Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Loki.15.origin
- Android.Backdoor.336.origin
- Android.Loki.10.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.336.origin
Network activity:
Connecting to:
- t####.####.com
- g####.####.com
- i####.####.com
- c####.####.net
- p####.####.com
- and####.####.com
- l####.####.net
- d####.####.com
- a####.####.plus
- ip####.io
- e####.####.com
- m####.####.com
- p####.####.com:3090
- a####.####.com
- md-41####.####.org
HTTP GET requests:
- e####.####.com/thinking/group/onemain/mainp.apk
- c####.####.net/games/icons/001/011/464/dimension_150x150.jpg?2017040####
- a####.####.plus/api/getADConfig?app_key=####&duid=####&sdk_version=####&gaid=####&sub=####&vs=####
- e####.####.com/thinking/group/ym32
- a####.####.com/c/d
- d####.####.com/thinking/group/rtt0319_662.apk
- e####.####.com/thinking/group/test4
- a####.####.com/pull/top_offer?gaid=####&id=####
- ip####.io/json
- md-41####.####.org/logo/c29da6fc8806e31219151e7bf4c5202b79faa7aa.png
- e####.####.com/thinking/group/exp
- i####.####.com/tracking/adBulkImpression?d=####
HTTP POST requests:
- a####.####.com/subscribe/api/1997
- a####.####.com/offerview/info/920
- and####.####.com/rqd/async
- t####.####.com/ggview/rsddateindex
- g####.####.com/pilot/api/300102
- p####.####.com:3090/PlutoServer/app/appinit/
- l####.####.net/gkview/info/600
- a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- a####.####.com/app_logs
- m####.####.com/errorview/api/601
- p####.####.com/PlutoServer/app/getplugin/
- p####.####.com/PlutoServer/app/appinit/
Modified file system:
Creates the following files:
- /data/data/####/databases/cc.db-journal
- /data/data/####/shared_prefs/SSPPrefe.xml
- /data/data/####/files/eopcmjt/libLXtzwvqtrxRlyavpdynamicloader.so
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/cc.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/eopcmjt/libnYlYSMWbGsbTavdZlala.so
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/app_armeabi/libBugly.so
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/.windy/65288c96bb8cefd3d531a278a6ac5862.tmp
- /data/data/####/app_armeabi/libdaemon_api20.so
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/app_armeabi/libXUSqbOmGAtoCLrCTdaemon.so
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/files/exid.dat
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/IMDPREF.xml
- /data/data/####/files/.pluto_lib/ab506f17f29f8f71a1eadc4e1487ddd0/pluto.apk
- /data/data/####/shared_prefs/share_data.xml
- /data/data/####/app_bugly/tomb_148542332266.txt
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/app_armeabi/liblegudb.x86.so
- /sdcard/.pluto_data/ab506f17f29f8f71a1eadc4e1487ddd0/images/125a97a3c9710f8c5ad4fec054d5c362.tmp
- /sdcard/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.tmp
- /data/data/####/files/eopcmjt/libqNiSBgujjBxAEiyqzxc.so
- /data/data/####/app_armeabi/libjni-comsysremindR002.so
- /data/data/####/files/83bf46f2b4e35a0f9c967cd01d154a8.data
- /data/data/####/files/.snow/.service
- /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.dat
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.snow/checkFile9
- /data/data/####/files/.snow/checkFile7
- /data/data/####/shared_prefs/com.monetiseguys.adsdk.preference.xml
- /data/data/####/files/.snow/checkFile0
- /data/data/####/cache/tomb.zip
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/databases/sp_db.mirror
- /data/data/####/files/nYlYSMWbGsbTavdZlala.jar
- /data/data/####/databases/webviewCookiesChromium.db.mirror
- /data/data/####/app_armeabi/liblegudb.so
