Android.DownLoader.2226

Malicious functions:

Executes code of the following detected threats:

Downloads the following detected threats from the Web:

Network activity:

Connecting to:

HTTP GET requests:

HTTP POST requests:

Modified file system:

Creates the following files:

<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591C258500F8-0001-0844-3F88B07B0FD0SessionOS.cls_temp
/data/anr/traces.txt
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591C258500F8-0001-0844-3F88B07B0FD0SessionDevice.cls_temp
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/com.crashlytics.settings.json
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap
<Package Folder>/shared_prefs/ddspname.xml
<Package Folder>/files/.imprint
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591C258500F8-0001-0844-3F88B07B0FD0SessionApp.cls_temp
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/initialization_marker
<Package Folder>/databases/dbname-journal
<Package Folder>/app_dex/ddcp.dex
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics_to_send/sa_70c136e5-9d6f-4719-bd52-dad1ca4dc9d5_1495016838881.tap
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/session_analytics.tap.tmp
<Package Folder>/files/.TwitterSdk/v/com.crashlytics.sdk.android/591C258500F8-0001-0844-3F88B07B0FD0BeginSession.cls_temp
<Package Folder>/shared_prefs/sharedPreferencesName.xml
<Package Folder>/shared_prefs/com.crashlytics.android.internal.D.xml
<Package Folder>/databases/dbname
<Package Folder>/cache/ddcp.dex

Miscellaneous:

Executes next shell scripts:

logcat -v brief *:V
sh
<dexopt>
/system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
su

Uses elevated priveleges.

Contains functionality to send SMS messages automatically.