Android.Exploit.67

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Exploit.12
Android.HiddenAds.182
Android.Rooter.16.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.kv####.com:80

DNS requests:

www.kv####.com

HTTP GET requests:

www.kv####.com/krt.do?result=####&model=####&count=####&hdware=####&disp...

Modified file system:

Creates the following files:

<Package Folder>/files/####/AndroidSystemPlug2.apk
<Package Folder>/files/####/NgpMain_2.0.6_C002_201702281605.apk
<Package Folder>/files/####/busybox
<Package Folder>/files/####/chattr
<Package Folder>/files/####/dg
<Package Folder>/files/####/gfhadex.jar
<Package Folder>/files/####/ir
<Package Folder>/files/####/killall
<Package Folder>/files/####/pet
<Package Folder>/files/####/r.jar
<Package Folder>/files/####/r.sh
<Package Folder>/files/####/r0
<Package Folder>/files/####/r1
<Package Folder>/files/####/r2
<Package Folder>/files/####/r3
<Package Folder>/files/####/r4
<Package Folder>/files/####/r5
<Package Folder>/files/####/r6
<Package Folder>/files/####/r8
<Package Folder>/files/####/sprot
<Package Folder>/files/####/su2
<Package Folder>/files/####/supolicy
<Package Folder>/files/####/zfile.zip
<Package Folder>/files/a.zip
<Package Folder>/files/schema
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/store.xml

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/.z/r0 -c <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/r1 -C '<Package Folder>/files/.sh/r.sh'
<Package Folder>/files/.z/r1 -auto
<Package Folder>/files/.z/r1 <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/r2
<Package Folder>/files/.z/r2 -c <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/r3
<Package Folder>/files/.z/r3 -c <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/r4 -c <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/r4 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
<Package Folder>/files/.z/r5 /system/bin/sh
<Package Folder>/files/.z/r6 /system/bin/sh
<Package Folder>/files/.z/r8
<Package Folder>/files/.z/su2 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/su2 al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh <Package Folder>/files/.sh/r.sh
<Package Folder>/files/.z/su2 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh <Package Folder>/files/.sh/r.sh
chmod 755 <Package Folder>/files/.data/gfhadex.jar
chmod 755 <Package Folder>/files/schema
chmod 777 <Package Folder>/files/.data
chmod 777 <Package Folder>/files/.data/unzfile
chmod 777 <Package Folder>/files/.data/unzfile/AndroidSystemPlug2.apk
chmod 777 <Package Folder>/files/.data/unzfile/NgpMain_2.0.6_C002_201702281605.apk
chmod 777 <Package Folder>/files/.data/unzfile/busybox
chmod 777 <Package Folder>/files/.data/unzfile/chattr
chmod 777 <Package Folder>/files/.data/unzfile/dg
chmod 777 <Package Folder>/files/.data/unzfile/ir
chmod 777 <Package Folder>/files/.data/unzfile/pet
chmod 777 <Package Folder>/files/.data/unzfile/sprot
chmod 777 <Package Folder>/files/.data/unzfile/supolicy
chmod 777 <Package Folder>/files/.sh
chmod 777 <Package Folder>/files/.sh/r.sh
sh <Package Folder>/files/.z/r0 -c <Package Folder>/files/.sh/r.sh
sh <Package Folder>/files/.z/r1 -C '<Package Folder>/files/.sh/r.sh'
sh <Package Folder>/files/.z/r1 -auto
sh <Package Folder>/files/.z/r2 -c <Package Folder>/files/.sh/r.sh
sh <Package Folder>/files/.z/r3
sh <Package Folder>/files/.z/r3 -c <Package Folder>/files/.sh/r.sh