Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.13.origin
Network activity:
Connecting to:
- o####.####.com
- g####.####.com
- a####.####.com
HTTP GET requests:
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
HTTP POST requests:
- a####.####.com/app_logs
- g####.####.com/cr/sv/getEPList
- o####.####.com/check_config_update
Modified file system:
Creates the following files:
- /data/data/####/files/1485415411847_cgr.so
- /data/data/####/databases/hlx_wifi.db-journal
- /data/data/####/files/hftJcw46N.jar
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/hlx_wifi.db
- /data/data/####/files/1485415428711.jar
- /data/data/####/files/.imprint
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
Sets the 'executable' attribute to the following files:
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
Miscellaneous:
Executes next shell scripts:
- getenforce
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 67617e5563a345b69d5794c896f51115 /data/data/####/.syslib-
- chmod 0771 /data/data/####/.syslib-
Contains functionality to send SMS messages automatically.
