Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Loki.10.origin
- Android.Loki.30.origin
Downloads the following detected threats from the Web:
- Android.Loki.10.origin
- Android.Loki.30.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- analy####.####.com
- n####.####.com
- re####.####.com
- up####.####.com
HTTP GET requests:
- n####.####.com/setting?app_id=####&sign=####
- re####.####.com/ad/find?platform=####&os_version=####&package_name=####&...
HTTP POST requests:
- analy####.####.com/
- up####.####.com/upload_log?platform=####&os_version=####&package_name=##...
Modified file system:
Creates the following files:
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/databases/sp_db-journal
- <Package Folder>/databases/webview.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/agent_log
- <Package Folder>/files/####/crash_log
- <Package Folder>/files/####/de_mcrxyv
- <Package Folder>/files/####/libLKlzxHWykSBJWBEJlala.so
- <Package Folder>/files/####/libSNXZJDaJLwXTgwiRdynamicloader.so
- <Package Folder>/files/####/libwbONhjXPKTfZuYhWzxc.so
- <Package Folder>/files/LKlzxHWykSBJWBEJlala.jar
- <Package Folder>/files/SNXZJDaJLwXTgwiRdynamicloader.jar
- <Package Folder>/files/eXbUzdeSShxTgRtYdaemon.so
- <Package Folder>/files/libKJbAcPkDTiiPPlFGbootstrap.so
- <Package Folder>/files/wbONhjXPKTfZuYhWzxc.jar
- <Package Folder>/shared_prefs/com.nativedroid.module.offerprobe.xml
- <Package Folder>/shared_prefs/sdk_scl_pid_config.xml
- <SD-Card>/.googlex9/.xamdecoq0962
- <SD-Card>/.sysAndroid/dbversion
- <SD-Card>/.sysAndroid/sys
- <SD-Card>/.sysAndroid/system.android.db
- <SD-Card>/.sysAndroid/system.android.db-journal
Miscellaneous:
Executes next shell scripts:
- /system/bin/ping -c 1 107.155.31.37
- /system/bin/ping -c 1 52.2.132.38
- <dexopt>
