Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.269.origin
- Android.Xiny.77
- Android.DownLoader.440.origin
Downloads the following detected threats from the Web:
- Android.Xiny.77
Network activity:
Connecting to:
- d####.####.net:8080
- a####.####.net:8900
- d####.####.net
- up####.####.net:6020
- i####.####.cn
- up####.####.net
HTTP GET requests:
- i####.####.cn/iplookup/iplookup.php?format=####
- d####.####.net/update/ocx_491.zip
- d####.####.net:8080/update/ocx_491.zip
HTTP POST requests:
- up####.####.net:6020/
- a####.####.net:8900/ad-mis-light/otherSdkConfig
- up####.####.net/
Modified file system:
Creates the following files:
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /data/data/####/shared_prefs/pp.xml
- /sdcard/device
- /data/data/####/shared_prefs/device.xml
- /data/data/####/app_libs/libloc.so
- /data/data/####/shared_prefs/appStatus.xml
- /data/data/####/databases/baidu_cjq-journal
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/f1f2724f-e929-46df-8bc1-d79a56a8dffa.zip
- /data/data/####/shared_prefs/config.xml.bak
- /data/data/####/shared_prefs/pp.xml.bak
Miscellaneous:
Executes next shell scripts:
- ps
- am broadcast --user 0 -a com.android.uninstall.watch
- am startservice --user 0 -n ####/com.neteasy.git.service.GitService
- am startservice --user 0 -n ####/com.neteasy.service.LauncherService
Contains functionality to send SMS messages automatically.
