Android.DownLoader.1845

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Hmad.2
Android.Hmad.7.origin
Android.Backdoor.336.origin
Android.Xiny.10.origin

Downloads the following detected threats from the Web:

Android.Backdoor.336.origin

Network activity:

Connecting to:

epup####.####.com:7013
d2h8j6q####.####.net
ecup####.####.com
i####.####.com
epre####.####.com:7012
e####.####.com:8011
p####.####.com
ecup####.####.com:8013
l####.####.net
d####.####.com
e####.####.com
s####.####.com
e####.####.com:7011
t####.####.net
o####.####.com:7070
b####.####.net
epre####.####.com
ecre####.####.com:8012
b####.####.net:5050
m####.####.COM
a####.####.com

HTTP GET requests:

i####.####.com/creative/1607/19/28dc55abfb400153-icon1024.png
ecup####.####.com:8013/ukup.do?mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networkname=####&operatorsn...
d2h8j6q####.####.net/oversea/lockad/logo/1481096613742.png
p####.####.com/stat/aos/v3/active/req?s=####
d2h8j6q####.####.net/oversea/pushad/logo/73f37fb6-4223-4d4e-8e21-966b691a3290.png
i####.####.com/creative/1701/07/de65189f690faf8e-unnamed.jpg
d2h8j6q####.####.net/oversea/lockad/logo/1481247530897.png
d####.####.com/thinking/group/rtt0123_652.apk
d2h8j6q####.####.net/oversea/lockad/logo/1481880152867.png
i####.####.com/creative/1701/07/82e4b2bc19619844-unnamed.jpg
d2h8j6q####.####.net/oversea/lockad/img/1481787089203.jpg
p####.####.com/push/aos/v1/req?s=####
d2h8j6q####.####.net/oversea/lockad/img/1481880152922.jpg
e####.####.com:8011/ugetad.do?kitmd=####&count=####&mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networ...
ecup####.####.com/getccontrol.do?mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networkname=####&operator...
ecre####.####.com:8012/upostdata.do?data=####&mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networkname=...
p####.####.com/popot/aos/v2/eff?s=####
d2h8j6q####.####.net/oversea/lockad/img/1481247530884.png
i####.####.com/creative/1511/13/b3de5a793147a4a7-icon.png
i####.####.com/creative/1701/10/c9f52d29e4daa19b-unnamed.png
i####.####.com/creative/1611/29/ece911ad096e08fb-hot.png
p####.####.com/popot/aos/v2/req?s=####
d2h8j6q####.####.net/oversea/pushad/logo/18a8ec2b-621d-446d-af54-f745ee19be8a.jpg
i####.####.com/creative/1701/10/98547187eced0f66-unnamed.png
p####.####.com/push/aos/v1/eff?s=####

HTTP POST requests:

epre####.####.com/ppostdata.do
a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
m####.####.COM/gcview/api/910
m####.####.COM/pmsg/api/20
e####.####.com/pcheckvalid.do
p####.####.com/v1/android/packages?rt=####&sign=####
t####.####.net/g/d
b####.####.net/
o####.####.com:7070/chnos/ospay/pytstart.do
l####.####.net/gkview/info/601
epre####.####.com:7012/ppostdata.do
s####.####.com/ggview/rsddateindex
b####.####.net:5050/
e####.####.com:7011/pgetad.do
epup####.####.com:7013/pkup.do
ecup####.####.com/getccontrol.do

Modified file system:

Creates the following files:

/sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418293688.log
/data/data/####/shared_prefs/pref_longtime.xml
/data/data/####/shared_prefs/flowapp_shared.xml
/data/data/####/shared_prefs/time_preferences.xml
/sdcard/.s_d_p/.im
/data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml.bak
/data/data/####/shared_prefs/pref_shorttime.xml
/data/data/####/files/.snow/b.png
/data/data/####/shared_prefs/initdata.xml
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/databases/467f628f2cdb577710d670694664b726-journal
/sdcard/Android/data/.dataycache/i42d45df023jnkdd93la483f9xGFKXI
/data/data/####/files/.snow/myshell
/data/data/####/files/armeabi/libmonitor.so
/data/data/####/shared_prefs/gfprf.xml
/data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
/data/data/####/shared_prefs/uuid.xml
/data/data/####/files/mylala/.p.apk
/data/data/####/files/.snow/.client
/data/data/####/files/ZQAgenttcagent.db-journal
/data/data/####/files/.snow/.zip/rt8
/sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/312eaf960118256849dadda3503cf47e
/data/data/####/files/cpf/cpf.txt
/data/data/####/databases/webview.db-journal
/sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/99852ec079e0666451fbe69c94d38d0b
/sdcard/Android/data/un/1e4hai1k78qpc50enpydr2a80.png.bak
/data/data/####/databases/XKwVoK0huy3R
/sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418303499.log
/data/data/####/shared_prefs/indion.xml
/sdcard/Android/data/com.osms.pay/plugins/com.osms.pay.msplugin.apk
/data/data/####/shared_prefs/fpksp.xml.bak
/data/data/####/files/.androidod/ac.jar.a
/data/data/####/lj/cl.zip
/data/data/####/shared_prefs/w4dw9t5c4.xml
/data/data/####/files/.snow/.dico.apk
/data/data/####/databases/MF_CFG-journal
/data/data/####/databases/fx_dd.db-journal
/data/data/####/shared_prefs/id_preferences.xml
/data/data/####/files/.snow/.service
/data/data/####/databases/P15pKIjsm64m-journal
/data/data/####/.lib/libexecmain.so
/data/data/####/databases/74ede8691f1a3aa2d5ea3e287641e108
/data/data/####/databases/gpab.db-journal
/data/data/####/files/.snow/.ir
/data/data/####/app_jc/tfp.jar
/data/data/####/files/.snow/checkFile0
/data/data/####/app_jni/libskin
/data/data/####/app_libs/libabcde.so
/data/data/####/databases/fp.db-journal
/sdcard/.s_d_p/.ual
/data/data/####/databases/wIU6pTyUBYWX-journal
/data/data/####/files/.snow/.center.tapk
/sdcard/Android/data/un/631dm3h2272rybxgwybl7a6s3.png.bak
/data/data/####/files/.snow/.dlme.apk
/data/data/####/shared_prefs/fx2016_shared.xml.bak
/sdcard/com/android/system/uid.sys
/data/data/####/files/.snow/.catr.apk
/data/data/####/databases/wsUL1uCdKvjD
/data/data/####/shared_prefs/fpksp.xml
/sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/d1bdec8c0ff7b9d0d66207a0ae40c3ef
/sdcard/Android/data/shard/.UUID
/data/data/####/databases/467f628f2cdb577710d670694664b726
/sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418298460.log
/data/data/####/files/.snow/.uks
/sdcard/cpf/cpf.txt
/data/data/####/files/.snow/.dg
/sdcard/Android/data/un/6hg718nd6hjeer95n04b4v5be.png.bak
/data/data/####/databases/XKwVoK0huy3R-journal
/data/data/####/files/.snow/.dlsb.apk
/sdcard/Android/data/un/6yb225p6fy54z25ppyx3fi1fj.png.bak
/data/data/####/dj/cd.zip
/sdcard/Android/data/.dataycache/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
/data/data/####/shared_prefs/flowapp_shared.xml.bak
/data/data/####/app_jc/dfx.jar
/data/data/####/databases/T1oX0rhhuXWt-journal
/data/data/####/shared_prefs/data.xml
/data/data/####/shared_prefs/initdata.xml.bak
/sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418312410.log
/data/data/####/files/ZQAgenttcagent.db
/sdcard/Android/data/un/7dauoe6ibf5j1mzazgzdpz4td.png.bak
/sdcard/Android/data/un/2y9o56vvzx715l7cjvscwrhby.png.bak
/data/data/####/shared_prefs/fx2016_shared.xml
/sdcard/.tcookieid
/data/data/####/shared_prefs/fpssp.xml
/data/data/####/app_jc/tfx.jar
/data/data/####/databases/T1oX0rhhuXWt
/sdcard/Android/data/fp/38522.png
/data/data/####/files/.snow/.zip/rsh
/data/data/####/databases/statistics_db-journal
/data/data/####/databases/gpab.db
/data/data/####/shared_prefs/appstarttwo.xml
/sdcard/Android/data/.mycache/.C2655DBDD5C7328BA5EF149B2A8261A0/b3f692e2857d0241278e60282f73ea0a
/data/data/####/files/.snow/.ukd
/data/data/####/databases/74ede8691f1a3aa2d5ea3e287641e108-journal
/data/data/####/files/.snow/supolicy
/sdcard/Android/data/fp/287538.png
/data/data/####/.lib/libexec.so
/data/data/####/qj/cq.zip
/sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/876eb4740f336f06ae2733ca9ffcae33
/data/data/####/files/.snow/.zip/r2
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/.snow/.zip/r4
/data/data/####/files/.snow/.zip/r1
/data/data/####/files/.snow/.zip/r3
/data/data/####/files/.snow/busybox
/data/data/####/shared_prefs/gfprf.xml.bak
/data/data/####/yj/cy.zip
/sdcard/Android/data/.mycache/.C2655DBDD5C7328BA5EF149B2A8261A0/28be79019ec68f3237ccf6e943e2067d
/data/data/####/databases/wIU6pTyUBYWX
/data/data/####/databases/c13937b2d660a6975f7a512952c2e306
/data/data/####/databases/wsUL1uCdKvjD-journal
/data/data/####/databases/jqIqJYOT3JpT-journal
/data/data/####/files/dd0c3e10c47fe15157815e8a7bb5546b.data
/data/data/####/files/.androidod/ac.jar
/data/data/####/shared_prefs/moertry.xml
/data/data/####/databases/P15pKIjsm64m
/data/data/####/shared_prefs/appstartone.xml
/sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418308039.log
/data/data/####/shared_prefs/initdata_stats.xml
/data/data/####/shared_prefs/fxssp.xml
/data/data/####/app_jc/dfp.jar
/data/data/####/databases/c13937b2d660a6975f7a512952c2e306-journal
/data/data/####/jj/cj.zip
/data/data/####/files/mylala/dd0c3e10c47fe15157815e8a7bb5546b.data.temp
/data/data/####/shared_prefs/gpac.xml
/data/data/####/files/.snow/a.xml
/data/data/####/shared_prefs/tdid.xml
/data/data/####/shared_prefs/pref_shorttime.xml.bak
/data/data/####/files/.snow/.uok
/data/data/####/databases/fpdown.db-journal
/data/data/####/databases/DATA_MF_CFG-journal
/data/data/####/xj/cx.zip
/data/data/####/files/.snow/.zip/mkdevsh
/sdcard/Android/data/.mycache/.C2655DBDD5C7328BA5EF149B2A8261A0/cdf9465b879edaea1dfd4bc260f5ef5a

Sets the 'executable' attribute to the following files:

/data/data/####/files/.snow/.dg
/data/data/####/files/.snow/.zip/r3
/data/data/####/files/.snow/busybox
/data/data/####/files/.snow/.zip/r4
/data/data/####/files/.snow/.zip/r1
/data/data/####/files/.snow/.service
/data/data/####/qj/cq.zip
/data/data/####/files/.snow/.zip/r2
/data/data/####/dj/cd.zip
/data/data/####/files/.snow/b.png
/data/data/####/files/.snow/.client
/data/data/####/files/.snow/.ir
/data/data/####/yj/cy.zip
/data/data/####/files/.snow/.zip/rt8
/data/data/####/files/.snow/.zip/rsh
/data/data/####/jj/cj.zip
/data/data/####/files/.snow/myshell
/data/data/####/files/.snow/.catr.apk
/data/data/####/files/.snow/a.xml
/data/data/####/files/.snow/.ukd
/data/data/####/lj/cl.zip
/data/data/####/files/.snow/.uok
/data/data/####/xj/cx.zip
/data/data/####/files/.snow/.zip/mkdevsh
/data/data/####/files/.snow/supolicy
/data/data/####/files/.snow/.uks

Miscellaneous:

Executes next shell scripts:

getprop ro.product.cpu.abi
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
sh
getprop ro.build.description

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial