Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.304.origin
- Android.DownLoader.255.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.304.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- m####.####.net
- im####.####.com
- cdnreso####.####.com
- mo####.####.com
- h####.####.com
- i####.####.com
- p####.####.com
- 6####.####.140
- c####.####.com
- m####.####.com:81
- m####.####.com
- dow####.####.net
- a####.####.com
- b####.####.com
HTTP GET requests:
- m####.####.net/uploads/allimg/150604/1-15060415122K51.jpg
- m####.####.net/css/common.css
- mo####.####.com/ads/css/min/main.css
- m####.####.net/uploads/allimg/150606/1-150606235405X6-lp.jpg
- m####.####.net/uploads/allimg/150413/1-150413003623642.jpg
- p####.####.com/push.js
- im####.####.com/cs/jsfile/js/c.js
- m####.####.net/uploads/allimg/150603/1-150603232959346.jpg
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- i####.####.com/ask?id=####&h=####&w=####&fv=####&if=####&sohuurl=####&refer=####&rnd=####&z=####&lmt=####&srp=####&ccd=####&lhi=####&eja=####&npl=####...
- mo####.####.com/ads/index.htm
- m####.####.net/css/commong.css
- m####.####.net/uploads/allimg/150531/1-150531013041S0-lp.jpg
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- dow####.####.net/ads/zhad/img/20170214/171732/tablescreen_20170214171717.png
- i####.####.com/ct?id=####&h=####&w=####&fv=####&if=####&sohuurl=####&refer=####&rnd=####&z=####&lmt=####&srp=####&ccd=####&lhi=####&eja=####&npl=####&...
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&u=####
- m####.####.net/uploads/allimg/150819/1-150QZS313155.jpg
- h####.####.com/hm.js?b79e50c####
- im####.####.com/cs/jsfile/js/fc.js?v=####
- mo####.####.com/ads/ads.appcache
- m####.####.net/uploads/allimg/150525/1-15052523213HH.jpg
- m####.####.net/uploads/allimg/150607/1-15060G45926317-lp.jpg
- m####.####.net/uploads/allimg/150807/1-150PG34212301.jpg
- i####.####.com/ando-res/m/xIrJf*8w9W6Eweq0nZDsTKIoBpjO9F4JLbTzttR-EFnuy3WnUS0qyA
- m####.####.net/uploads/allimg/150821/1-150R110161C10-lp.jpg
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- b####.####.com/version/update/resource/348cd48f8a714e598994f6af406de8cf.apk
- cdnreso####.####.com/upload/attachment/20161222/a58e8e3e15f46c53f1212a2d828c28df.apk
- m####.####.net/uploads/allimg/150715/1-150G522551R32.jpg
- m####.####.net/images/sprite.png
- m####.####.net/uploads/allimg/151009/1-151009215UU21.jpg
- m####.####.net/images/wlogo.png
- c####.####.com/cpro/ui/mi.js
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- m####.####.net/uploads/allimg/161214/1-161214114954V6.jpg
- dow####.####.net/ads/zhad/img/20151208/193240/closeimg_20151208193240.png
- m####.####.net/uploads/allimg/151011/1-151011231JT01.jpg
- dow####.####.net/ads/auto/jar/1_0_0093/zhsysgdi.jar
- m####.####.net/uploads/allimg/150525/1-1505251PJ1U8.jpg
- m####.####.net/uploads/allimg/150525/1-1505251R323291.jpg
- m####.####.net/css/lady.css
- m####.####.net/uploads/allimg/150605/1-150605024935J9.jpg
- a####.####.com/s.gif?l=####
- m####.####.net/uploads/allimg/150822/1-150R2092S1R1.jpg
- m####.####.net/redian/29086.html
- m####.####.net/
- m####.####.net/uploads/allimg/160925/1-160925022503X0-lp.jpg
HTTP POST requests:
- a####.####.com/patmob.mob
- a####.####.com/shupwxm.mob
- m####.####.com/hladserver/api/4
- m####.####.com/hladserver/api/2
- 6####.####.140/ando/x/liv?app_id=####&r=####
- m####.####.com/hladserver/api/3
- a####.####.com/getads.mob
- a####.####.com/xxrrpp.mob
- m####.####.com:81/hladserver/api/1
- m####.####.com/hladserver/api/1
- a####.####.com/init.mob
Modified file system:
Creates the following files:
- /sdcard/Android/data/.529556641da81be7fcf36818391342c9
- /sdcard/.android/dev.txt
- /data/data/####/shared_prefs/googlesdk.xml
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/sKCd-rRJWY0yv8Z2xM0a6A==/cLfePZceCSiI0RdX.zip
- /data/data/####/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
- /data/data/####/files/qhad/update/qh_ad_backs.t
- /data/data/####/shared_prefs/.hdyihmen.xml.bak
- /data/data/####/files/ghfeaa_d/ghfeaa_f.zip
- /data/data/####/files/.android/zhsysgdi.jar
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/.android/close.png
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/shared_prefs/hlcsdpf.xml
- /sdcard/Android/data/.nomedia
- /data/data/####/files/ab2334f82bb9893c40fc965b1434405c/a58e8e3e15f46c53f1212a2d828c28df.apk
- /data/data/####/app_database/ApplicationCache.db-journal
- /data/data/####/files/itvywrZYa1Gz-xGtG8WYtg==/kzSr2uAcZtuV3HWuVLIsr8kfs0I=
- /sdcard/Android/data/.infofo
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/fVTi7__JyN4-t052EU5IyA==.new
- /sdcard/.env/.uunique.new
- /data/data/####/shared_prefs/__x_adsdk_agent_header__.xml
- /data/data/####/shared_prefs/googlesdk.xml.bak
- /sdcard/610dac5495365a7a1adf6c9cc2bef234.jar
- /data/data/####/databases/COMLETANGGAMEAZP-journal
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/SXa9uZQkALqU-0KmNwrwyA==/sbpW0AoP-1XpeI7Q96Dycg==
- /data/data/####/files/rdata_comnwvxjaib.new
- /data/data/####/shared_prefs/com.baidu.mobads.loader.xml
- /sdcard/Android/data/####/610dac5495365a7a1adf6c9cc2bef234.jar
- /sdcard/.android/102877739
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/0HUi2XLP3LGM75X1
- /sdcard/.android/thinpot.png
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/fVTi7__JyN4-t052EU5IyA==
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/SXa9uZQkALqU-0KmNwrwyA==/l60JvsOk5EkKgp1I.temp
- /data/data/####/shared_prefs/.xt_epg_uxath.xml
- /data/data/####/shared_prefs/hlcsdpf.xml.bak
- /data/data/####/files/rdata_comnwvxjaib
- /data/data/####/shared_prefs/.xt_epg_uxath.xml.bak
- /sdcard/.android/back.png
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/SXa9uZQkALqU-0KmNwrwyA==/l60JvsOk5EkKgp1I
- /data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
- /sdcard/.android/sign.info
- /sdcard/.android/fatpot.png
- /data/data/####/databases/vastpaydb
- /data/data/####/databases/vastpaydb-journal
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/YW_XeKrkw567lf0W7pAv-w==/data.dat.tmp
- /data/data/####/files/2sFmSk0JxAtxTO9lWPNmMwCtFDtV0Zzm/DcNEZvBlUqI6a8urWmuz6A==.new
- /sdcard/.x
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/.hdyihmen.xml
Miscellaneous:
Executes next shell scripts:
- dumpsys meminfo
- procrank
- cat /data/anr/traces.txt
Contains functionality to send SMS messages automatically.
