Technical information
Malicious functions:
Executes code of the following detected threats:
- Tool.Rooter.41.origin
Downloads the following detected threats from the Web:
- Android.Xiny.31.origin
Network activity:
Connecting to:
- c####.####.net
- c####.####.com
- st####.####.net
- stati####.####.com
- i####.####.cn
- a####.####.com
HTTP GET requests:
- st####.####.net/app/rootdashi/wodeshijie.jpg
- c####.####.net/data/static/app/rootdashi/qqmeihua.jpg
- st####.####.net/verbose/rootdashi/market.json
- st####.####.net/rootdashi/rootdashi_chinatoglobal.apk
- st####.####.net/app/rootdashi/kuaiyuehui.png
- c####.####.net/data/static/app/rootdashi/wifi.png
- c####.####.net/data/static/app/rootdashi/pingce.png
- c####.####.net/data/static/app/rootdashi/91zhuomian.jpg
- st####.####.net/app/rootdashi/91zhuomian.jpg
- c####.####.net/data/static/app/rootdashi/wodeshijie.jpg
- c####.####.net/data/static/app/rootdashi/zhuomian.png
- c####.####.net/data/static/app/market/uucun_dashi_market.apk
- i####.####.cn/iplookup/iplookup.php?format=####
- stati####.####.com/ad/rootdashi/msee.png
- c####.####.net/data/static/expand/ExpandPointWall.apk
- st####.####.net/app/rootdashi/yingyongtuijian_type.json
- c####.####.net/data/static/app/rootdashi/yingyongtuijian_type.json
- c####.####.net/data/static/app/rootdashi/kuaiyuehui.png
- st####.####.net/app/rootdashi/qqmeihua.jpg
- c####.####.net/data/static/app/rootdashi/rootdashi_ad_9.json
- st####.####.net/app/rootdashi/zitidashi.png
- c####.####.net/data/static/app/rootdashi/sangegudingfenlei_ad_or_game.json
- st####.####.net/app/rootdashi/youxipojie.png
- stati####.####.com/ad/rootdashi/kuaibao.png
- c####.####.com/dex/container_165.dex
- st####.####.net/app/rootdashi/lbe.png
- st####.####.net/expand/new_rootdashi_expand.json
- stati####.####.com/ad/rootdashi/lianaike.png
- st####.####.net/app/rootdashi/weizhuomian.jpg
- c####.####.net/data/static/verbose/rootdashi/market.json
- c####.####.net/data/static/app/rootdashi/goex.jpg
- c####.####.net/data/static/app/rootdashi/zitidashi.png
- st####.####.net/app/rootdashi/bizhi.png
- c####.####.net/data/static/expand/new_rootdashi_expand.json
- c####.####.net/data/static/verbose/rootdashi/verbose_clear.json
- c####.####.net/data/static/app/rootdashi/xxzhushou.jpg
- c####.####.net/data/static/app/rootdashi/youxipojie.png
- st####.####.net/verbose/rootdashi/verbose_clear.json
- st####.####.net/app/market/uucun_dashi_market.apk
- st####.####.net/expand/ExpandPointWall.apk
- st####.####.net/app/rootdashi/zitidashi.jpg
- c####.####.net/data/static/app/rootdashi/bizhi.png
- c####.####.net/data/static/app/rootdashi/diaobao.jpg
- st####.####.net/app/rootdashi/fengwo.jpg
- st####.####.net/app/rootdashi/wifi.png
- st####.####.net/app/rootdashi/diaobao.jpg
- st####.####.net/app/rootdashi/pingce.png
- st####.####.net/app/rootdashi/zhuomian.png
- c####.####.net/data/static/app/rootdashi/weizhuomian.jpg
- st####.####.net/app/rootdashi/xxzhushou.jpg
- c####.####.net/data/static/app/rootdashi/fengwo.jpg
- c####.####.net/data/static/rootdashi/rootdashi_chinatoglobal.apk
- st####.####.net/app/rootdashi/rootdashi_ad_9.json
- st####.####.net/app/rootdashi/goex.jpg
- c####.####.net/data/static/app/rootdashi/qqshuoshuo.jpg
