Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.120
Network activity:
Connecting to:
- s####.####.net:5284
- 1####.####.222:1234
- 1####.####.222
HTTP POST requests:
- s####.####.net:5284/android.frontserver/pcsvc
- 1####.####.222:1234/GoAPI
- 1####.####.222/GoAPI
Droppers:
Downloaded by the following detected threats from the Web:
- Android.Spy.42.origin
- Android.Spy.145.origin
Modified file system:
Creates the following files:
- /data/data/####/files/ki1JDp2r_CO6I_2MipICoibmB9c=/4EZs-hlXGZKgJoAs5RT3dQ==/data.dat.tmp
- /data/data/####/files/ki1JDp2r_CO6I_2MipICoibmB9c=/yP30GVjqWAFyeBfmZtbJEQ==.new
- /sdcard/Sonnenblume/4A72F2DFFDBD84EB0C5C797BB76AFC44
- /data/data/####/files/ki1JDp2r_CO6I_2MipICoibmB9c=/BV-22vQkxLOf5ZAHYnLTAQ==/udT1gvZW9ISe4pUaEdxwVg==
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/rdata_comodhzph.new
- /data/data/####/files/ki1JDp2r_CO6I_2MipICoibmB9c=/140thcyf_yE2O9NYqqcAkQ==.new
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Sonnenblume/kb_sn.ini
- /data/data/####/files/ki1JDp2r_CO6I_2MipICoibmB9c=/VHeiFF-AAyAJ5BwPgyp6eg==/Rchz3fuamrmW-Vcp.zip
- /sdcard/Sonnenblume/res.apk.u
- /data/data/####/files/hxuivq_d/hxuivq_f.zip
- /data/data/####/databases/cc/cc.db
- /data/data/####/files/mobclick_agent_cached_####20170206
- /data/data/####/files/ki1JDp2r_CO6I_2MipICoibmB9c=/BV-22vQkxLOf5ZAHYnLTAQ==/2SgQj-S_TSnnaMgF
- /data/data/####/files/rdata_comodhzph
- /sdcard/Sonnenblume/EE53AF5B170264468E95E783E26D76C2
Miscellaneous:
Executes next shell scripts:
- cat /sys/block/mmcblk0/device/cid
Contains functionality to send SMS messages automatically.
