Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.433.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.433.origin
Network activity:
Connecting to:
- c####.####.com
- t####.####.com
- p####.####.com
- p####.####.com:6088
HTTP GET requests:
- p####.####.com/c/1493729623563
- t####.####.com/update.php?channel=####&uid=####&from=####&kernelVersion=...
- c####.####.com/s?v####
HTTP POST requests:
- p####.####.com:6088/s/
- t####.####.com/checkRG.php
Modified file system:
Creates the following files:
- /sdcard/Android/n5/sys_install
- /data/data/####/shared_prefs/SP_CACHE.xml
- /data/data/####/shared_prefs/rg_sp_cache.xml
- /sdcard/Android/n5/config
- /data/data/####/shared_prefs/SP_CACHE.xml.bak
- /sdcard/Android/n5/master
- /data/data/####/files/INSTALLATION
- /sdcard/Android/n5/deviceId
- /data/data/####/files/aejjqo
- /data/data/####/shared_prefs/rg_sp_cache.xml.bak
- /data/data/####/app_dqtefw/FE07E730A010A802AEA8AB3C88560BA4.jar
- /sdcard/Android/n5/master.lock
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 43 40 332740 /data/data/####/app_dqtefw/FE07E730A010A802AEA8AB3C88560BA4.jar 1251640122 1397460273 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system
Contains functionality to send SMS messages automatically.
