Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.16.origin
- Android.Mixi.13.origin
Network activity:
Connecting to:
- s####.####.com
- 4####.####.79
- g####.####.com
HTTP GET requests:
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
- s####.####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
HTTP POST requests:
- 4####.####.79/miguOper/api/business.do
- g####.####.com/cr/sv/getEPList
Modified file system:
Creates the following files:
- /data/data/####/files/1493299027390.jar
- /data/data/####/files/us.Bw9ZFE73cw8kITQhNXSp3MJ1wK737
- /data/data/####/files/sky8nfXtq.jar
- /data/data/####/files/us.sky8nfXtq6ZB3G920o8btru2dsgBy
- /data/data/####/files/.S1CH1S/E8DA4242CCE6870F257E23706DC33B51
- /data/data/####/files/us.2P06C9w0LP1bd2N0C8h4e506rX6oo
- /data/data/####/files/1493299015002_cgr.so
- /data/data/####/files/us.Kaq2TL17uW3LDWP0u0WRD98k1Oite
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/us.Ny95bI1JeacS0F0vLJWp9W99UqH5x
- /data/data/####/files/.gepd/gpdu
Miscellaneous:
Executes next shell scripts:
- sh -c /system/usr/toolbox rm -f /data/data/####/files/us.Kaq2TL17uW3LDWP0u0WRD98k1Oite > /dev/null 2>&1
- /system/bin/dexopt --dex 27 50 40 66944 /data/data/####/files/1493299027390.jar 1251052727 1662001824 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /data/data/####/files/us.Bw9ZFE73cw8kITQhNXSp3MJ1wK737 -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- getenforce
- chmod 0771 /data/data/####/.syslib-
- <error:2>
- /data/data/####/files/us.Ny95bI1JeacS0F0vLJWp9W99UqH5x -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f /data/data/####/files/us.Bw9ZFE73cw8kITQhNXSp3MJ1wK737 > /dev/null 2>&1
- sh /data/data/####/files/us.2P06C9w0LP1bd2N0C8h4e506rX6oo -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- sh /data/data/####/files/us.Bw9ZFE73cw8kITQhNXSp3MJ1wK737 -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- /system/bin/dexopt --dex 27 43 40 13452 /data/data/####/files/sky8nfXtq.jar 1230786788 -790161502 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- sh -c /system/usr/toolbox rm -f /data/data/####/files/sky8nfXtq.jar > /dev/null 2>&1
- /data/data/####/files/us.Kaq2TL17uW3LDWP0u0WRD98k1Oite -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- sh /data/data/####/files/us.Ny95bI1JeacS0F0vLJWp9W99UqH5x -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- /data/data/####/files/us.sky8nfXtq6ZB3G920o8btru2dsgBy -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- sh /data/data/####/files/us.Kaq2TL17uW3LDWP0u0WRD98k1Oite -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- sh /data/data/####/files/us.sky8nfXtq6ZB3G920o8btru2dsgBy -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f /data/data/####/files/us.Ny95bI1JeacS0F0vLJWp9W99UqH5x > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f /data/data/####/files/sky8nfXtq.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f /data/data/####/files/us.2P06C9w0LP1bd2N0C8h4e506rX6oo > /dev/null 2>&1
- /data/data/####/files/us.2P06C9w0LP1bd2N0C8h4e506rX6oo -h 5ac760207e544a0a90e79fe24d7368eb /data/data/####/.syslib-
Contains functionality to send SMS messages automatically.
