Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.371.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.371.origin
Network activity:
Connecting to:
- 3####.####.com
- h####.####.com
- o####.####.com
- p####.####.com
- c####.####.com
- e####.####.com
- f####.####.com
- a####.####.com
- b####.####.com
HTTP GET requests:
- b####.####.com/wifi/js/touchslider.dev.js
- a####.####.com/a4d7bfeed0556e351450428584122.dex
- p####.####.com/s/18E2tH
- b####.####.com/wifi/js/jquery.min.js
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- b####.####.com/wifi/js/api_v1.2.12.min.js
- h####.####.com/h.js?6805ae2####
- b####.####.com/wifi/img/3.jpg
- e####.####.com/hmt/icon/21.gif
- b####.####.com/wifi/img/2.jpg
- c####.####.com/huluxia/wifi_update.txt
- b####.####.com/wifi/css/index.css
- b####.####.com/wifi/js/combineInfo.js?v201411####
- 3####.####.com/new/mobile/images/right-btn_3d43a5b.png
- b####.####.com/wifi/js/jquery.url.js
- b####.####.com/wifi/img/1.jpg
- h####.####.com/h.js?b2e86f6####
- 3####.####.com/new/mobile/images/icon_502506b.png
- f####.####.com/update.html?version=####
- b####.####.com/wifi/js/touchScroll.js
- b####.####.com/wifi/img/4.jpg
- b####.####.com/wifi/
- 3####.####.com/new/mobile/images/left-btn_19b0ee9.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
HTTP POST requests:
- a####.####.com/app_logs
- f####.####.com/adCenter/app/get
- f####.####.com/adCenter/seo/get
- o####.####.com/check_config_update
- f####.####.com/adCenter/ad/get
Modified file system:
Creates the following files:
- <Package Folder>/databases/hlx_wifi.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/dbname-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/dbname
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/cache/ddcp.dex
- <Package Folder>/shared_prefs/sharedPreferencesName.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/mobclick_agent_cached_<Package>2015032213
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/databases/hlx_wifi.db
- <Package Folder>/shared_prefs/ddspname.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
