Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.396.origin
- Android.DownLoader.348.origin
- Android.DownLoader.455.origin
Network activity:
Connecting to:
- f####.####.com
- a####.####.com
HTTP GET requests:
- f####.####.com/f/wf0215.dat
- f####.####.com/f/3xc4.jpg
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/yoappInfo_pre.xml
- /data/data/####/shared_prefs/fcut_appInfo_pre.xml.bak
- /data/data/####/databases/qcut_download.db-journal
- /data/data/####/files/14854184904197.jar
- /sdcard/1485418491528q.jar
- /data/data/####/shared_prefs/yotrategy_pre.xml.bak
- /sdcard/Download/g_356507059351895/_os.dat
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/databases/yop_download.db-journal
- /data/data/####/shared_prefs/coni_io_356507059351895.xml
- /data/data/####/databases/db_d.db
- /data/data/####/shared_prefs/yo_fconf_pre.xml.bak
- /data/data/####/databases/po_download.db-journal
- /data/data/####/shared_prefs/ybappInfo_pre.xml
- /data/data/####/shared_prefs/fcut_trategy_pre.xml
- /data/data/####/shared_prefs/cn.jpush.serverconfig.xml
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /sdcard/Download/g_356507059351895/2479/3xc4.jpg.dat
- /data/data/####/files/14854184912409.jar
- /data/data/####/shared_prefs/iinfo_io_356507059351895.xml
- /data/data/####/shared_prefs/MyPrefsFile.xml
- /data/data/####/shared_prefs/fcut_conf_pre.xml
- /data/data/####/shared_prefs/yo_fconf_pre.xml
- /data/data/####/shared_prefs/itrategy_io_356507059351895.xml
- /data/data/####/shared_prefs/fcut_appInfo_pre.xml
- /data/data/####/shared_prefs/yoconf_pre.xml.bak
- /data/data/####/files/14854184953285.jar
- /sdcard/1485418491388u.jar
- /data/data/####/databases/E_ID356507059351895.db-journal
- /sdcard/1485418491671u.jar
- /data/data/####/shared_prefs/yoinfo_pre.xml
- /data/data/####/shared_prefs/ybconf_pre.xml
- /data/data/####/shared_prefs/i.xml
- /data/data/####/files/14854184909907.jar
- /data/data/####/shared_prefs/yoappInfo_pre.xml.bak
- /data/data/####/shared_prefs/itrategy_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/fcut_conf_pre.xml.bak
- /data/data/####/shared_prefs/ybappInfo_pre.xml.bak
- /data/data/####/files/14854184959635.jar
- /data/data/####/shared_prefs/coni_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml
- /data/data/####/shared_prefs/yoconf_pre.xml
- /data/data/####/shared_prefs/yoac_pre.xml
- /sdcard/1485418496366b.jar
- /sdcard/Download/b056463c7dbecb74839dcc856f2322fe_fs_cache/2479/3xc4.jpg.data
- /data/data/####/shared_prefs/yotrategy_pre.xml
- /data/data/####/shared_prefs/fcut_trategy_pre.xml.bak
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/files/14854184905660.jar
- /data/data/####/files/14854184907659.jar
- /data/data/####/databases/db_d.db-journal
- /data/data/####/files/14854184911130.jar
Miscellaneous:
Contains functionality to send SMS messages automatically.
