Android.DownLoader.2147

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.333.origin
Android.Rootkit.5.origin
Android.Triada.74.origin
Android.Xiny.10.origin
Android.Backdoor.336.origin

Downloads the following detected threats from the Web:

Android.Backdoor.336.origin

Network activity:

Connecting to:

s####.####.com
p####.####.com:8080
g####.####.com
hostwe####.com
hostwe####.com:8080
p####.####.com
q####.####.com:8092
al####.####.com
l####.####.net
d####.####.com
inter####.####.com
k####.####.com
m####.####.COM
r####.####.com
a####.####.com

HTTP GET requests:

d####.####.com/thinking/group/rtt0421_662.apk
k####.####.com/download/opacore/xcore7_1.0.2.md
al####.####.com/Ag21
g####.####.com/atmp/ad.png
al####.####.com/ym_jar

HTTP POST requests:

inter####.####.com/newservice/newgetApks.action
p####.####.com:8080/OpaService/OpaStrategy
a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
m####.####.COM/gcview/api/910
p####.####.com:8080/OpaService/OpaQHCode
p####.####.com/OpaService/OpaMagicCode
m####.####.COM/pmsg/api/20
r####.####.com/rqd/sync
l####.####.net/gkview/info/601
inter####.####.com/newservice/newopenOrSale.action
hostwe####.com:8080/dispatcher.php
q####.####.com:8092/active.do?ie=####&ch=####&svs=####&system=####&ua=##...
m####.####.COM/errorview/api/601
a####.####.com/app_logs
hostwe####.com/dispatcher.php
p####.####.com/OpaService/OpaReport
p####.####.com/OpaService/OpaStrategy
s####.####.com/ggview/rsddateindex

Modified file system:

Creates the following files:

/sdcard/cpf/cpf.txt
/data/data/####/files/.snow/.dico.apk
/data/data/####/shared_prefs/Oveead.xml
/data/data/####/files/.snow/.dg
/data/data/####/shared_prefs/bugly_data.xml
/data/data/####/files/Agcr.tmp
/data/data/####/shared_prefs/config.xml
/data/data/####/files/.snow/.center.tapk
/data/data/####/files/.snow/busybox
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/.snow/.ukd
/data/data/####/files/bcjyxp.dat
/data/data/####/files/.snow/.zip/r4
/data/data/####/files/.snow/.dlsb.apk
/data/data/####/files/.snow/.zip/r1
/data/data/####/files/.snow/.service
/data/data/####/files/.snow/.zip/r3
/data/data/####/files/.snow/.zip/r2
/data/data/####/files/.snow/b.png
/data/data/####/shared_prefs/bugly_data.xml.bak
/data/data/####/tx_shell/libshella-0.0.4.so
/data/data/####/shared_prefs/gfprf.xml.bak
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/bcjyxp.jar
/data/data/####/files/.snow/myshell
/data/data/####/shared_prefs/gpac.xml
/data/data/####/shared_prefs/OverseaSDK.xml
/data/data/####/files/mySdk.jar
/data/data/####/shared_prefs/gfprf.xml
/data/data/####/files/.snow/checkFile0
/data/data/####/shared_prefs/mobclick_agent_state_####.xml
/data/data/####/files/mda.ico
/data/data/####/files/miuk.db
/data/data/####/shared_prefs/xapcinfo.xml
/data/data/####/files/.androidod/ac.jar
/data/data/####/shared_prefs/moertry.xml
/data/data/####/databases/gpab.db-journal
/data/data/####/app_sgdex/dos.jar
/data/data/####/files/wddex.jar
/data/data/####/files/.snow/.catr.apk
/data/data/####/mix.dex
/data/data/####/files/.snow/.zip/rt8
/data/data/####/files/cpf/cpf.txt
/data/data/####/files/.snow/.dlme.apk
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/OverseaSDK.xml.bak
/data/data/####/files/.snow/.zip/rsh
/data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
/data/data/####/databases/StaticDataC.dataBase-journal
/data/data/####/files/sss.pdb
/data/data/####/databases/gpab.db
/data/data/####/shared_prefs/config.xml.bak
/data/data/####/files/.snow/.ir
/data/data/####/files/.snow/a.xml
/data/data/####/files/bcjyxp.md
/data/data/####/files/.snow/.uok
/data/data/####/files/.Ag/Agcr
/data/data/####/files/mylala/95d3861ebbd38c2dc8795952cc6c4d37.data.temp
/data/data/####/shared_prefs/mobclick_agent_header_####.xml
/data/data/####/files/.snow/.client
/data/data/####/files/.snow/.zip/mkdevsh
/data/data/####/files/95d3861ebbd38c2dc8795952cc6c4d37.data
/data/data/####/databases/bugly_db_lejiagu-journal
/data/data/####/files/.snow/supolicy
/data/data/####/files/.snow/.uks

