Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.16.origin
- Android.Xiny.184.origin
- Android.Loki.15.origin
- Android.Backdoor.336.origin
- Android.DownLoader.2139
- Android.MulDrop.84.origin
- Android.DownLoader.304.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.336.origin
Network activity:
Connecting to:
- s####.####.com
- t####.####.com
- g####.####.com
- and####.####.com
- d####.####.com
- e####.####.com
- ip####.io
- m####.####.com
- a####.####.com
HTTP GET requests:
- s####.####.com/cr/sdk/dynV17041701D/des_onlydyV17041701Dj1so32.zip
- s####.####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
- s####.####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
- g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- a####.####.com/pull/top_offer?gaid=####&id=####
- ip####.io/json
- g####.####.com/cr/sv/getGoFile?name=####
- e####.####.com/thinking/group/exp
- s####.####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
- s####.####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
- d####.####.com/thinking/group/rtt_0511_669.apk
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
HTTP POST requests:
- g####.####.com/cr/sv/getEPList
- a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- a####.####.com/subscribe/api/1110
- and####.####.com/rqd/async
- t####.####.com/ggview/rsddateindex
- g####.####.com/pilot/api/300102
- m####.####.com/errorview/api/601
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- <Package Folder>/files/.snow/.zip/mkdevsh
- <Package Folder>/files/awsrabf/libqBikvXzxORCegosEzxc.so
- <Package Folder>/files/421.jar
- <Package Folder>/files/32d0c3764a75d854745f1d868f8081e3.data
- <Package Folder>/shared_prefs/googlesdk.xml.bak
- <Package Folder>/databases/bugly_db_legu
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/hello.apk
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/webviewCookiesChromium.db.mirror
- <Package Folder>/files/1496231854275_onlydyV17041701Dj1so32.so
- <Package Folder>/files/awsrabf/libLDyARNDidKiYcqzxdynamicloader.so
- <Package Folder>/files/617.jar
- <Package Folder>/databases/ua.db
- <Package Folder>/files/.snow/.dlme.apk
- <Package Folder>/shared_prefs/googlesdk.xml
- <Package Folder>/tx_shell/libufix.so
- <Package Folder>/files/hftJcw46N.jar
- <Package Folder>/databases/cc.db
- <Package Folder>/files/.snow/myshell
- <Package Folder>/tx_shell/libshella-2.10.2.3.so
- <Package Folder>/files/.snow/.zip/rt8
- <Package Folder>/files/.play/.md
- <Package Folder>/mix.dex
- <Package Folder>/files/.snow/.dsmt.apk
- <Package Folder>/files/exid.dat
- <Package Folder>/files/.snow/exp
- <Package Folder>/files/.snow/.ir
- <Package Folder>/files/610.jar
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/files/.snow/.uok
- <Package Folder>/files/.snow/.center.tapk
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- <Package Folder>/files/.snow/.service
- <Package Folder>/tx_shell/libnfix.so
- <Package Folder>/files/.snow/a.xml
- <Package Folder>/files/.default/.p.apk
- <Package Folder>/files/.snow/supolicy
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/files/.snow/busybox
- <Package Folder>/files/LDyARNDidKiYcqzxdynamicloader.jar
- <Package Folder>/files/.snow/.client
- <Package Folder>/files/.snow/.catr.apk
- <Package Folder>/files/awsrabf/libUniUxqsTCxkMnvngbt.so
- <Package Folder>/files/fvmch.apk
- <Package Folder>/files/.S1CH1S/77C88DAB96A79BD7EA89098DEBA88F21
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/files/.work/postroot.sh
- <Package Folder>/databases/cc.db.mirror
- <Package Folder>/files/wifi_configuration2<System Property>4/5wifi_configuration2<System Property>46
- <Package Folder>/files/.default/32d0c3764a75d854745f1d868f8081e3.data.temp
