Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.122.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- 5####.####.com
- h####.####.com
- c####.####.net
- s####.####.cn
- c####.####.cc
- i####.####.cc
- l####.####.com
- i####.####.cc:8080
- i####.####.cn
HTTP GET requests:
- i####.####.cc/MTProject/MTContr?action=####&terminalType=####&version=####
- 5####.####.com/sdkplugin/smssdk_v17.txt
- l####.####.com/kb416.php?ri=####
- i####.####.cn/iplookup/iplookup.php?format=####
- i####.####.cc:8080/MTProject/MTContr?action=####&terminalType=####&versi...
- c####.####.cc/IsInterface.php?ri=####&op=####&mac=####&vs=####&tm=####&k...
- i####.####.cc/MTProject/MTContr?action=####
HTTP POST requests:
- s####.####.cn/cn/reportErrorLog.do
- c####.####.net/config/update
- c####.####.net/dc/sync_adr
- h####.####.com/app.gif
- s####.####.cn/cn/smsSdk.do
- s####.####.cn/serverIP.do
- s####.####.cn/cn/prefetch.do
Modified file system:
Creates the following files:
- /data/data/####/EOZTzhVG.jar
- /sdcard/Sonnenblume/apayment.db-journal
- /data/data/####/files/.libs/libus.so
- /data/data/####/databases/dataeye_database_58D921C89F78658092824A91509B6F3F.db
- /data/data/####/databases/dataeye_database_58D921C89F78658092824A91509B6F3F.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/dc.58D921C89F78658092824A91509B6F3F.preferences.xml
- /sdcard/Sonnenblume/sf_idle.ini
- /data/data/####/shared_prefs/dc.58D921C89F78658092824A91509B6F3F.preferences.xml.bak
- /sdcard/.SystemService/58D921C89F78658092824A91509B6F3F/uid
- /data/data/####/shared_prefs/bill_list.xml
- /sdcard/.SystemService/58D921C89F78658092824A91509B6F3F/.account/2D7F07BB6125DEB407E92A22DC4AC550
- /sdcard/Sonnenblume/res.apk.u
- /sdcard/Sonnenblume/apayment.db
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 40 40 606360 /data/data/####/EOZTzhVG.jar 1225742597 2074961913 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- ls -l /system/sbin/su
- ls -l /vendor/bin/su
- /system/bin/sh
- ls -l /sbin/su
- ls -l /system/xbin/su
- ls -l /system/bin/su
Contains functionality to send SMS messages automatically.
