Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.151.origin
Network activity:
Connecting to:
- w####.####.cn
- i####.####.cn
- o####.####.com
- 1####.####.136:8090
- a####.####.com
HTTP POST requests:
- i####.####.cn/iplookup/iplookup.php?format=####
- a####.####.com/app_logs
- 1####.####.136:8090/main.aspx
- o####.####.com/check_config_update
- w####.####.cn/ip.jsp
Modified file system:
Creates the following files:
- /sdcard/mmt/widegets/data/test.dat9750f7d6-e09b-480e-b6fa-b6a9ac4cdcc6.tmp
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/.hand/lastaccf75a81c3-aa3f-4d31-b8ab-229855a1a0f4.tmp
- /sdcard/mmt/widegets/data/test.dat2893b316-9684-463c-a9bc-b64560098abb.tmp
- /sdcard/tmpsd11012/test.dat96c35c1a-15cd-41be-a4d8-4d246c87048a.tmp
- /sdcard/sdtmp/id269d019e6-989b-46cc-b50f-c63872e3df87.tmp
- /sdcard/sdtmp/id25ab0778a-5ce9-4628-a4f1-10b8aa28483e.tmp
- /sdcard/mmt/widegets/data/droidinfo
- /sdcard/tmpsd11012/test.dat2872bd68-fe65-4d40-ad1a-71f375e14903.tmp
- /sdcard/sdtmp/id1f631c126-b076-4e5c-8f75-a9caa1525b20.tmp
- /sdcard/.uct/uuid3a49c9dc2-19a7-40a6-9da0-eb5163355218.tmp
- /sdcard/mmt/widegets/data/droidinfo-journal
- /sdcard/.hand/developkeyca4387d1-d66d-477d-82b8-92afffc76bba.tmp
- /sdcard/mmt/widegets/data/test.dateb3bd916-ae2e-42f4-807e-e1c80060e8fe.tmp
- /sdcard/sdtmp/id10b4c7acd-ce67-4646-898c-2ea9f63336aa.tmp
- /sdcard/sdtmp/id1
- /sdcard/sdtmp/id2
- /sdcard/sdtmp/id156411d88-4e05-4f1e-bd16-868dd71d7246.tmp
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
- /system/bin/.nbwayxwzt
- cat /sys/class/net/wlan0/address
- conbb od2gf04pd9
Contains functionality to send SMS messages automatically.