- <Package Folder>/files/awsrabf/libbcVPHHDpaVhsxLGUlala.so
- <Package Folder>/files/.snow/b.png
- <Package Folder>/databases/webview.db.mirror
- <Package Folder>/files/.snow/.zip/r4
- <Package Folder>/files/.snow/.zip/r1
- <Package Folder>/files/.snow/.zip/r3
- <Package Folder>/files/.snow/.zip/r2
- <Package Folder>/shared_prefs/internal.xml
- <Package Folder>/files/23<System Property>32/<Package>12<System Property>2
- <Package Folder>/files/security_info
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/files/.gepd/gpdu
- <Package Folder>/files/.S1CH1S/301B743A25916CB9DA3C6199B2E0506E
- <Package Folder>/databases/ua.db.mirror
- <Package Folder>/files/.snow/.dico.apk
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/files/.snow/.uks
- <Package Folder>/files/.snow/.dg
- <Package Folder>/files/.snow/checkFile13
- <Package Folder>/files/native_record_lock
- <Package Folder>/files/.snow/checkFile0
- <Package Folder>/files/.snow/.ukd
- <Package Folder>/files/libhjdSsDMxuUQaCVMDbootstrap.so
- <Package Folder>/files/.snow/.dlsb.apk
- <Package Folder>/files/local_crash_lock
- <Package Folder>/databases/bugly_db_legu-journal
- <Package Folder>/files/.snow/.zip/rsh
- <Package Folder>/files/na1l2t/ntmp21142168
- <Package Folder>/files/.S1CH1S/DAE162B8F5BD577ECEBC6108599F20CC
- <Package Folder>/files/.S1CH1S/B9715B7918D2D279EFCC5D0D892DFA3A
- <Package Folder>/databases/bugly_db_legu.mirror
- <Package Folder>/files/.play/test
- <Package Folder>/files/source.apk
Miscellaneous:
Executes next shell scripts:
- getenforce
- app_process /system/bin com.android.commands.pm.Pm disable org.app.info.grate
- mount -o remount ro /system
- /system/bin/sh -c getprop ro.meizu.product.model
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 22a66d1676604160b855343cd9b269fe <Package Folder>/.syslib-
- mount -o remount,ro /system
- chmod 700 /data/data/####/tx_shell/libufix.so
- getprop ro.gn.gnromvernumber
- chmod 777 <Package Folder>/files/.snow/a.xml
- rm -f <Package Folder>/files/hftJcw46N.jar
- /system/bin/sh -c getprop ro.miui.ui.version.name
- chmod 777 <Package Folder>/files/.snow/.zip/rsh
- chmod 777 <Package Folder>/files/.snow/.ukd
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm -f <Package Folder>/files/hftJcw46N.dex
- /system/bin/sh -c getprop ro.board.platform
- getprop ro.build.nubia.rom.name
- chown 0.0 /system/app/Banner.apk
- chmod 777 <Package Folder>/files/.snow/.uks
- chmod 777 <Package Folder>/files/.snow/.zip/rt8
- chown 0:0 /system/app/oneshs.apk
- /data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
- getprop ro.build.version.opporom
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- app_process /system/bin com.android.commands.pm.Pm disable com.example.gpsdk
- chmod 777 <Package Folder>/files/.snow/exp
- chown 0:0 /system/app/Dingps.apk
- mount -ro remount,ro /system
- chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
- chcon u:object_r:system_file:s0 /system/xbin/supolicy
- app_process /system/bin com.android.commands.pm.Pm disable com.fly.me.ssp.be
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- getprop ro.lewa.version
- chmod 777 <Package Folder>/files/.snow/.zip/
- chmod 777 <Package Folder>/files/.snow/b.png
- chown 0:0 /system/xbin/.cp
- chmod 0771 <Package Folder>/.syslib-
- chcon u:object_r:system_file:s0 /system/bin/.author
- app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
- /system/bin/sh -c getprop ro.aa.romver
- logcat -d -v threadtime
- chmod 0771 /data/data/####/.syslib-
- rm <Package Folder>/files/hftJcw46N.dex
- mount -wo remount rw /system
- app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
- chown 0:0 /system/xbin/.ci.pm
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- rm <Package Folder>/files/hftJcw46N.jar
- chmod 700 <Package Folder>/tx_shell/libufix.so
- /system/bin/sh -c getprop ro.lewa.version
- chown 0:0 /system/app/smalin.apk
- app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
- <error:2>
- chmod 700 /data/data/####/tx_shell/libshella-2.10.2.3.so
- chown 0.0 /system/app/Treese.apk
- app_process /system/bin com.android.commands.pm.Pm enable org.app.info.grate
- chmod 700 /data/data/####/tx_shell/libnfix.so
- getprop ro.miui.ui.version.name
- chown 0:0 /system/app/Treese.apk
- /system/bin/sh -c getprop ro.build.version.emui
- /data/data/####/files/.play/test /data/data/####/files/.play/ 22a66d1676604160b855343cd9b269fe
- /system/bin/sh -c getprop ro.build.fingerprint
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 22a66d1676604160b855343cd9b269fe
- app_process /system/bin com.android.commands.pm.Pm enable com.example.gpsdk
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
- chown 0.0 /system/xbin/supolicy
- chmod 777 <Package Folder>/files/.snow/.dg
- chown 0:0 /data/local/tmp/busybox
- chown 0:0 /system/lib/libsoon.so
- chmod 777 <Package Folder>/files/.snow/.uok
- getprop ro.build.rom.id
- getprop ro.yunos.version
- sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
- chmod 700 <Package Folder>/tx_shell/libnfix.so
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- chown 0:0 /system/app/Lowerp.apk
- chown 0.0 /system/bin/debuggerd
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 22a66d1676604160b855343cd9b269fe /data/data/####/.syslib-
- getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- chmod 777 <Package Folder>/files/.snow/.zip/r1
- chmod 777 <Package Folder>/files/.snow/.client
- chmod 777 <Package Folder>/files/.snow/.zip/r2
- chmod 777 <Package Folder>/files/.snow/.zip/r4
- getprop ro.board.platform
- chown 0.0 /system/xbin/.cp
- /data/data/####/app_bin/daemon -p #### -s com.burm.vre.d.c -t 180
- df /system
- chown 0:0 /system/xbin/.rainin
- /system/bin/sh -c getprop ro.lenovo.series
- app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
- chown 0.0 /system/xbin/.ci.pm
- getprop ro.build.version.emui
- chown 0:0 /system/bin/debuggerd
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.opporom
- chcon u:object_r:system_file:s0 /system/xbin/.cp
- app_process /system/bin com.android.commands.pm.Pm enable com.fly.me.ssp.be
- rm /system/bin/debuggerd
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.build.rom.id
- chmod 770 /data/data/####/files/.play/test
- getprop ro.aa.romver
- chmod 700 <Package Folder>/tx_shell/libshella-2.10.2.3.so
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- sh
- app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
- chmod 777 <Package Folder>/files/.snow/.zip/r3
- chmod 777 <Package Folder>/files/.snow/supolicy
- chown 0:0 /system/xbin/supolicy
- chmod 777 <Package Folder>/files/.snow/.service
- chmod 777 <Package Folder>/files/.work/postroot.sh
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- getprop ro.lenovo.series
- chown 0:0 /data/local/tmp/.catr.apk
- mount -ro remount ro /system
- getprop ro.build.tyd.kbstyle_version
- chmod 770 <Package Folder>/files/.play/test
- getprop ro.meizu.product.model
- chmod 777 <Package Folder>/files/.snow/busybox
- chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
- mount -wo remount,rw /system
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- getprop ro.vivo.os.build.display.id
- mount -o remount rw /system
- chmod 777 <Package Folder>/files/.snow/myshell
- chown 0.0 /system/lib/libsoon.so
- chmod 777 <Package Folder>/files/.snow/.catr.apk
- /system/bin/sh ./mkdevsh
- <dexopt>
- chown 0:0 /system/app/Banner.apk
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
