.zip
- /data/data/####/base.apk.classes2.dex
- /data/data/####/base.apk.classes2.dex.flock (deleted)
- /data/data/####/base.apk.classes2.zip
- /data/data/####/base.apk.classes3.dex
- /data/data/####/base.apk.classes3.dex.flock (deleted)
- /data/data/####/base.apk.classes3.zip
- /data/data/####/base.apk.classes4.dex
- /data/data/####/base.apk.classes4.dex.flock (deleted)
- /data/data/####/base.apk.classes4.zip
- /data/data/####/base.apk.classes5.dex
- /data/data/####/base.apk.classes5.dex.flock (deleted)
- /data/data/####/base.apk.classes5.zip
- /data/data/####/base.apk.classes6.dex
- /data/data/####/base.apk.classes6.dex.flock (deleted)
- /data/data/####/base.apk.classes6.zip
- /data/data/####/base.apk.classes7.dex
- /data/data/####/base.apk.classes7.dex.flock (deleted)
- /data/data/####/base.apk.classes7.zip
- /data/data/####/base.apk.classes8.dex
- /data/data/####/base.apk.classes8.dex.flock (deleted)
- /data/data/####/base.apk.classes8.zip
- /data/data/####/mi_sdk_cache.xml
- /data/data/####/mi_sdk_cache.xml.bak
- /data/data/####/mioauth_sp.xml
- /data/data/####/multidex.version.xml
- /data/data/####/one_track_cloud-journal
- /data/data/####/one_track_pref.xml
- /data/data/####/onetrack-journal
- /data/data/####/pref_first_channel.xml
- /data/data/####/report2.db-journal
- /data/data/####/secret.xml
- /data/data/####/temp (deleted)
- /data/data/####/tmp-base.apk.classes1117425582.zip
- /data/data/####/tmp-base.apk.classes1194806532.zip
- /data/data/####/tmp-base.apk.classes1231557187.zip
- /data/data/####/tmp-base.apk.classes1367570868.zip
- /data/data/####/tmp-base.apk.classes1424684114.zip
- /data/data/####/tmp-base.apk.classes1488876896.zip
- /data/data/####/tmp-base.apk.classes1527034701.zip
- /data/data/####/tmp-base.apk.classes1786755533.zip
- /data/data/####/tmp-base.apk.classes1977714766.zip
- /data/data/####/tmp-base.apk.classes4653226.zip
- /data/data/####/tmp-base.apk.classes562545829.zip
- /data/data/####/tmp-base.apk.classes587483871.zip
- /data/data/####/tmp-base.apk.classes644815094.zip
- /data/data/####/tmp-base.apk.classes645359803.zip
- /data/data/####/tmp-base.apk.classes709880747.zip
- /data/data/####/tmp-base.apk.classes792681324.zip
- /data/data/####/tmp-base.apk.classes973345673.zip
- /data/data/####/xiaomi.cfg
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Accesses the ITelephony private interface.