- st####.####.net/app/rootdashi/yijianqingli.png
- st####.####.net/app/rootdashi/qqshuoshuo.jpg
- c####.####.net/data/static/app/rootdashi/lbe.png
- st####.####.net/app/rootdashi/sangegudingfenlei_ad_or_game.json
- c####.####.net/data/static/app/rootdashi/yijianqingli.png
- c####.####.net/data/static/app/rootdashi/zitidashi.jpg
HTTP POST requests:
- a####.####.com/app_logs
- a####.####.com/container/global_config?cid=####&udid=####&cv=####
Modified file system:
Creates the following files:
- /sdcard/rootdashi_zds/imagecache/msee.png
- /sdcard/rootdashi_zds/imagecache/youxipojie.png
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_data/container.pre_global_config
- /sdcard/rootdashi_zds/imagecache/zitidashi.tmp
- /data/data/####/shared_prefs/umeng_feedback_conversations.xml
- /data/data/####/app_data/container.pre_need_update_plugins
- /data/data/####/shared_prefs/device_id.xml.xml
- /sdcard/rootdashi_chinatoglobal.apk
- /sdcard/rootdashi_zds/imagecache/187779aa8f8c1a4fb57e180e0e52748f
- /sdcard/rootdashi_zds/imagecache/8b22940acd49e6d43ebfde4e5974caff
- /sdcard/rootdashi_zds/imagecache/f9ff2a7ca939ad837c2d5b750368c77f
- /sdcard/rootdashi_zds/imagecache/eca81f8d6c6bc135e4f8afc4b7d7bea6
- /sdcard/rootdashi_zds/imagecache/kuaibao.png
- /data/data/####/.cache/libsecexe.x86.so
- /data/data/####/files/root5
- /data/data/####/.cache/####
- /sdcard/.expand/ExpandPointWall_3.apk
- /data/data/####/shared_prefs/event_preferences.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/.md5
- /data/data/####/files/ExpandPointWall_3.apk
- /data/data/####/.cache/libsecmain.x86.so
- /data/data/####/files/.imprint
- /sdcard/rootdashi_zds/imagecache/wifi.tmp
- /data/data/####/.cache/libsecpreload.x86.so
- /sdcard/rootdashi_zds/imagecache/9260846c768b848017bbc72d7d5ae168
- /sdcard/rootdashi_zds/imagecache/4fb9cbf6f887f9e5d1d2e4c091010cbe
- /data/data/####/.cache/####.art
- /sdcard/rootdashi_zds/imagecache/lbe.tmp
- /data/data/####/shared_prefs/surplus.xml
- /sdcard/rootdashi_zds/imagecache/70082d4df234e5983661d4cc164e62af
- /data/data/####/.sec_version
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/ads.db-journal
- /sdcard/rootdashi_zds/imagecache/0f4c3958d8c0760124a93485b522519f
- /data/data/####/app_bangcleplugin/container.apk
- /data/data/####/.cache/classes.jar
- /sdcard/rootdashi_zds/imagecache/1180b37a1ab7b488eb5338babc864bed
- /data/data/####/shared_prefs/custom_theme.xml.bak
- /data/data/####/shared_prefs/custom_theme.xml
- /sdcard/.weblog/QQ
- /sdcard/rootdashi_zds/imagecache/pingce.tmp
- /data/data/####/.cache/classes.dex
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/rootdashi_zds/imagecache/yijianqingli.png
- /sdcard/.weblog/Baidu
- /sdcard/rootdashi_zds/imagecache/bizhi.tmp
- /data/data/####/databases/ads.db
- /sdcard/rootdashi_zds/imagecache/kuaiyuehui.tmp
- /sdcard/rootdashi_zds/imagecache/zhuomian.png
- /sdcard/rootdashi_zds/imagecache/lianaike.tmp
- /sdcard/rootdashi_zds/imagecache/c60a789fca6d8325ee5815a85928b7c9
Sets the 'executable' attribute to the following files:
- /data/data/####/.cache/####
Miscellaneous:
Executes next shell scripts:
- getprop
- su
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
