Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.147.origin
Network activity:
Connecting to:
- ad####.####.com
- xx####.com
- 1####.####.com
- c####.####.com
- xx####.com:8080
- ad####.####.com:9638
- 1####.####.9
- b####.####.cn
- l####.####.com
HTTP GET requests:
- c####.####.com/pic/20150606/0ebbfdf0baa940ea91b6e6b658e4ed2d.7292.png
- 1####.####.com/ic.asp
- c####.####.com/pic/20170210/9563959377c840cb9230530654986169.29933.jpg
- b####.####.cn/ad/impress?impressId=####&traceId=####&inAId=####&wPltId=#...
- l####.####.com/it?yexi=####&yexcb=####&yext=####&yexv=####
- b####.####.cn/ad/click?clickId=####&traceId=####&cp=####&inAId=####&wPlt...
- ad####.####.com:9638/zgapi-outservice2/smonitor?fr=####&xptp=####&snum=#...
- c####.####.com/pic/20170210/6ea978f88a18424798dbf0f4a0b940c3.7681.jpg
- c####.####.com/pic/20170210/60eed5d89db04176b6ddeda93be6d34a.28384.jpg
- l####.####.com/ct?slot=####&youdao_bid=####&yexi=####&yexcb=####&yext=####
- c####.####.com/pic/20170210/536ec0f735b3413cb116b735a97d6448.27015.jpg
- c####.####.com/pic/20170210/2748e547191a46ceb9f2b57c983e44cf.24233.jpg
- c####.####.com/pic/20161104/ec0923c7beb34beca4eb05b5adc45541.10048.jpg
- c####.####.com/pic/20170210/9aef3bcca7644897b6240fe0880d3e50.24933.jpg
- ad####.####.com/zgapi-outservice2/smonitor?fr=####&xptp=####&snum=####
HTTP POST requests:
- xx####.com/app/getAd
- xx####.com/app/reportParam
- 1####.####.9/yg/y.do
- xx####.com:8080/app/getConfig
Modified file system:
Creates the following files:
- <Package Folder>/files/box103.zip
- <Package Folder>/files/edev
- <Package Folder>/files/hpr
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/eu
Miscellaneous:
Executes next shell scripts:
- busybox ifconfig
- <dexopt>
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
