Technical information
Malicious functions:
Downloads the following detected threats from the Web:
- Android.SmsSpy.5971
Network activity:
Connecting to:
- jcyx3####.####.com
- dl####.####.com
- di####.com
- a####.####.com
- di####.com:5681
HTTP GET requests:
- dl####.####.com//jcyx3/2017/02/2c714002fd7111e6822400163e0c427c.apk
- di####.com/download/check?fromId=####&model=####&packageName=####&asdk=#...
- jcyx3####.####.com/black_lists
- di####.com:5681/checkIpStatus?fromId=####&model=####&packageName=####&as...
- di####.com/download/verify?fromId=####&model=####&packageName=####&asdk=...
- dl####.####.com//jcyx3/2017/01/d2d176bcd66911e6859c00163e0c427c.jpg
- di####.com/version/check?fromId=####&updateVersionTime=####&model=####&p...
- jcyx3####.####.com/controls
- jcyx3####.####.com/adverts?form=####
- di####.com/checkIpStatus?fromId=####&model=####&packageName=####&asdk=##...
- di####.com/checkIpStatus?fromId=####&updateVersionTime=####&model=####&p...
HTTP POST requests:
- jcyx3####.####.com/events
- di####.com/postFile?fromId=####&updateVersionTime=####&model=####&packag...
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/cache/volley/-1824952636-1652138373
- /data/data/####/files/lib/armeabi-v7a/libluajava.so
- /data/data/####/databases/cc.db-journal
- /data/data/####/files/META-INF/CERT.RSA
- /data/data/####/databases/ua.db
- /data/data/####/files/lib/arm64-v8a/libluajava.so
- /data/data/####/databases/hremote.db-journal
- /data/data/####/files/lib/armeabi/libluajava.so
- /data/data/####/shared_prefs/hremote_setting.xml
- /data/data/####/databases/cc.db
- /data/data/####/shared_prefs/com_huhu_sdk_sp.xml
- /data/data/####/cache/volley/259013904-489980281
- /data/data/####/files/dexchk
- /data/data/####/cache/volley/16353500231713587423
- /data/data/####/files/googlegs
- /data/data/####/cache/volley/615632674835934068
- /data/data/####/cache/volley/16973825451713587423
- /data/data/####/files/20170502125717.txt
- /data/data/####/shared_prefs/sp_save.xml
- /data/data/####/shared_prefs/hremote.xml
- /data/data/####/files/res/mipmap-hdpi-v4/ic_launcher.png
- /data/data/####/files/resources.arsc
- /data/data/####/databases/ua.db-journal
- /data/data/####/files/META-INF/MANIFEST.MF
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/volley/-983080538-1652138373
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/files/res/mipmap-xxxhdpi-v4/ic_launcher.png
- /data/data/####/files/scrcore
- /data/data/####/files/classes.dex
- /data/data/####/files/META-INF/CERT.SF
- /data/data/####/files/res/mipmap-mdpi-v4/ic_launcher.png
- /data/data/####/files/gleac.jar
- /data/data/####/files/googleuz
- /data/data/####/files/exid.dat
- /data/data/####/cache/volley/146902616805287362
- /data/data/####/files/20170502125717.gz
- /data/data/####/files/AndroidManifest.xml
- /data/data/####/databases/hremote.db
- /data/data/####/shared_prefs/isFirstStart.xml
- /data/data/####/files/df
- /data/data/####/shared_prefs/com_huhu_sdk_sp.xml.bak
- /data/data/####/files/res/layout/activity_main.xml
- /data/data/####/app_native/bg-daemon
- /data/data/####/databases/tcclick_b.db-journal
- /data/data/####/cache/volley/-17416504131973344709
- /data/data/####/files/googlesq
- /data/data/####/files/gcgdd
- /data/data/####/cache/volley/-825899123-2083466116
- /data/data/####/files/umeng_it.cache
- /sdcard/.tcclick.udid
- /data/data/####/files/res/mipmap-xxhdpi-v4/ic_launcher.png
- /data/data/####/files/rfg
- /data/data/####/files/rfgh.apk
- /data/data/####/cache/volley/-12828305651326373966
- /data/data/####/files/bm
- /sdcard/.baidus/2c714002fd7111e6822400163e0c427c.apk
- /data/data/####/shared_prefs/tcclick.preferences.xml
- /data/data/####/files/res/mipmap-xhdpi-v4/ic_launcher.png
- /data/data/####/cache/volley/-1957376931489796817
- /data/data/####/databases/tcclick_b.db
Sets the 'executable' attribute to the following files:
- /data/data/####/app_native/bg-daemon
- /data/data/####/files/rfgh.apk
Miscellaneous:
Executes next shell scripts:
- chmod 777 /data/data/####/files/scrcore
- chmod 777 /data/data/####/files/googleuz
- chmod 777 /data/data/####/files/.umeng
- chmod 777 /data/data/####/files/googlesq
- getprop ro.product.model
- getprop ro.product.brand
- chmod 777 /data/data/####/files/META-INF
- chmod 777 /data/data/####/files/exid.dat
- getprop ro.build.version.sdk
- chmod 777 /data/data/####/files/.imprint
- chmod 777 /data/data/####/files/rfg
- chmod 777 /data/data/####/files/bm
- chmod 777 /data/data/####/files/df
- getprop ro.product.device
- /data/data/####/app_native/bg-daemon
- chmod 777 /data/data/####/files/lib
- chmod 777 /data/data/####/files/resources.arsc
- chmod 777 /data/data/####/files/dexchk
- chmod 777 /data/data/####/files/assets
- chmod 777 /data/data/####/files/gleac.jar
- chmod 777 /data/data/####/files/umeng_it.cache
- chmod 777 /data/data/####/files/.um
- chmod 777 /data/data/####/files/AndroidManifest.xml
- chmod 777 /data/data/####/files/googlegs
- chmod 777 /data/data/####/files/rfgh.apk
- chmod 777 /data/data/####/files/gcgdd
- chmod 777 /data/data/####/files/classes.dex
- sh /data/data/####/app_native/bg-daemon
- chmod 777 /data/data/####/files/res
Contains functionality to send SMS messages automatically.
