Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.54.origin
Network activity:
Connecting to:
- s####.####.com
- g####.####.com
- i####.####.in
- 7j####.####.com
- c-h####.####.com
- u####.####.in
- a####.####.com
HTTP GET requests:
- s####.####.com/config/hz-hzv3.conf
- 7j####.####.com/tdata_KpJ330
- a####.####.com/cr/sdk/des_V170223Aj1so32.zip
- i####.####.in/img/4sdk1.png
- 7j####.####.com/tdata_fZU284
- g####.####.com/cr/sv/getGoFile?name=####
- 7j####.####.com/tdata_ZSe996
HTTP POST requests:
- a####.####.com/Api/AddActivate
- u####.####.in/rreg.php
- a####.####.com/Api/UnifiedAccess
- s####.####.com/api.php?format=####&t=####
- u####.####.in/rtn.php
- c-h####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- /data/data/####/files/push.pid
- /data/data/####/files/init.pid
- /data/data/####/files/run.pid
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml.bak
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/files/tdata_ZSe996.jar
- /data/data/####/files/gdaemon_20161017
- /data/data/####/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
- /data/data/####/databases/pushext.db-journal
- /data/data/####/files/tdata_ZSe996
- /sdcard/libs/app.db
- /data/data/####/databases/xUtils_http_cookie.db-journal
- /data/data/####/files/tdata_fZU284.jar
- /data/data/####/databases/tmpd8.db-journal
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/files/.err.jar
- /data/data/####/shared_prefs/a.xml
- /data/data/####/files/init_c1.pid
- /data/data/####/databases/pushg.db-journal
- /data/data/####/databases/fddata-journal
- /data/data/####/files/baidu582DB8520H4/5baidu582DB8520H46
- /data/data/####/files/hftJcw46N.jar
- /data/data/####/app_lib/libmdat.so
- /sdcard/libs/####.db
- /data/data/####/databases/pushgdm.db-journal
- /data/data/####/shared_prefs/a.xml.bak
- /sdcard/system/tmp/local/tdata_KpJ330
- /data/data/####/files/tdata_KpJ330
- /sdcard/system/tmp/local/tdata_fZU284
- /data/data/####/app_libs/.m.apk
- /data/data/####/files/tdata_fZU284
- /data/data/####/files/1485415313250_V170223Aj1so32.so
- /sdcard/system/tmp/local/tdata_ZSe996
- /data/data/####/files/23DB8520H32/####12x862
- /sdcard/Download/log.txt
- /data/data/####/files/tdata_KpJ330.jar
- /data/data/####/files/aHR0cDovL2ltZy5hbW9iaS5pbi9pbWcvNHNkazEucG5n
Sets the 'executable' attribute to the following files:
- /data/data/####/files/gdaemon_20161017
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/app_lib/libmdat.so
Miscellaneous:
Executes next shell scripts:
- chmod 700 /data/data/####/files/gdaemon_20161017
- chmod 0771 /data/data/####/.syslib-
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 6353eebc37334c26ac36eaef9c7be605 /data/data/####/.syslib-
- chmod 777 /data/data/####/app_lib/libmdat.so
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25800 300 0
- chmod 775 /data/data/####/app_lib
Contains functionality to send SMS messages automatically.
