Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- q####.####.cn
- imgc####.####.com
- d####.####.cn
- and####.####.com
- a####.####.cn
- a####.####.com
HTTP GET requests:
- d####.####.cn/jarFile/SDKAutoUpdate/ber.jar
- a####.####.cn/2/game/msgbox/latest?app_key=####&game_id=####&s_s=####&ch...
- a####.####.cn/2/game/general/baseinfo?app_key=####&channel_id=####&os=##...
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his...
HTTP POST requests:
- s####.####.com/activate
- q####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- a####.####.cn/2/game/startup/upload
- a####.####.com/app_logs
- and####.####.com/rqd/async
Modified file system:
Creates the following files:
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.sig
- /data/data/####/tx_shell/libufix.so
- /data/data/####/app_e_qq_com_setting/gdt_suid
- /data/data/####/app_e_qq_com_setting/sdkCloudSetting.cfg
- /data/data/####/files/yoyda
- /data/data/####/mix.dex
- /data/data/####/app_e_qq_com_plugin/update_lc
- /data/data/####/shared_prefs/hungryshark1.xml
- /data/data/####/files/a.jar
- /data/data/####/shared_prefs/a.xml.bak
- /data/data/####/tx_shell/libnfix.so
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/dbojxxw-journal
- /data/data/####/shared_prefs/ktplay.xml
- /data/data/####/files/.imprint
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/a.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar.sig
- /sdcard/ktplay/d
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.tmp
- /data/data/####/app_buoclasses.jar
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.jar
- /sdcard/Download/gov/4.7_ber.jar.tmp
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_e_qq_com_plugin/gdt_plugin.next.sig
- /data/data/####/files/umeng_it.cache
- /data/data/####/tx_shell/libshella-2.10.1.so
- /data/data/####/files/security_info
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/shared_prefs/W_Key.xml.bak
- /data/data/####/files/local_crash_lock
- /data/data/####/files/native_record_lock
- /data/data/####/app_e_qq_com_setting/devCloudSetting.sig
Sets the 'executable' attribute to the following files:
- /data/data/####/tx_shell/libshella-2.10.1.so
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop ro.aa.romver
- logcat -d -v threadtime
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- chmod 700 /data/data/####/tx_shell/libshella-2.10.1.so
- chmod 700 /data/data/####/tx_shell/libnfix.so
- chmod 700 /data/data/####/tx_shell/libufix.so
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.build.rom.id
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
