Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.33.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) hc.s####.top.####.com:80
- TCP(HTTP/1.1) hg.hig####.today:80
- TCP(HTTP/1.1) hg.hig####.today:8082
DNS requests:
- hc.s####.top
- hg.hig####.today
HTTP GET requests:
- hc.s####.top.####.com/gpfile/pfiles/gofile/des_V18092101Aj1so32.zip
HTTP POST requests:
- hg.hig####.today/cr/sv/mList
- hg.hig####.today:8082/spdumread/service/rtLogRecord
Modified file system:
Creates the following files:
- /data/data/####/1540128434263_V17041702Aj1so32.so
- /data/data/####/com.android.pachcr062712golden2
- /data/data/####/com.android.pachcr0627_preferences.xml
- /data/data/####/hftJcw46N.jar
- /data/data/####/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/media/####/android_fm.id
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c98c128202ed8890002abc9d8902b843 <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- getenforce
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h c98c128202ed8890002abc9d8902b843 <Package Folder>/.syslib-
Loads the following dynamic libraries:
- 1540128434263_V17041702Aj1so32
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
