Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.192.origin
Network activity:
Connecting to:
- s####.####.pub
- d####.####.com
- s####.####.cn
- s####.####.pub:6377
HTTP GET requests:
- d####.####.com/assets/j_close.png
- s####.####.pub/?phdh=####
- s####.####.pub:6377/?phdh=####
- d####.####.com/md5_08292b4b235a76748f1584426fadebed.jpg
HTTP POST requests:
- s####.####.cn/ncp.action?requestId=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/ki.xml
- /data/data/####/.lib/libexec.so
- /data/data/####/databases/Downloado
- /data/data/####/files/.flurryagent.41f9ea4c
- /data/data/####/shared_prefs/configo.xml.bak
- /sdcard/.android/files3/xbc.ahx.cb.dex
- /data/data/####/shared_prefs/vgp_id.xml
- /data/data/####/.lib/libexecmain.so
- /data/data/####/shared_prefs/vgp_id.xml.bak
- /data/data/####/shared_prefs/configo.xml
- /sdcard/Android/data/.nomedia
- /sdcard/Android/data/####/files/logo.png
- /sdcard/Android/data/####/cache/md5_08292b4b235a76748f1584426fadebed.jpg.cache
- /data/data/####/databases/Downloado-journal
- /sdcard/Android/data/####/files/cls.png
- /sdcard/Android/####/z.jar
- /data/data/####/shared_prefs/a.xml
- /data/data/####/databases/Logo-journal
- /data/data/####/shared_prefs/com.fungamesforfree.snipershooter.analytics.xml
- /sdcard/Android/data/####/files/id
- /sdcard/Android/data/code/CX.DAT
- /data/data/####/databases/cxcdownloads
- /sdcard/Android/data/####/files/filter
- /data/data/####/databases/Logo
- /data/data/####/databases/cxcdownloads-journal
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