- /data/data/####/files/.snow/.center.tapk
- /data/data/####/files/LXtzwvqtrxRlyavpdynamicloader.jar
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/security_info
- /data/data/####/files/.snow/.ukd
- /data/data/####/databases/bugly_db_legu.mirror
- /data/data/####/app_armeabi/libdaemon_api21.so
- /sdcard/.pluto_data/ab506f17f29f8f71a1eadc4e1487ddd0/images/cb80f413d5bdd3a7b365b4782a1622e0
- /data/data/####/files/local_crash_lock
- /data/data/####/files/native_record_lock
- /sdcard/.windy/508e8558f784e3a21d3368e4763e2693.tmp
- /data/data/####/files/.snow/.uks
- /data/data/####/files/.snow/.dg
- /data/data/####/app_armeabi/libshella-2.10.1.so
- /data/data/####/databases/ua.db
- /sdcard/.pluto_data/ab506f17f29f8f71a1eadc4e1487ddd0/client.id
- /data/data/####/files/AyuSnsgpJNCmGCZwdaemon.so
- /data/data/####/files/.snow/.zip/ym
- /data/data/####/app_bugly/rqd_record.eup
- /data/data/####/files/eopcmjt/libHkvFXwaLTSDvKsFFbt.so
- /data/data/####/files/qNiSBgujjBxAEiyqzxc.jar
- /sdcard/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.dat
- /data/data/####/app_armeabi/mix.dex
- /sdcard/.pluto_data/ab506f17f29f8f71a1eadc4e1487ddd0/images/5d74127c127c7ee704225168893ab7c8
- /data/data/####/app_armeabi/libcore.so
- /sdcard/.pluto_data/ab506f17f29f8f71a1eadc4e1487ddd0/images/3e4c73fa708f9dee6b9ef5e4a8d36731
- /data/data/####/files/.snow/.zip/rsh
- /sdcard/.windy/49f19b1b089f018a1792a4c581f93d58.tmp
- /data/data/####/databases/webview.db.mirror
- /data/data/####/databases/ReminderDatabase-journal
- /data/data/####/files/.default/83bf46f2b4e35a0f9c967cd01d154a8.data.temp
- /data/data/####/app_indicators/indicator_p
- /data/data/####/files/libcqqVdNbNsWngeIrdbootstrap.so
- /data/data/####/files/.snow/supolicy
- /data/data/####/files/.snow/.zip/post.sh
- /data/data/####/app_indicators/indicator_d
- /data/data/####/tx_shell/libufix.so
- /data/data/####/files/.snow/.zip/boy
- /data/data/####/databases/ReminderDatabase.mirror
- /data/data/####/files/HkvFXwaLTSDvKsFFbt.jar
- /data/data/####/files/.snow/busybox
- /data/data/####/mix.dex
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/shared_prefs/SSPPrefe.xml.bak
- /data/data/####/databases/ua.db-journal
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/app_armeabi/libcqqVdNbNsWngeIrdbootstrap.so
- /sdcard/.pluto_data/ab506f17f29f8f71a1eadc4e1487ddd0/images/793c49d8ae8f8583d4fdbfbf1ea38f5f
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/databases/sp_db-journal
- /data/data/####/app_armeabi/mixz.dex
- /data/data/####/files/.imprint
- /data/data/####/databases/ua.db.mirror
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/files/.snow/checkFile13
- /data/data/####/files/HkvFXwaLTSDvKsFFbt.dex
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/files/.snow/.uok
- /data/data/####/files/.default/.p.apk
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/databases/cc.db.mirror
Sets the 'executable' attribute to the following files:
- /data/data/####/tx_shell/libufix.so
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/files/.snow/.dg
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/.snow/.ukd
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/files/.snow/busybox
- /data/data/####/files/.snow/.uok
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.service
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/app_bugly/tomb_148542332266.txt
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/files/.snow/supolicy
- /data/data/####/files/.snow/.zip/post.sh
- /data/data/####/files/.snow/.uks
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
