Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.433.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.433.origin
Network activity:
Connecting to:
- t####.####.com
- p####.####.com:6088
- 1####.####.189:9090
- p####.####.com
- c####.####.com
- f####.####.com
- w####.####.com
HTTP GET requests:
- w####.####.com/adx.php?c=####
- f####.####.com/it/u=87447634,121293644&fm=76
- c####.####.com/title.png
- 1####.####.189:9090/ad2016/ad/getAdconfnew
- p####.####.com/c/1493298738208
- c####.####.com/s?v####
HTTP POST requests:
- p####.####.com:6088/s/
- p####.####.com/t/1493298741028
- p####.####.com/p/1493298738487
- t####.####.com/checkRG.php
Modified file system:
Creates the following files:
- /sdcard/Android/n5/sys_install
- /data/data/####/shared_prefs/SP_CACHE.xml
- /sdcard/Android/n5/.res/7178D8700E7A03DA299E97F6917AC34F
- /sdcard/Android/n5/config
- /data/data/####/files/xcnmhr
- /data/data/####/shared_prefs/SP_CACHE.xml.bak
- /sdcard/Android/n5/master
- /data/data/####/shared_prefs/rg_sp_cache.xml
- /sdcard/Android/n5/deviceId
- /data/data/####/app_aucjyy/463966918F731BEA8EFDCD43D854BA13.jar
- /data/data/####/shared_prefs/rg_sp_cache.xml.bak
- /sdcard/Android/n5/master.lock
- /data/data/####/app_cache/res.png
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 44 40 332740 /data/data/####/app_aucjyy/463966918F731BEA8EFDCD43D854BA13.jar 1251640122 1397460273 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/
Contains functionality to send SMS messages automatically.
