Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Siggen.Susp.26707
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.126.14.69:8080
- TCP(HTTP/1.1) v.changme####.com:80
- TCP(HTTP/1.1) 1####.173.115.68:8080
- TCP(HTTP/1.1) 1####.40.43.179:4545
- TCP(HTTP/1.1) 1####.62.63.181:8080
- TCP(HTTP/1.1) www.duod####.cc:80
- TCP(HTTP/1.1) c8w2ov7####.aliy####.click:80
- TCP(HTTP/1.1) a.mu####.top:4512
- TCP(HTTP/1.1) 1####.25.18.217:6632
- TCP(HTTP/1.1) chinado####.c####.l####.####.com:80
- TCP(HTTP/1.1) a.mu####.top:5623
- TCP(HTTP/1.1) v.l####.cn:80
- TCP(HTTP/1.1) ys.changme####.com:80
- TCP(HTTP/1.1) pan####.pro:80
- TCP(HTTP/1.1) 1####.62.61.51:6888
- TCP(HTTP/1.1) tt.ys####.cn:80
- TCP(HTTP/1.1) 1####.100.48.52:18008
- TCP(HTTP/1.1) 1####.62.61.51:8080
- TCP(HTTP/1.1) v.r####.cn:80
- TCP(HTTP/1.1) m####.mi####.cn:80
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) zy.qia####.com:443
- TCP(TLS/1.0) d.dcm####.top:443
- TCP(TLS/1.0) sf16-sg####.akama####.net:443
- TCP(TLS/1.0) 1####.250.74.35:443
- TCP(TLS/1.0) sug####.v####.i####.com:443
- TCP(TLS/1.0) bytedan####.oss-####.aliy####.com:443
- TCP(TLS/1.0) v####.obs.cn-ea####.####.com:443
- TCP(TLS/1.0) rr6---s####.g####.com:443
- TCP(TLS/1.0) 3cda####.vhqts-t####.top:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) jiekou-####.cos.ap-chon####.####.com:443
- TCP(TLS/1.2) 1####.217.21.174:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- TCP(TLS/1.2) 1####.250.74.68:443
- TCP(TLS/1.2) 1####.250.74.35:443
- TCP(TLS/1.2) 2####.58.211.14:443
- TCP i####.doub####.com.####.com:443
- UDP p####.google####.com:443
- TCP img1-do####.b0.a####.com:443
- TCP www.cf####.com:443
- TCP apiappd####.68.gy:5689
- TCP i####.doub####.com:443
- TCP n####.v####.qq.####.net:443
- TCP for####.do####.com:443
DNS requests:
- a.mu####.top
- and####.google####.com
- apiappd####.68.gy
- app.br####.com
- c8w2ov7####.aliy####.click
- cdn.qia####.com
- d.dcm####.top
- gmscomp####.google####.com
- hangz####.bul####.top
- hangz####.bul####.top
- i####.doub####.com
- i####.doub####.com
- i####.doub####.com
- jiekou-####.cos.ap-chon####.####.com
- m####.do####.com
- m####.mi####.cn
- n####.v####.qq.com
- p####.google####.com
- pan####.pro
- rr6---s####.g####.com
- rr9---s####.g####.com
- sf16-sg####.akama####.net
- sug####.v####.i####.com
- tt.ys####.cn
- txt.y####.news
- v####.obs.cn-ea####.####.com
- v.changme####.com
- v.l####.cn
- v.r####.cn
- v3-cold####.toutia####.com
- www.cf####.com
- www.duod####.cc
- ys.changme####.com
- zy.qia####.com
HTTP GET requests:
- a.mu####.top:4512/api.php/v1.vod?wd=####&limit=####&page=####
- chinado####.c####.l####.####.com/fix250111.jar
- jiekou-####.cos.ap-chon####.####.com:443/jiekou.txt
- m####.mi####.cn//api.php/v1.search/data?wd=####&type_id=####&page=####
- m####.mi####.cn//shark/api.php?action=####
- pan####.pro/tvbox/tvbox.json
- sug####.v####.i####.com:443/?if=####&key=####
- v.changme####.com/api.php/provide/report_device?app=####&lng=####&device...
- ys.changme####.com/api.php/provide/search_result?app=####&video_name=###...
- zy.qia####.com:443/app/fix1205.json
HTTP POST requests:
- a.mu####.top:5623/info.php
- c8w2ov7####.aliy####.click/api.php/getappapi.index/searchList
- tt.ys####.cn/v2/home/search
- v.l####.cn/v2/home/search
- v.l####.cn/v2/home/vod_details
- v.r####.cn/v2/home/search
- www.duod####.cc/api.php/getappapi.index/searchList
File system changes:
Creates the following files:
- /data/data/####/621055d21b517fcbba2db1a12306d05a
- /data/data/####/Hawk2.xml
- /data/data/####/Hawk2.xml.bak (deleted)
- /data/data/####/crypto.KEY_256.xml
- /data/data/####/csp.dex
- /data/data/####/csp.dex.flock (deleted)
- /data/data/####/csp.jar
- /data/data/####/proc_auxv
- /data/data/####/sp_NanGuaApp.xml
- /data/data/####/tvbox.v3.db-journal
- /data/misc/####/primary.prof
Miscellaneous:
Loads the following dynamic libraries:
- libconceal
- libijkffmpeg
- libijksdl
- libplayer
- libquickjs
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5PADDING
- AES-ECB-PKCS5Padding
Displays its own windows over windows of other apps.
