Android.DownLoader.2766

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Loki.15.origin
Android.Mixi.16.origin
Android.HiddenAds.102.origin
Android.MulDrop.84.origin
Android.Backdoor.336.origin

Downloads the following detected threats from the Web:

Android.Backdoor.336.origin

Blocks access to graphical screen interface

Removes its shortcut from the home screen.

Network activity:

Connecting to:

trac####.####.com
t####.####.com
set####.####.com
g####.####.com
buzzade####.com
flirt4####.com
s####.####.com
google-####.com
p####.####.com
ip####.io
d####.####.com
e####.####.com
sc####.####.com
cdn####.####.com
m####.####.com
n####.####.com
a####.####.com

HTTP GET requests:

buzzade####.com/a/display.php?r=####&treqn=####&runauction=####&crr=####...
a####.####.com/mpapi/ad?model=####&fomat=####&mcc=####&os_v=####&directi...
trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/14/58c654d6792d5.png
s####.####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
d####.####.com/onlyImpression?k=####&p=####
e####.####.com/thinking/group/onemain/mainp.apk
google-####.com/analytics.js
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
flirt4####.com/entrance/scaling-bg-sc-03.php?service=####&mp_code=####&c...
d####.####.com/click?k=####&p=####&q=####&notice=####
a####.####.com/pull/top_offer?gaid=####&id=####
ip####.io/json
d####.####.com/thinking/group/rtt_0525_666.apk
g####.####.com/cr/sv/getGoFile?name=####
set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
sc####.####.com/v1/scheme/app?model=####&mcc=####&os_v=####&direction=##...
a####.####.com/com.gtarcade.lod?pid=####&af_click_lookback=####&c=####&c...

HTTP POST requests:

a####.####.com/app_logs
p####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
t####.####.com/ggview/rsddateindex
g####.####.com/pilot/api/300102
m####.####.com/errorview/api/601

Modified file system:

Creates the following files:

<Package Folder>/files/.snow/.zip/mkdevsh
<Package Folder>/databases/mobvista.msdk.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/mobvista.xml
<Package Folder>/files/hello.apk
<Package Folder>/files/na1l2t/ntmp22372280
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/wrhlrci/libRppEcpLJpRVcTveVlala.so
<Package Folder>/files/wrhlrci/libIQPFsmOUChmkwhbDdynamicloader.so
<Package Folder>/files/617.jar
<Package Folder>/databases/ua.db
<Package Folder>/files/.snow/.dlme.apk
<Package Folder>/files/wrhlrci/libhMEnYimzyYJbxvhuzxc.so
<Package Folder>/files/1496215449685_dyV17041701Dj1so32.so
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/.S1CH1S/B42B2C9D6CCD32374D24B5CCFE330C9F
<Package Folder>/databases/cc.db
<Package Folder>/files/.snow/myshell
<Package Folder>/files/.snow/.zip/rt8
<Package Folder>/files/f402<System Property>4/5f402<System Property>46
<Package Folder>/files/.snow/.zip/ym
<Package Folder>/files/.snow/.dsmt.apk
<Package Folder>/files/IQPFsmOUChmkwhbDdynamicloader.jar
<Package Folder>/files/exid.dat
<Package Folder>/files/libswbqgonYxEgdlSXzbootstrap.so
<Package Folder>/files/.snow/exp
<Package Folder>/files/.snow/.ir
<Package Folder>/files/.snow/.zip/boy
<Package Folder>/files/.umeng/exchangeIdentity.json
<Package Folder>/files/.snow/.uok
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/files/.snow/.center.tapk
<Package Folder>/files/na1l2t/ntmp20582108
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/.snow/.service
<Package Folder>/files/.snow/ex0
<Package Folder>/files/.snow/a.xml
<Package Folder>/files/.default/.p.apk
<Package Folder>/files/.snow/supolicy
<Package Folder>/files/.play/.md
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/.snow/.rshs
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/shared_prefs/com.mobpower.xml
<Package Folder>/files/.imprint
<Package Folder>/databases/ua.db-journal
<Package Folder>/files/.snow/busybox
<Package Folder>/files/.S1CH1S/8A918D4FA94BAC6382DD9BFA0302ED77
<Package Folder>/files/.snow/.client
<Package Folder>/files/.snow/.catr.apk
<Package Folder>/files/wrhlrci/libKueWuLGqMMnRgVVgbt.so
<Package Folder>/files/dbcbd7361f0fdf0d3db91bd4710f63ca.data
<Package Folder>/shared_prefs/com.mobpower.xml.bak
<Package Folder>/shared_prefs/share_data.xml
<Package Folder>/files/.work/postroot.sh
<Package Folder>/files/.default/dbcbd7361f0fdf0d3db91bd4710f63ca.data.temp
<Package Folder>/shared_prefs/share_date.xml.bak
<Package Folder>/files/.snow/b.png
<Package Folder>/files/.snow/.zip/r4
<Package Folder>/files/.snow/.e0.data
<Package Folder>/files/.snow/.zip/r1
<Package Folder>/files/.snow/.zip/r3
<Package Folder>/files/.snow/.zip/r2
<Package Folder>/files/23<System Property>32/<Package>12<System Property>2
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/files/1496215452000_dyV17041701Dj1so32.so
<Package Folder>/databases/cc.db-journal
<Package Folder>/files/.gepd/gpdu
<Package Folder>/files/.snow/.dico.apk
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/.snow/.uks
<Package Folder>/files/.snow/.dg
<Package Folder>/files/.snow/checkFile13
<Package Folder>/files/log/agent_log
<Package Folder>/files/.snow/checkFile3
<Package Folder>/files/.snow/checkFile0
<Package Folder>/files/.snow/.ukd
<Package Folder>/files/.snow/checkFile7
<Package Folder>/files/.snow/.dlsb.apk
<Package Folder>/files/.snow/checkFile5
<Package Folder>/files/.snow/checkFile9
<Package Folder>/databases/mobpower.db-journal
<Package Folder>/files/.snow/.zip/rsh
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/files/.snow/.zip/post.sh
<Package Folder>/shared_prefs/share_date.xml
<Package Folder>/files/.play/test
<Package Folder>/files/source.apk
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0

Miscellaneous:

Executes next shell scripts:

getenforce
mount -o remount ro /system
app_process /system/bin com.android.commands.pm.Pm disable com.wo.ai.girl.huy.wp
mount -o remount,ro /system
/data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h ad796abdf69a4021957d923caf493e1a /data/data/####/.syslib-
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h ad796abdf69a4021957d923caf493e1a <Package Folder>/.syslib-
chmod 777 <Package Folder>/files/.snow/ex0
app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
rm -f <Package Folder>/files/hftJcw46N.jar
chmod 777 <Package Folder>/files/.snow/.zip/rsh
chmod 777 <Package Folder>/files/.snow/.ukd
rm -f <Package Folder>/files/hftJcw46N.dex
chmod 777 <Package Folder>/files/.snow/.uks
chmod 777 <Package Folder>/files/.snow/.zip/rt8
chown 0:0 /system/app/oneshs.apk
/data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
chown 0.0 /system/xbin/.rainin
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
mount -o remount,rw /system
chmod 777 <Package Folder>/files/.snow/exp
chown 0:0 /system/app/RomterFacebook.apk
app_process /system/bin com.android.commands.pm.Pm enable com.wo.ai.girl.huy.wp
chown 0:0 /system/app/Dingps.apk
app_process /system/bin com.android.commands.pm.Pm enable com.kai.kia.dou.ye.cai
mount -ro remount,ro /system
chmod 777 <Package Folder>/files/.snow/.zip/post.sh
chcon u:object_r:system_file:s0 /system/xbin/supolicy
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
chmod 777 <Package Folder>/files/.snow/.zip/
chmod 777 <Package Folder>/files/.snow/b.png
chown 0:0 /system/xbin/.cp
chown 0.0 /system/app/Lowerp.apk
chown 0.0 /system/app/Dingps.apk
chmod 0771 <Package Folder>/.syslib-
rm <Package Folder>/files/.snow/ex0
app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
chown 0.0 /data/local/tmp/busybox
chmod 777 <Package Folder>/files/.work/postroot.sh
rm <Package Folder>/files/hftJcw46N.dex
mount -wo remount rw /system
app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
chown 0:0 /system/xbin/.ci.pm
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
rm <Package Folder>/files/hftJcw46N.jar
<error:2>
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ ad796abdf69a4021957d923caf493e1a
chmod 770 <Package Folder>/files/.play/test
chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
chown 0:0 /system/app/Linkcai.apk
app_process /system/bin com.android.commands.pm.Pm disable com.kai.kia.dou.ye.cai
app_process /system/bin com.android.commands.pm.Pm enable com.num.hum.kong.ui.op.er
chown 0:0 /system/app/LocalFacebook.apk
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
chown 0.0 /system/xbin/supolicy
chown 0:0 /data/local/tmp/busybox
chown 0:0 /system/lib/libsoon.so
chmod 777 <Package Folder>/files/.snow/.uok
chmod 777 <Package Folder>/files/.snow/.dg
sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
chown 0:0 /system/app/Lowerp.apk
chown 0.0 /system/bin/debuggerd
chmod 777 <Package Folder>/files/.snow/.zip/r1
/data/data/####/files/.play/test /data/data/####/files/.play/ ad796abdf69a4021957d923caf493e1a
chmod 777 <Package Folder>/files/.snow/.zip/r3
chmod 777 <Package Folder>/files/.snow/.zip/r2
chmod 777 <Package Folder>/files/.snow/.zip/r4
chmod 777 <Package Folder>/files/.snow/a.xml
df /system
chown 0:0 /system/xbin/.rainin
app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
chown 0:0 /system/bin/.author
chown 0.0 /system/xbin/.ci.pm
chown 0:0 /system/bin/debuggerd
app_process /system/bin com.android.commands.pm.Pm disable com.num.hum.kong.ui.op.er
chmod 777 <Package Folder>/files/.snow/.zip/boy
chcon u:object_r:system_file:s0 /system/lib/libsoon.so
rm /system/bin/debuggerd
/system/bin/sh <Package Folder>/files/.snow/.zip/rsh
chmod 770 /data/data/####/files/.play/test
sh
app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
chmod 777 <Package Folder>/files/.snow/.client
chown 0.0 /data/local/tmp/.catr.apk
chmod 777 <Package Folder>/files/.snow/supolicy
chown 0:0 /system/xbin/supolicy
chmod 777 <Package Folder>/files/.snow/.service
chmod 0771 /data/data/####/.syslib-
chown 0:0 /data/local/tmp/.catr.apk
mount -ro remount ro /system
chmod 777 <Package Folder>/files/.snow/.rshs
chmod 777 <Package Folder>/files/.snow/busybox
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
mount -wo remount,rw /system
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
mount -o remount rw /system
chmod 777 <Package Folder>/files/.snow/myshell
chmod 777 <Package Folder>/files/.snow/.catr.apk
/system/bin/sh ./mkdevsh
<dexopt>

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial