Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.151.origin
Downloads the following detected threats from the Web:
- Android.Triada.151.origin
Network activity:
Connecting to:
- g####.####.pw:6601
- i####.####.cn
HTTP POST requests:
- g####.####.pw:6601/kitmain.aspx
- i####.####.cn/iplookup/iplookup.php?format=####
Modified file system:
Creates the following files:
- <Package Folder>/app_devid/uuid3
- <Package Folder>/app_hand/lastacc
- <Package Folder>/app_po/p7.apk
- <Package Folder>/shared_prefs/rtparam4.xml
- <SD-Card>/.hand/lastacce39b0fe3-6407-47d7-ac47-feaae1c792b9.tmp
- <SD-Card>/.uct/uuid3567506e7-329b-45a7-a23b-b52978caeee5.tmp
- <SD-Card>/rct/####/sts.sys91a0c68d-9ca2-4185-a856-4aa8723a2f1c.tmp
- <SD-Card>/sdtmp/id10d9a5088-a4e3-4705-addd-c81500dc3fb1.tmp
- <SD-Card>/sdtmp/id172616ab3-d168-4282-a988-89992400ac1a.tmp
- <SD-Card>/sdtmp/id22b256edf-3b5f-4c3e-a339-9e661722aa59.tmp
- <SD-Card>/sdtmp/id23c022b81-ae9d-4760-97e4-60e4fe23cb9c.tmp
- <SD-Card>/tmpsd11012/test.dat7f275939-f6b3-43f4-a45e-f74972bf6d20.tmp
- <SD-Card>/tmpsd11012/test.data9c81cc4-711f-4ea5-bc9c-39041087240b.tmp
Miscellaneous:
Executes next shell scripts:
- /system/bin/.nbwayxwzt
- <dexopt>
- cat /sys/class/net/wlan0/address
- conbb od2gf04pd9
- getprop ro.yunos.build.version
- ls -l /system/bin/su
