Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Joye.3.origin
- Android.Mixi.6.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- g####.####.com
- ts####.####.sg:8847
- a####.####.com
- h####.####.hk:8800
HTTP GET requests:
- g####.####.com/cr/sv/getRlt?eid=####&estatus=####&appkey=####&pid=####&interval=####
- h####.####.hk:8800/task/img/12253.jpeg
- a####.####.com/rt/611f8fe01c3dba4b52b7106269c6e7c5.slze
- a####.####.com/rt/421d7ed53bd9ea7fb30697f3b778e4cd.slze
- a####.####.com/rt/806f0fd805fbb9fd51f60f0a2d93c7a8.slze
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- a####.####.com/rt/617c56fe6865f099aeede372b1dfc689.slze
- a####.####.com/rt/40826aa35909aed08c4993ac8a2ab5ab.slze
- g####.####.com/cr/sdk/goplaysdk_statistics.dat
- a####.####.com/rt/61090119678a9fc560270041f02fc36e.slze
- a####.####.com/rt/6407fbe4a566fed8aac0fc1f0e3b7927.slze
HTTP POST requests:
- a####.####.com/app_logs
- g####.####.com/cr/sv/getEP?pid=####
- ts####.####.sg:8847/tskSdk/tsk/get_t_k.json
- g####.####.com/cr/sv/getEP
Modified file system:
Creates the following files:
- /data/data/####/files/cr
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/O617_.jar
- /data/data/####/files/O806_.jar
- /data/data/####/files/O610_.jar
- /data/data/####/files/al
- /data/data/####/files/slib
- /data/data/####/files/O408_.jar
- /data/data/####/files/.play/test
- /data/data/####/files/10540d4666f674b7e3b3f6ac56f99b3c.jpeg
- /data/data/####/files/r.apk
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/files/1485417960611.jar
- /data/data/####/files/.play/.md
- /data/data/####/databases/hw.db-journal
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/mcr.apk
- /data/data/####/files/O640_.jar
- /data/data/####/files/1485417988472.jar
- /data/data/####/files/O421_.jar
- /data/data/####/files/libdt.so
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/databases/hw.db
- /data/data/####/files/O611_.jar
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.play/test
Miscellaneous:
Executes next shell scripts:
- chmod 0755 /data/data/####/.syslib-
- /data/data/####/files/.play/test /data/data/####/files/.play/ 2deda64a4c654622a21fed561a0d8e59
- chmod 770 /data/data/####/files/.play/test
- syssp -h 2deda64a4c654622a21fed561a0d8e59 /data/data/####/.syslib-
- chmod 777 /data/data/####/files/10540d4666f674b7e3b3f6ac56f99b3c.jpeg
Contains functionality to send SMS messages automatically.
