Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.205.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.205.origin
Network activity:
Connecting to:
- g####.####.cn
- ad####.####.cn
- k####.####.cn
- c####.####.net
- o####.####.com
- s####.####.cn
- m####.####.net
- pus####.####.com
- ce####.####.com
- a####.####.com:38080
- a####.####.com
HTTP GET requests:
- ad####.####.cn/sdk/signlib/lib_v1.0.4.zip
- ad####.####.cn/sdk/ggpt/lib_v3.0.29.1.zip
- ad####.####.cn/20160329023605Y5.jpg
- s####.####.cn/template/android/install_insert_image/index.html
- ad####.####.cn/20160324041243Y8.png
- ad####.####.cn/sdk/hlpt/lib_v1.0.36.zip
HTTP POST requests:
- a####.####.com/CD382781B46D648D05B8C219784B4DD1
- k####.####.cn/FA193DF6DFDF511DCB16AEA4AA91E793
- k####.####.cn/702619E220213D3BFE64AC4C86FBECF1
- o####.####.com/v2/check_config_update
- c####.####.net/dc/sync_adr
- pus####.####.com/get/get_ad_3
- g####.####.cn/IssueEngine/getShieldEthereal.do?appId=####&channel=####
- o####.####.com/v2/get_update_time
- m####.####.net/api/get_apps
- pus####.####.com/user/ad_screen
- a####.####.com/app_logs
- c####.####.net/config/update
- a####.####.com/8018DAF55F3FB325C0EF07F6C62DC787
- s####.####.cn/702619E220213D3BFE64AC4C86FBECF1
- s####.####.cn/70F5024058DC2E24DFD61302050EEED3
- k####.####.cn/F6EA80A604B90C1AFFF602C719787160
- s####.####.cn/3F5D2B81DADEA1179A7A2F1759D9CF62
- s####.####.cn/FA193DF6DFDF511DCB16AEA4AA91E793
- ce####.####.com/cmge_server/activationCheck
- pus####.####.com/user/register_gzip
- a####.####.com:38080/70F5024058DC2E24DFD61302050EEED3
- s####.####.cn/F6EA80A604B90C1AFFF602C719787160
- a####.####.com/F24303512B08C2D0918EAC8F8649AC2C
Modified file system:
Creates the following files:
- <Package Folder>/databases/bb_old.db
- <Package Folder>/databases/bb_new.db-journal
- <Package Folder>/shared_prefs/admainlib_new.xml
- <Package Folder>/shared_prefs/ads_share_cache.pref.xml.bak
- <Package Folder>/shared_prefs/lib_names.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/bb_old.db-journal
- <Package Folder>/shared_prefs/ads_share_cache.pref.xml
- <Package Folder>/files/.imprint
- <Package Folder>/databases/dataeye_database_90533B4958145246844EE2CB41F927DA.db
- <Package Folder>/databases/ab_new.db-journal
- <Package Folder>/shared_prefs/shared_lib_info_new.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/JARD_-1635165577.zip
- <Package Folder>/files/mobclick_agent_cached_<Package>3
- <Package Folder>/shared_prefs/dc.90533B4958145246844EE2CB41F927DA.preferences.xml
- <Package Folder>/shared_prefs/admainlib.xml.bak
- <Package Folder>/files/JARD_97368500.zip
- <Package Folder>/files/JNID_-1272900806.so
- <Package Folder>/files/JARD_-422780674.zip
- <Package Folder>/shared_prefs/shared_data.xml.bak
- <Package Folder>/files/JNID_-75867319.so
- <Package Folder>/shared_prefs/shared_data.xml
- <Package Folder>/files/JNID_635478378.so
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/databases/ab_new.db
- <Package Folder>/databases/bb_new.db
- <Package Folder>/shared_prefs/shared_lib_info_new.xml.bak
- <Package Folder>/shared_prefs/cached.pref.xml
- <Package Folder>/databases/ab_old.db
- <Package Folder>/shared_prefs/admainlib.xml
- <Package Folder>/files/JARD_893624924.zip
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/dataeye_database_90533B4958145246844EE2CB41F927DA.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/lib_names_new.xml
- <Package Folder>/shared_prefs/admainlib_new.xml.bak
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/shared_lib_info.xml
- <Package Folder>/shared_prefs/cached.pref.xml.bak
- <Package Folder>/files/JNID_-1462814178.so
- <Package Folder>/cache/webviewCacheChromium/data_0
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/databases/ab_old.db-journal
Miscellaneous:
Executes next shell scripts:
- <error:2>
- getprop ro.build.version.sdk
- /system/bin/sh
- ls -l /sbin/su
- getprop ro.build.version.release
- ls -l /system/xbin/su
- ls -l /system/bin/su
- <dexopt>
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
