Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Click.136.origin
Downloads the following detected threats from the Web:
- Android.Click.136.origin
Network activity:
Connecting to:
- r####.####.net
- l####.####.cn
- a####.####.com
- l####.####.cn:88
HTTP GET requests:
- r####.####.net/update/7.3.5_rt_sf14
HTTP POST requests:
- a####.####.com/app_logs
- l####.####.cn:88/i/nu/v1/6112497805397405694?t=####
- l####.####.cn/i/lv/v1/6112497805397405694?t=####
Droppers:
Downloaded by the following detected threats from the Web:
- Android.Triada.102
Modified file system:
Creates the following files:
- /data/data/####/.wn/shared_prefs/extra
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.wn_data/.1947302420.zip.temp
- /data/data/####/.wn/shared_prefs/lconfig
- /data/data/####/.wn/shared_prefs/lconfig.bak
- /sdcard/.ups/config/extra
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/.wn/shared_prefs/sconfig
- /data/data/####/.wn/shared_prefs/locconfig
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/.ups/up/1745858843158214126.atemp
- /sdcard/.ups/db/st-journal
- /data/data/####/files/.imprint
- /data/data/####/files/.wn_data/.1947302420.zip
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 44 40 689096 /data/data/####/files/.wn_data/.1947302420.zip 0 1140732414 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
Contains functionality to send SMS messages automatically.
