Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.371.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.371.origin
Network activity:
Connecting to:
- pose####.####.com
- im####.####.com
- g####.####.com
- startap####.com
- i####.####.com
- t####.####.net
- google-####.com
- p####.####.com
- c####.####.com
- f####.####.com
- 2####.####.174
- a####.####.com
HTTP GET requests:
- i####.####.com/?appProd=####&appPub=####&prodid=####
- a####.####.com/a4d7bfeed0556e351450428584122.dex
- c####.####.com/tracking/adImpression?d=####
- im####.####.com/static/images/fullpage_vertical_sports_infra/drawable-md...
- p####.####.com/s/18E2tH
- t####.####.net/v1/tracking?ad=####&app_id=####&pid=####&user_id=####&and...
- 2####.####.174/tracking/adClick?d=####&lu=####&index=####&ts=####&tsh=####
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
- i####.####.com/InApp/resources/info_ex_l.png
- c####.####.com/index.php?o=####&p=####&clickid=####&placement=####&index...
- im####.####.com/styles/compressed/fullpage_vertical_general_infra.201705...
- google-####.com/ga.js
- im####.####.com/image/fetch/f_auto,q_80,w_230,h_230/http%3A%2F%2Flh6.ggp...
- im####.####.com/image/fetch/f_auto,q_80,w_230,h_230/http%3A%2F%2Flh3.goo...
- c####.####.com/tracking/adClick?d=####&ru=####&advId=####&clickId=####&s...
- im####.####.com/static/images/fullpage_vertical_entertainment_infra/draw...
- i####.####.com/styles/top-apps/styles.css
- startap####.com/1.3/trackdownload?publisherId=####&productId=####&os=###...
- g####.####.com/1.3/gethtmlad?publisherId=####&productId=####&os=####&sdk...
- 2####.####.174/tracking/adImpression?d=####&position=####&ts=####&tsh=####
- i####.####.com/InApp/resources/info_ex_s.png
- google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmt...
- startap####.com/1.3/gethtmlad?publisherId=####&productId=####&os=####&sd...
- f####.####.com/update.html?version=####
- i####.####.com/1.3/getadsmetadata?publisherId=####&productId=####&os=###...
- i####.####.com/InApp/resources/info_s.png
- im####.####.com/image/fetch/f_auto,q_80,w_300,h_300/http%3A%2F%2Flh3.goo...
- startap####.com/tracking/infoEvent?publisherId=####&productId=####&os=##...
- google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmc...
- im####.####.com/js/compressed/fullpage_vertical_general_infra.20170517-0...
- i####.####.com/InApp/resources/info_l.png
- i####.####.com/static/images/top-apps/ribon.png
HTTP POST requests:
- t####.####.net/v1/tracking?s=AAdXJ####
- f####.####.com/adCenter/seo/get
- f####.####.com/adCenter/ad/get
- f####.####.com/adCenter/app/get
- a####.####.com/app_logs
- pose####.####.com/
Modified file system:
Creates the following files:
- <Package Folder>/files/info_ex_l.png
- <Package Folder>/cache/filename_return_ad_html
- <Package Folder>/files/half_star.png
- <Package Folder>/files/info_l.png
- <Package Folder>/files/filled_star.png
- <Package Folder>/files/.imprint
- <Package Folder>/files/preloader/preloader_0012.png
- <Package Folder>/files/preloader/preloader_0011.png
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/preloader/preloader_0007.png
- <Package Folder>/files/preloader/preloader_0001.png
- <Package Folder>/files/preloader/preloader_0003.png
- <Package Folder>/files/logo.png
- <Package Folder>/files/preloader/preloader_0010.png
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml.bak
- <Package Folder>/databases/dbname-journal
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/preloader/preloader_0005.png
- <Package Folder>/shared_prefs/1%dss#gfs#ge1%dr1%dps#g_s#gds#ge1%drs#gas#ghs#gSs#g_s#ge1%dr1%dos#gCs#ge1%dls#gis#gb1%do1%dm.xml
- <Package Folder>/files/drawable.zip
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/dbname
- <Package Folder>/files/preloader/preloader_0002.png
- <Package Folder>/files/resources.zip
- <Package Folder>/files/preloader/preloader_0008.png
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml.bak
- <Package Folder>/files/preloader.zip
- <Package Folder>/files/Roboto-Regular.ttf
- <Package Folder>/cache/filename_return_ad
- <Package Folder>/files/close_button.png
- <Package Folder>/files/preloader/preloader_0004.png
- <Package Folder>/files/preloader/preloader_0006.png
- <Package Folder>/files/info_ex_s.png
- <Package Folder>/cache/ddcp.dex
- <Package Folder>/files/tab_side.png
- <Package Folder>/shared_prefs/sharedPreferencesName.xml
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml
- <Package Folder>/files/empty_star.png
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/drawable-hdpi.zip
- <Package Folder>/files/info_s.png
- <Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
- <Package Folder>/files/preloader/preloader_0009.png
- <Package Folder>/shared_prefs/ddspname.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