Sets the 'executable' attribute to the following files:

/data/data/####/files/.snow/.catr.apk
/data/data/####/files/.snow/.ir
/data/data/####/files/.Ag/Agcr
/data/data/####/files/.snow/.zip/rt8
/data/data/####/files/.snow/busybox
/data/data/####/files/.snow/.zip/r4
/data/data/####/files/.snow/.zip/rsh
/data/data/####/files/.snow/.zip/r1
/data/data/####/files/.snow/.zip/r3
/data/data/####/files/.snow/.zip/r2
/data/data/####/files/.snow/.zip/mkdevsh
/data/data/####/files/.snow/b.png

Miscellaneous:

Executes next shell scripts:

configopb ebf05813c1
chown 0.0 /system/bin/.author
app_process /system/bin com.android.commands.pm.Pm disable org.app.info.grate
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.meizu.product.model
getprop ro.gn.gnromvernumber
/system/bin/dexopt --dex 27 55 40 13876 /data/data/####/app_sgdex/dos.jar 1200312071 1108093956 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framewor
chmod 0777 /data/data/####/files/.rtt/chattr
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
chown 0.0 /system/xbin/.cp
/system/bin/sh -c getprop ro.miui.ui.version.name
chmod 0777 /data/data/####/files/su
/data/data/####/files/.rtt/r1 /data/data/####/files/psneuter.js
/system/bin/sh -c getprop ro.board.platform
getprop ro.build.nubia.rom.name
chown 0.0 /system/app/Banner.apk
/data/data/####/files/.rtt/r2 -c /data/data/####/files/psneuter.js
chmod 777 /data/data/####/files/.snow/.zip/r4
chmod 777 /data/data/####/files/.snow/.zip/r1
getprop ro.build.version.opporom
chmod 777 /data/data/####/files/.snow/.zip/r2
/system/bin/dexopt --dex 27 114 40 38812 /data/data/####/files/bcjyxp.jar 1223856443 62427497 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.
mount -o remount,rw /system
chmod 0777 /data/data/####/files/.rtt/nis
chmod 777 /data/data/####/files/.snow/busybox
chown 0:0 /system/app/Dingps.apk
chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
chcon u:object_r:system_file:s0 /system/xbin/supolicy
app_process /system/bin com.android.commands.pm.Pm disable com.fly.me.ssp.be
chmod 777 /data/data/####/files/.snow/myshell
/data/data/####/files/.rtt/r4 -c /data/data/####/files/psneuter.js
getprop ro.lewa.version
ls /data/data
/system/bin/dexopt --dex 27 55 40 127996 /data/data/####/files/.androidod/ac.jar 1195937496 -1605482392 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
chown 0.0 /system/app/Dingps.apk
/system/bin/dexopt --dex 27 94 40 13992 /data/data/####/files/mySdk.jar 1223010873 -889945778 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.
sh /data/data/####/files/suc f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh /data/data/####/files/psneuter.js
chcon u:object_r:system_file:s0 /system/bin/.author
app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
/system/bin/sh -c getprop ro.aa.romver
logcat -d -v threadtime
mount -wo remount rw /system
chmod 777 /data/data/####/files/.Ag/Agcr
chmod 777 /data/data/####/app_outdex
chown 0:0 /system/xbin/.ci.pm
/system/bin/dexopt --dex 27 83 40 2504384 /data/data/####/files/mylala/.p.apk 1251299633 -1585053023 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
chmod 777 /data/data/####/files/.snow/.ukd
chmod 777 /data/data/####/files/.snow/.client
/system/bin/sh -c getprop ro.lewa.version
/system/bin/dexopt --dex 27 52 40 292 /data/data/####/mix.dex 1493729294 -49011495 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /system
conbb od2gf04pd9
chmod 777 /data/data/####/files/.snow/.uks
