Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.248.origin
- Android.Backdoor.433.origin
- Android.Triada.247.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.1877
Network activity:
Connecting to:
- j####.####.cn
- 1####.####.71
- g####.####.com
- i####.####.com
- c####.com
- c####.####.net
- ub####.####.com
- p####.####.com
- 1####.####.71:9600
- m####.####.com:6088
- c####.####.com
- f####.####.com
- w####.####.com
- a####.####.com
- m####.####.com
- f####.####.cn
- tala####.cn
- uukk####.####.com
HTTP GET requests:
- w####.####.com/adx.php?c=####
- uukk####.####.com/ads/apks/46c9b212-c395-4da5-baaa-7f2b61b6c565.apk
- ub####.####.com/media/v1/0f0005DSCA-mczqmKT7tk0.jpg
- m####.####.com/c/1495006120240
- uukk####.####.com/ads/apks/df5910cd-872e-4c95-b61b-d59a73fc87da.apk
- f####.####.cn/focus/conf?device_type=####&height=####&dpi=####&android_i...
- tala####.cn/n/s?v####
- c####.com/
- f####.####.com/it/u=253965068,3074491977&fm=76
- g####.####.com/getconfig.do?sv=####&appkey=####&kv=####&names=####
- f####.####.cn/focus/st?status=####&cid=####&source=####&requestid=####
- ub####.####.com/media/v1/0f000nZSygTeqxo6BrNQl6.jpg
- i####.####.com/a/3e47ba4d845b8456f45d1d4bbc191ac29
- tala####.cn/n/p.dyd.c
- ub####.####.com/media/v1/0f000KnIg78q3fdj6sr0os.jpg
- uukk####.####.com/ads/images/534fb6df-081f-40bc-91dc-94b1cecf075e.jpg
- tala####.cn/n/p.wca.c?v####
- uukk####.####.com/ads/apks/4622e95b-cca2-4a0d-8981-9cc71815acdd.apk
- tala####.cn/n/p.yd.c
- uukk####.####.com/ads/images/61bec62f-b518-4ff5-b70e-1c8c0fe216d4.png
- uukk####.####.com/ads/images/d86d8b99-2e7f-4bb1-865c-4862a0acb180.jpg
HTTP POST requests:
- p####.####.com/api/statis/3e47ba4d845b8456f45d1d4bbc191ac29/game-8D1591F...
- c####.####.net/config/update
- 1####.####.71/
- c####.####.net/dc/sync_adr
- m####.####.com/t/1495006133072
- 1####.####.71:9600/
- m####.####.com/p/1495006120483
- f####.####.cn/focus/req
- w####.####.com/adx.php?c=####&ext=####
- g####.####.com/report.do
- m####.####.com/t/1495006134499
- j####.####.cn/e5/l09
- f####.####.cn/focus/atex
- m####.####.com/t/1495006131057
- m####.####.com/t/1495006135885
- m####.####.com/t/1495006135702
- a####.####.com/app_logs
- p####.####.com/api/q/a/3e47ba4d845b8456f45d1d4bbc191ac29
- j####.####.cn/e5/gg10
- c####.####.com/show.aspx?Key=####
- m####.####.com:6088/s/
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/528b82d23021.xml
- <Package Folder>/files/paylib.jar
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/shared_prefs/unknown.xml
- <Package Folder>/files/ogjbiq
- <Package Folder>/shared_prefs/pref_file.xml.bak
- <Package Folder>/files/exid.dat
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/files/libexec.so
- <Package Folder>/databases/vi_db_pay-journal
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/app_dex/F40F7DFD55773D5DC3A24824224B9CD1.jar.tmp
- <Package Folder>/shared_prefs/3e47ba4d845b8456f45d1d4bbc191ac29|account_file.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
- <Package Folder>/app_dex/20805074C633169190AAFB97720073F3.jar.tmp
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/dc.87E030F22A3A0A5D2188829AC1809024.preferences.xml.bak
- <Package Folder>/files/ZpAsjmMnFpz_m5HwX-ssyr27QlKvlId3/7-X92cHVbtMLSOT34tVdoQ==/data.dat.tmp
- <Package Folder>/app_dex/E2951744D01880B0FE78848D69504151.jar.tmp
- <Package Folder>/files/sxbfuq_d/sxbfuq_f.zip
- <Package Folder>/databases/dataeye_database_87E030F22A3A0A5D2188829AC1809024.db
- <Package Folder>/files/ZpAsjmMnFpz_m5HwX-ssyr27QlKvlId3/fjjej4Bw024Vm8wtDNcPGw==/zwK7IiNYP_oZtPCu.zip
- <Package Folder>/files/rdata_combdpzlpwoe.new
- <Package Folder>/databases/ua.db
- <Package Folder>/files/com.vik.jvz.jar
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/files/yw.db
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/files/ZpAsjmMnFpz_m5HwX-ssyr27QlKvlId3/bk8PiFBMllKxA37oLm-uyA==/KT4sTjsd6LVJ8qXxNyQNGw==
- <Package Folder>/app_etkpwv/F47215539D6AE01A2A23DFEC278B691E.jar
- <Package Folder>/files/ZpAsjmMnFpz_m5HwX-ssyr27QlKvlId3/YO1u2XpslpWPGQAvT_ucEQ==.new
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/databases/dataeye_database_87E030F22A3A0A5D2188829AC1809024.db-journal
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/shared_prefs/flad.xml
- <Package Folder>/files/libexecmain.so
- <Package Folder>/files/ZpAsjmMnFpz_m5HwX-ssyr27QlKvlId3/bk8PiFBMllKxA37oLm-uyA==/TRWubUAYkDMoVqOo
- <Package Folder>/files/ZpAsjmMnFpz_m5HwX-ssyr27QlKvlId3/HN72P6RbSq8ttILiZp5_mQ==.new
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/dc.87E030F22A3A0A5D2188829AC1809024.preferences.xml
Miscellaneous:
Executes next shell scripts:
- ls -l /system/sbin/su
- cat /sys/block/mmcblk0/device/cid
- ls -l /vendor/bin/su
- getprop ro.product.cpu.abi
- /system/bin/sh
- ls -l /system/xbin/su
- ping -c 2 -w 5 f####.####.cn
- ls -l /sbin/su
- ls -l /system/bin/su
- <dexopt>
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
