Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.652
File system changes:
Creates the following files:
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/032ea254-50da-4e4c-8477-c6e28e92b1f7
- /data/data/####/088d6332-3b86-4cda-a77d-b5974e87a899
- /data/data/####/1768402c-a246-4178-ad7a-b3044b9fca5c
- /data/data/####/1a7908b1-0cae-4fc0-9c87-1f83d15bdc93
- /data/data/####/1c1eeec1-2795-4272-8bce-42a35d2c7a63
- /data/data/####/1d46c9ac-3dec-4511-9778-69b4758ede24
- /data/data/####/2af45dc8-7d35-4d91-8bee-e7d5b28b28dc
- /data/data/####/3b61467e-7c83-48f7-a7e8-ac129f8fa948
- /data/data/####/49f65fa5-b578-48f9-beb2-c128618fff08
- /data/data/####/52641f9d-13da-4b1b-8303-5e2ce62057b7
- /data/data/####/68dd2c32-0d7f-41b4-8bf7-d98a9005366c
- /data/data/####/6b23cf09-c8b0-4a02-83af-5bed1ce51477
- /data/data/####/6cf21639-d435-4855-84b7-daf29dd9ef40
- /data/data/####/71910b9d-cf48-4c67-b2db-bb2046dc1be9
- /data/data/####/79967d80-4ab5-4445-9ea8-ba4b8732fd62
- /data/data/####/7b56ba3d-8280-4de8-80f6-5847545b98d3
- /data/data/####/9fb93f45-e5d9-4916-9374-1ae84b98d5b7
- /data/data/####/aabc7d8d-b15e-4f8c-9968-83b3c6a9ef76
- /data/data/####/abf03f59-13d9-4c66-83dd-f0e819e62da6
- /data/data/####/af577264-1528-4c00-884c-92641967d6cf
- /data/data/####/bbcef247-1456-462f-8bf0-6a682eed6d1c
- /data/data/####/c23fbb76-000b-436f-bbc3-229bb17545f4
- /data/data/####/c2d85efa-34e6-4665-8157-eacd34e503f3
- /data/data/####/c83c00cc-d009-4cba-9aa3-6348edf07d9e
- /data/data/####/c973414a-1ce9-4ceb-b55a-e9e014bf8aa2
- /data/data/####/cb8a40dc-5fb1-4f34-ac65-24ad510b461b
- /data/data/####/ccd1684e-3e2d-4f7e-8d75-22ffea654b70
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/com.qsair.sscwap
- /data/data/####/com.qsair.sscwap.art
- /data/data/####/com.qsair.sscwap.art.20
- /data/data/####/dd2f49fe-4e6a-4e16-a214-7248384001c6
- /data/data/####/df2f3e28-5d67-44fe-b865-b4f9318efea3
- /data/data/####/ecaeea9a-8003-4d56-be11-c0e821260b47
- /data/data/####/f397a2fc-130d-4135-85bf-80f66d05ec20
- /data/data/####/fcb3cb14-85e3-4d2b-b394-ef558512dbb6
- /data/data/####/libsecexe.x86.so
- /data/data/####/libsecmain.x86.so
- /data/data/####/libsecpreload.x86.so
- /data/data/####/t
- /data/media/####/com.golden.cloud.jkoz.dex
- /data/media/####/com.golden.cloud.jkpz.dex
Miscellaneous:
Executes the following shell scripts:
- <Package> <Package> -1835390184 0 /data/app/<Package>-1.apk 41 <Package> 43 44 1 0
- <Package> <Package> -1835390184 0 /data/app/<Package>-1.apk 41 <Package> 47 49 1 0
- <Package> <Package> -1835390184 0 /data/app/<Package>-1.apk 41 <Package> 54 55 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 43 44 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 46 47 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 47 49 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 52 53 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 53 54 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 41 <Package> 54 55 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 42 <Package> 53 54 1 0
- <Package> <Package> -1836389608 0 /data/app/<Package>-1.apk 42 <Package> 54 55 1 0
- chmod 755 <Package Folder>/.cache/<Package>
- chmod 755 <Package Folder>/.cache/<Package>.art
- chmod 755 <Package Folder>/.cache/<Package>.art.20
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- 032ea254-50da-4e4c-8477-c6e28e92b1f7
- 088d6332-3b86-4cda-a77d-b5974e87a899
- 1768402c-a246-4178-ad7a-b3044b9fca5c
- 1a7908b1-0cae-4fc0-9c87-1f83d15bdc93
- 1c1eeec1-2795-4272-8bce-42a35d2c7a63
- 1d46c9ac-3dec-4511-9778-69b4758ede24
- 2af45dc8-7d35-4d91-8bee-e7d5b28b28dc
- 3b61467e-7c83-48f7-a7e8-ac129f8fa948
- 49f65fa5-b578-48f9-beb2-c128618fff08
- 52641f9d-13da-4b1b-8303-5e2ce62057b7
- 68dd2c32-0d7f-41b4-8bf7-d98a9005366c
- 6b23cf09-c8b0-4a02-83af-5bed1ce51477
- 6cf21639-d435-4855-84b7-daf29dd9ef40
- 71910b9d-cf48-4c67-b2db-bb2046dc1be9
- 79967d80-4ab5-4445-9ea8-ba4b8732fd62
- 7b56ba3d-8280-4de8-80f6-5847545b98d3
- 9fb93f45-e5d9-4916-9374-1ae84b98d5b7
- aabc7d8d-b15e-4f8c-9968-83b3c6a9ef76
- abf03f59-13d9-4c66-83dd-f0e819e62da6
- af577264-1528-4c00-884c-92641967d6cf
- bbcef247-1456-462f-8bf0-6a682eed6d1c
- c23fbb76-000b-436f-bbc3-229bb17545f4
- c2d85efa-34e6-4665-8157-eacd34e503f3
- c83c00cc-d009-4cba-9aa3-6348edf07d9e
- c973414a-1ce9-4ceb-b55a-e9e014bf8aa2
- cb8a40dc-5fb1-4f34-ac65-24ad510b461b
- ccd1684e-3e2d-4f7e-8d75-22ffea654b70
- dd2f49fe-4e6a-4e16-a214-7248384001c6
- df2f3e28-5d67-44fe-b865-b4f9318efea3
- ecaeea9a-8003-4d56-be11-c0e821260b47
- f397a2fc-130d-4135-85bf-80f66d05ec20
- fcb3cb14-85e3-4d2b-b394-ef558512dbb6
- libsecexe.x86
Uses the following algorithms to decrypt data:
- AES-CFB-NoPadding
Uses special library to hide executable bytecode.