sh /data/data/####/files/suc HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh /data/data/####/files/psneuter.js
chmod 777 /data/data/####/files/.snow/a.xml
<error:2>
chown 0.0 /system/app/Treese.apk
getprop ro.meizu.product.model
app_process /system/bin com.android.commands.pm.Pm enable org.app.info.grate
getprop ro.miui.ui.version.name
chown 0:0 /system/app/Treese.apk
/system/bin/sh -c getprop ro.build.version.emui
/data/data/####/files/suc HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/sh -c getprop ro.build.fingerprint
chmod 0777 /data/data/####/files/busybox
/system/bin/dexopt --dex 27 87 40 38812 /data/data/####/files/bcjyxp.jar 1223856443 62427497 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
sh /data/data/####/files/.rtt/r3 -c /data/data/####/files/psneuter.js
chmod 777 /data/data/####/files/.snow/.dg
getprop ro.build.version.sdk
cat /proc/cpuinfo
chown 0.0 /system/xbin/supolicy
getprop ro.build.rom.id
getprop ro.yunos.version
chmod 777 /data/data/####/files/.snow/.uok
getprop ro.build.fingerprint
chmod 777 /data/data/####/files/.snow/b.png
/system/bin/sh -c getprop ro.vivo.os.build.display.id
getprop ro.board.platform
chown 0:0 /system/xbin/.cp
df /system
chmod 0777 /data/data/####/files/suc
/data/data/####/files/suc f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/sh -c getprop ro.lenovo.series
chmod 777 /data/data/####/files/.snow/.catr.apk
chmod 777 /data/data/####/files/.snow/supolicy
chmod 0777 /data/data/####/files/psneuter.js
chmod 777 /data/data/####/files/.snow/.zip/rsh
chown 0:0 /system/bin/.author
chmod 777 /data/data/####/files/.snow/.zip/mkdevsh
/system/bin/dexopt --dex 27 55 40 47924 /data/data/####/files/wsh.jar 1244093369 1005593515 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.ja
chown 0.0 /system/xbin/.ci.pm
getprop ro.build.version.release
chmod 777 /data/data/####/files/.snow/.zip/rt8
getprop ro.build.version.emui
getprop
/system/bin/dexopt --dex 27 102 40 38812 /data/data/####/files/bcjyxp.jar 1223856443 62427497 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.
/system/bin/sh -c getprop ro.build.version.opporom
chcon u:object_r:system_file:s0 /system/xbin/.cp
app_process /system/bin com.android.commands.pm.Pm enable com.fly.me.ssp.be
chmod 777 /data/data/####/files/.snow/.service
/system/bin/sh -c getprop ro.build.rom.id
chmod 0777 /data/data/####/files/.rtt/r4
sh /data/data/####/files/.rtt/r1 /data/data/####/files/psneuter.js
getprop ro.aa.romver
chmod 0777 /data/data/####/files/.rtt/r1
chmod 0777 /data/data/####/files/.rtt/r3
chmod 0777 /data/data/####/files/.rtt/r2
/system/bin/sh -c getprop ro.build.nubia.rom.name
cat /proc/version
app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
chmod 777 /data/data/####/files/.Ag
chmod 700 /data/data/####/tx_shell/libshella-0.0.4.so
chown 0:0 /system/xbin/supolicy
getprop ro.lenovo.series
getprop ro.build.tyd.kbstyle_version
chmod 777 /data/data/####/files/wsh.jar
chmod 777 /data/data/####/files/.snow/.zip/r3
mount -wo remount,rw /system
getprop ro.vivo.os.build.display.id
mount -o remount rw /system
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
sh
/data/data/####/files/.rtt/r3 -c /data/data/####/files/psneuter.js
/data/data/####/files/suc al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/sh ./mkdevsh
chmod 777 /data/data/####/files/.snow/.zip/
chown 0:0 /system/app/Banner.apk

Uses administrator priveleges.

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial