Android.RemoteCode.442

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.205.origin
Android.DownLoader.456.origin
Android.RemoteCode.110.origin
Android.RemoteCode.88.origin
Android.Xiny.197
Android.Xiny.244.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ads.ad####.com:80
TCP(HTTP/1.1) www.n####.com:80
TCP(HTTP/1.1) sp1.zzw####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) sp.adpusho####.com:7088
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) cl####.ads####.com:80
TCP(TLS/1.0) ea.sno####.1####.com:11218

DNS requests:

a####.u####.com
ads.ad####.com
ali.f####.cdn.####.com
cl####.ads####.com
ea.sno####.1####.com
en.sno####.1####.com
mt####.go####.com
oc.u####.com
sp.adpusho####.com
sp.zzw####.com
sp1.zzw####.com
www.admobim####.com
www.cu####.com
www.mmmmmm####.com
www.n####.com
www.zfr####.com

HTTP GET requests:

ads.ad####.com/acs.php?sid=####&adid=####&pb=####&subid=####&gaid=####
ali.f####.cdn.####.com/20180511120524-snowfox_v19n157a.jar
cl####.ads####.com/index.php?m=####&p=####&app_id=####&offer_id=####&cli...
www.cu####.com/20180523162919.BdJar521Dex_05231628.zip
www.n####.com/api/clk/clkoffer.do?offer_id=####&clickid=####&gaid=####&a...

HTTP POST requests:

a####.u####.com/app_logs
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/checklib
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/sdk/api/log/record
oc.u####.com/check_config_update
sp.adpusho####.com:7088/sdk_p/a
sp.adpusho####.com:7088/sdk_p/b
sp1.zzw####.com/70F5024058DC2E24DFD61302050EEED3
sp1.zzw####.com/8018DAF55F3FB325C0EF07F6C62DC787
sp1.zzw####.com/CD382781B46D648D05B8C219784B4DD1
sp1.zzw####.com/F24303512B08C2D0918EAC8F8649AC2C
sp1.zzw####.com/F6EA80A604B90C1AFFF602C719787160
sp1.zzw####.com/FA193DF6DFDF511DCB16AEA4AA91E793
www.admobim####.com/surl/api2_reg.action
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.n####.com/api/v2/report/rpClk.do
www.n####.com/api/v2/task/getTask.do
www.zfr####.com/up.do

Modified file system:

Creates the following files:

/data/anr/traces.txt
/data/data/####/-14151222
/data/data/####/.imprint
/data/data/####/10043u0_a43.jar
/data/data/####/134905922
/data/data/####/134905922.data
/data/data/####/148ffb722f437e2d2.zip
/data/data/####/ActivatePreUtil.xml
/data/data/####/BusinessPreUtil.xml
/data/data/####/LoginPreUtil.xml
/data/data/####/LoginPreUtil.xml.bak (deleted)
/data/data/####/OfferPreUtil.xml
/data/data/####/a10043u0_a43.apk
/data/data/####/aab.db
/data/data/####/aab.db-journal
/data/data/####/aabn.db
/data/data/####/aabn.db-journal
/data/data/####/abb.db
/data/data/####/abb.db-journal
/data/data/####/abbn.db
/data/data/####/abbn.db-journal
/data/data/####/admlib.xml
/data/data/####/admlib.xml.bak
/data/data/####/admlibn.xml
/data/data/####/amu10043u0_a43.apk
/data/data/####/ari.xml
/data/data/####/ash.db
/data/data/####/ash.db-journal
/data/data/####/cn_rs.xml
/data/data/####/comsh11.xml
/data/data/####/d.zip
/data/data/####/databases.db-journal
/data/data/####/db_snowfox.db
/data/data/####/db_snowfox.db-journal
/data/data/####/device_info.xml
/data/data/####/dtemp.apk
/data/data/####/dylib.xml
/data/data/####/fiwmw
/data/data/####/hunter_config.xml
/data/data/####/info.green.hill_preferences.xml
/data/data/####/isupdate.xml
/data/data/####/lib_v19n.dat
/data/data/####/liblocalinfo.green.hill.mu.so
/data/data/####/liblocalinfo.green.hill.so
/data/data/####/m_cfg.xml
/data/data/####/mesosphere_v19n.jar
/data/data/####/mobclick_agent_cached_info.green.hill13
/data/data/####/mobclick_agent_online_setting_info.green.hill.xml
/data/data/####/my.db
/data/data/####/my.db-journal
/data/data/####/nsa.db-journal
/data/data/####/ob1.zip
/data/data/####/other_config.xml
/data/data/####/pgbwaa
/data/data/####/resource.status.share.xml
/data/data/####/s_sdk_pro_pref.xml
/data/data/####/service_config.xml
/data/data/####/snowfox_v19n.jar
/data/data/####/snowfoxad_msg.db
/data/data/####/snowfoxad_msg.db-journal
/data/data/####/snowfoxprf.xml
/data/data/####/sp_cache.xml
/data/data/####/sp_click_cf.xml
/data/data/####/sp_config.xml
/data/data/####/t_ini.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/upgrade_config.xml
/data/data/####/webview.db-journal
/data/media/####/.snowfoxmsgshow_ad_blacklist.txt
/data/media/####/config.ini
/data/media/####/crash-2018-05-25-17-39-07-1527269947058.log
/data/media/####/crash-2018-05-25-17-39-13-1527269953222.log
/data/media/####/crash-2018-05-25-17-39-42-1527269982101.log
/data/media/####/dev_3cd4e63c.txt
/data/media/####/dy.dat
/data/media/####/imei.txt
/data/media/####/info.green.hill.ini
/data/media/####/ins.dat
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/oc.ini
/data/media/####/sp
/data/media/####/ua.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /system/build.prop
cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq

Loads the following dynamic libraries:

cannedfruit
fiwmw
info.it

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
desede-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES
AES-ECB-PKCS5Padding
DES

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial