Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Hmad.2
- Android.Loki.6.origin
- Android.Hmad.1.origin
Network activity:
Connecting to:
- epup####.####.com:7013
- ecup####.####.com:8013
- i####.####.com
- 1####.####.228:8006
- t####.####.net
- cdne-####.####.com
- e####.####.com:7011
- l####.####.io
- e####.####.com
- wina####.com:8006
- 1####.####.228
- l####.####.com
- haha####.com
- m####.####.com
- n####.####.com
- wina####.com
- up####.####.net
HTTP GET requests:
- n####.####.com/api/setting?app_id=####&sign=####
- up####.####.net/stylesdk/v1/config?token=####&channel=####&ua=####&net_n...
- i####.####.com/category/c7c1s.png
- up####.####.net/update?sdk=####&v=####&pkg=####&debug=####&aid=####&loca...
- l####.####.com/script.html
- cdne-####.####.com/d/b/c/dbcf49c0b89a579716b2cb46d99f082f1381453207-640-...
- n####.####.com/request?p=####
- cdne-####.####.com/0/a/8/0a8e9c8a28994e50f71597a5388fa57a1381095364-640-...
- m####.####.com/videos/two-brunette-lezzies-tease-in-nylons-9827111.html
- i####.####.com/category/c7c5s.png
- m####.####.com/videos/hot-brunette-amateur-babe-playing-with-her-pussy-9...
- i####.####.com/category/c7c6s.png
- m####.####.com/videos/european-brunette-fisted-from-behind-by-horny-lesb...
- i####.####.com/category/c7c2s.png
- cdne-####.####.com/f/d/1/fd1aaf0a4bfb82b5a5f0c2b2fec644611381487405-640-...
- cdne-####.####.com/6/f/8/6f81110af34212e5e93686c716299fbf1381716183-720-...
- i####.####.com/channels/channel3.jpg
- haha####.com/api/strategy.php?p=####
- i####.####.com/channels/channel7g.jpg
- l####.####.com/version.php?channel=####&category=####&page=####
- i####.####.com/category/c7c4s.png
- l####.####.com/update.html
- i####.####.com/channels/channel4.jpg
- i####.####.com/channels/channel2.jpg
- i####.####.com/channels/channel1.jpg
- i####.####.com/channels/channel7s.jpg
- up####.####.net/update?v=####&sdk=####&pkg=####&debug=####&aid=####&loca...
- m####.####.com/videos/savannah-stern-is-a-very-horny-brunette,-who-doesn...
- i####.####.com/channels/channel5.jpg
- i####.####.com/channels/channel6.jpg
- cdne-####.####.com/3/9/2/3924a34e7abebe8f3ba505f6a845e9ca1379797564-720-...
- cdne-####.####.com/f/6/5/f65b4fe4adf149ae75b9129c96b2b71a1379679486-640-...
- i####.####.com/category/c7c3s.png
HTTP POST requests:
- e####.####.com/ugetad.do
- l####.####.io/common?funid=####&rd=####
- 1####.####.228:8006/service/com.ads.basic.model.ServerAddress?type=####
- 1####.####.228/service/com.ads.basic.model.BeatInterval?code=####
- t####.####.net/g/d
- e####.####.com:7011/pgetad.do
- epup####.####.com:7013/pkup.do
- 1####.####.228/service/com.ads.sales.model.Installed
- wina####.com/service/com.ads.basic.model.ServerAddress?type=####
- wina####.com:8006/service/com.like.system.model.ChipBind
- ecup####.####.com:8013/ukup.do
- 1####.####.228/service/com.ads.sales.model.Mobile
Modified file system:
Creates the following files:
- /data/data/####/app_jc/tfx.jar
- /data/data/####/shared_prefs/uid####.xml
- /sdcard/Android/data/####/cache/3deiocpkq52lysf5bajr7vx8x.tmp
- /data/data/####/shared_prefs/pref_longtime.xml
- /sdcard/Android/data/####/cache/6bhrv1v20eh924q4bvy1gp9mi.tmp
- /data/data/####/databases/fxlock.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/tx_shell/libshella-0.0.3.so
- /data/data/####/shared_prefs/pref_shorttime.xml
- /data/data/####/databases/nativedroid.asa.sdk.db-journal
- /data/data/####/shared_prefs/intelligent.xml
- /data/data/####/shared_prefs/fxkit.xml.bak
- /data/data/####/files/td.lock
- /data/data/####/shared_prefs/ads_share_cache.pref.xml
- /data/data/####/app_jc/dfx.jar
- /data/data/####/app_jc/tfp.jar
- /data/data/####/shared_prefs/cached.pref.xml
- /data/data/####/be/ce.zip
- /sdcard/.nativedroid/tick
- /data/data/####/files/plugin/plugin.jar
- /data/data/####/files/log/agent_log
- /data/data/####/app_jni/libskin
- /sdcard/.nativedroid/adc
- /sdcard/Android/data/####/cache/6rwxynee20ectjz2sa1ro2vwc.tmp
- /sdcard/.batcloud/uid
- /data/data/####/shared_prefs/batcloud.xml
- /sdcard/Android/data/####/cache/mfzn8boxz4j9wfiwha9hci54.tmp
- /data/data/####/shared_prefs/batmobi_install_apps.xml
- /data/data/####/databases/fp.db-journal
- /data/data/####/shared_prefs/flowapp_shared.xml.xml
- /data/data/####/files/log/crash_log
- /sdcard/.tcookieid
- /data/data/####/shared_prefs/fxkit.xml
- /data/data/####/shared_prefs/ads_share_cache.pref.xml.bak
- /data/data/####/shared_prefs/fpssp.xml
- /data/data/####/shared_prefs/device.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/fpksp.xml
- /data/data/####/shared_prefs/cached.pref.xml.bak
- /data/data/####/shared_prefs/TD_CHANNEL_ID.xml
- /data/data/####/app_jc/dfp.jar
- /data/data/####/shared_prefs/batcloud.xml.bak
- /data/data/####/databases/fx_kit_unlock-journal
- /data/data/####/shared_prefs/batmobi_offer_cfg.xml
- /data/data/####/shared_prefs/intelligent.xml.bak
- /data/data/####/files/TDtcagent.db
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/Android/data/####/cache/54yhxn5w9srx8aa4matxlk4i9.tmp
- /data/data/####/shared_prefs/tdid.xml
- /sdcard/Android/data/####/cache/51s28emtn2tatfrc0xk81d87y.tmp
- /data/data/####/files/TDtcagent.db-journal
- /data/data/####/shared_prefs/com.nativedroid.sa.xml
- /data/data/####/databases/fpdown.db-journal
- /data/data/####/shared_prefs/fxssp.xml
- /data/data/####/databases/usage.db-journal
- /sdcard/Android/data/shard/.UUID
- /data/data/####/shared_prefs/batmobi_click.xml
- /data/data/####/shared_prefs/fpksp.xml.bak
- /data/data/####/files/daemon
- /data/data/####/shared_prefs/batmobi_lib.xml
Sets the 'executable' attribute to the following files:
- /data/data/####/be/ce.zip
- /data/data/####/files/daemon
- /data/data/####/tx_shell/libshella-0.0.3.so
Miscellaneous:
Executes next shell scripts:
- /data/data/####/files/daemon --process_name #### --package_name #### --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.haha####.com/api/uninstall.php?android_id=8a2cd8ea6251eb8b'&'imei=
- chmod 775 /data/data/####/files/daemon
- chmod 700 /data/data/####/tx_shell/libshella-0.0.3.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
