Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.371.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.371.origin
Network activity:
Connecting to:
- d####.####.com
- doud####.com
- p####.####.com
- a####.####.com
- h####.####.com
HTTP GET requests:
- a####.####.com/res/chengyu/category/0.png
- a####.####.com/a4d7bfeed0556e351450428584122.dex
- d####.####.com//aaa/8762655255b716fc77491ee0cbf590cf.png
- a####.####.com/res/chengyu/category/8.png
- h####.####.com/hm.js?8296a32####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- a####.####.com/res/chengyu/category/16.png
- a####.####.com/min/4X48r-c9oWB-19nWoU.js?t=####
- a####.####.com/res/chengyu/category/21.png
- a####.####.com/res/chengyu/guess/g74.png
- a####.####.com/res/chengyu/guess/xx177.png
- a####.####.com/chengyu/image/idiom.png?t=####
- a####.####.com/min/B09od.js?t=####
- a####.####.com/chengyu/index.php?track_id=####
- a####.####.com/min/CpqxM.css?t=####
- a####.####.com/res/chengyu/category/17.png
- a####.####.com/res/chengyu/guess/xx265.png
- a####.####.com/res/chengyu/category/15.png
- a####.####.com/res/chengyu/category/14.png
- p####.####.com/s/18E2tH
- a####.####.com/res/chengyu/category/20.png
- a####.####.com/res/chengyu/guess/xx179.png
- a####.####.com/res/chengyu/guess/xx178.png
- a####.####.com/uc/image/watermark.png?t=####
- a####.####.com/res/chengyu/guess/xx148.png
- doud####.com/update.html?version=####
- a####.####.com/res/chengyu/category/13.png
- a####.####.com/res/chengyu/category/11.png
- a####.####.com/res/chengyu/category/10.png
- a####.####.com/min/TTArc-ZXnBN-jb7ea-HE4DE-zbBwf-mHNi0-4lsSt-guFIe.css?t...
- a####.####.com/res/chengyu/category/19.png
- a####.####.com/res/chengyu/category/18.png
- a####.####.com/res/chengyu/category/9.png
- a####.####.com/res/chengyu/category/12.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
HTTP POST requests:
- doud####.com/adCenter/appReport/addOne
- doud####.com/adCenter/app/get
- doud####.com/adCenter/ad/get
- doud####.com/adCenter/seo/get
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/shared_prefs/d.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/app_libs/libddad1495130287183ddad.so
- <Package Folder>/databases/dbname-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/dbname
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/d.dex
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/umeng_feedback_user_info.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/ddspname.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
