Android.DownLoader.3542

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.190.origin
Android.Xiny.1.origin
Android.Xiny.231.origin
Android.Xiny.251.origin

Downloads the following detected threats from the Web:

Android.HiddenAds.190.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.info####.me:80
TCP(HTTP/1.1) api.l####.com:80
TCP(HTTP/1.1) cdn.info####.me:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) trafy####.com:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) www.linkonc####.com:80
TCP(HTTP/1.1) r1.b####.co:80
TCP(HTTP/1.1) pop####.net:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) overt####.com:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) r1.s####.co:80
TCP(HTTP/1.1) sp.pop####.net:80
TCP(TLS/1.0) r.oeme####.com:443
TCP(TLS/1.0) a####.k####.a####.top:7078
TCP(TLS/1.0) api.info####.me:443
TCP(TLS/1.0) api-####.coo####.org:443

DNS requests:

a####.k####.a####.top
ali.f####.cdn.####.com
and####.b####.qq.com
api-####.coo####.org
api.info####.me
api.l####.com
cdn.info####.me
ea.sno####.1####.com
en.sno####.1####.com
overt####.com
pop####.net
r.oeme####.com
r1.b####.co
r1.s####.co
r1.x####.co
sp.pop####.net
trafy####.com
www.linkonc####.com

HTTP GET requests:

ali.f####.cdn.####.com/2018/03/16/195816662.zip
api.info####.me/api/s2s/goto?id=####&channel=####&provider=####&appkey=#...
api.l####.com/redirect?s=####&at=####&rt=####&o=####&s1=####&s2=####&s3=...
cdn.info####.me/files/7c34a2ed8f72fb81e30dd13e19e07ac6
overt####.com/d/46801059bf4cd8312d4?sub=####&source=####
overt####.com/d/46801059bf4cd8312d4?sub=####&source=####&code=####
overt####.com/gw?sub=####&source=####&url=####&vId=####&hash=####&ete=####
pop####.net/world/go/118844/282334
r1.b####.co/c/d_ab
r1.s####.co/de
r1.s####.co/v1/c/sf
sp.pop####.net/go/118844/282334
sp.pop####.net/sgo/ad?p=####&w=####&t=####&r=####&vw=####&vh=####
trafy####.com/jump/next.php?stamat=####&cbrandom=####&cbtitle=####&cbifr...
www.linkonc####.com/jump/next.php?r=####&sub1=####

HTTP POST requests:

and####.b####.qq.com/rqd/async
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/msg/error
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/sdk/api/ad/hull_v2
en.sno####.1####.com:8088/sdk/api/log/record

Modified file system:

Creates the following files:

/data/data/####/542324769-1749282151
/data/data/####/IM.xml
/data/data/####/ad_native_client_action_log.db
/data/data/####/ad_native_client_action_log.db-journal
/data/data/####/androidnativ_com.coolook.backupr.xml
/data/data/####/androidnativ_com.coolook.backupr.xml.bak
/data/data/####/androidnativesdk_shell.jar
/data/data/####/app.manager-journal
/data/data/####/black.dat
/data/data/####/bugly_db_legu
/data/data/####/bugly_db_legu-journal
/data/data/####/com.coolook.backupr.zip
/data/data/####/com.coolook.backupr.zip (deleted)
/data/data/####/com.coolook.backupr_preferences.xml
/data/data/####/coolook.xml
/data/data/####/dat_v22h2.dat
/data/data/####/data.zip
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_s_af.db
/data/data/####/db_s_af.db-journal
/data/data/####/db_snowfox.db
/data/data/####/db_snowfox.db-journal
/data/data/####/f_000001
/data/data/####/im.database.ad-journal
/data/data/####/index
/data/data/####/lib_v22h2.dat
/data/data/####/libnfix.so
/data/data/####/libshella-2.10.7.1.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mesosphere_v22h2.jar
/data/data/####/mix.dex
/data/data/####/native_record_lock
/data/data/####/nbt_coolook.db
/data/data/####/nbt_coolook.db-journal
/data/data/####/s_sdk_pro_pref.xml
/data/data/####/security_info
/data/data/####/servi
/data/data/####/sf_file_provider.dat
/data/data/####/snowfox_mid_v22h2.so
/data/data/####/snowfox_sdk_so-v22h2.jar
/data/data/####/snowfox_v22h2.jar
/data/data/####/snowfox_v22h2.so
/data/data/####/snowfoxad_msg.db
/data/data/####/snowfoxad_msg.db-journal
/data/data/####/snowfoxprf.xml
/data/data/####/sp_cache.xml
/data/data/####/t.zip
/data/data/####/track_event
/data/data/####/track_event-journal
/data/data/####/track_event.com.coolook.backupr.xml
/data/data/####/virgo_events
/data/data/####/virgo_events-journal
/data/data/####/virgo_mpsp.db
/data/data/####/virgo_mpsp.db-journal
/data/data/####/wap_data.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/2017-11-16.txt
/data/media/####/dev_1d02d98b.txt
/data/media/####/imei.txt
/data/media/####/pid
/data/media/####/s_client.txt
/data/media/####/s_imei.txt

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/<Package>.BackupService
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
chmod 777 <Package Folder>/servi
dd if <Package Folder>/lib/libservi.so of <Package Folder>/servi
dd if=<Package Folder>/lib/libservi.so of=<Package Folder>/servi
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh

Loads the following dynamic libraries:

Bugly
libnfix
libshella-2.10.7.1
libufix
nfix
nog
servi
ufix

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial