Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.32
Downloads the following detected threats from the Web:
- Android.RemoteCode.32
Network activity:
Connecting to:
- a####.####.cn
- i####.####.cn
- tb####.com
HTTP GET requests:
- a####.####.cn/soon/54804.html
- i####.####.cn/iplookup/iplookup.php?format=####
- tb####.com/image/lb04.jpg
Modified file system:
Creates the following files:
- <Package Folder>/EOZTzhVG.dex (deleted)
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/files/####/libtm_pay.so
- <Package Folder>/files/####/libus.so
- <Package Folder>/shared_prefs/MYYR.xml
- <SD-Card>/Android/####/-1000680088.0.tmp
- <SD-Card>/Android/####/-1001603609.0.tmp
- <SD-Card>/Android/####/-1002527130.0.tmp
- <SD-Card>/Android/####/-1003450651.0.tmp
- <SD-Card>/Android/####/-1004374172.0.tmp
- <SD-Card>/Android/####/-1005297693.0.tmp
- <SD-Card>/Android/####/-1006221214.0.tmp
- <SD-Card>/Android/####/-1007144735.0.tmp
- <SD-Card>/Android/####/-1008068256.0.tmp
- <SD-Card>/Android/####/-1008991777.0.tmp
- <SD-Card>/Android/####/-1029309239.0.tmp
- <SD-Card>/Android/####/-1030232760.0.tmp
- <SD-Card>/Android/####/-1031156281.0
- <SD-Card>/Android/####/-1032079802.0
- <SD-Card>/Android/####/-1033003323.0
- <SD-Card>/Android/####/-1033926844.0.tmp
- <SD-Card>/Android/####/-1034850365.0.tmp
- <SD-Card>/Android/####/-1035773886.0.tmp
- <SD-Card>/Android/####/-1037620928.0.tmp
- <SD-Card>/Android/####/-1057938390.0.tmp
- <SD-Card>/Android/####/-1058861911.0.tmp
- <SD-Card>/Android/####/-1059785432.0.tmp
- <SD-Card>/Android/####/-1060708953.0.tmp
- <SD-Card>/Android/####/-1061632474.0.tmp
- <SD-Card>/Android/####/-1062555995.0.tmp
- <SD-Card>/Android/####/-1063479516.0.tmp
- <SD-Card>/Android/####/-1064403037.0.tmp
- <SD-Card>/Android/####/-1065326558.0.tmp
- <SD-Card>/Android/####/-866799924.0.tmp
- <SD-Card>/Android/####/-867723445.0.tmp
- <SD-Card>/Android/####/-947115870.0.tmp
- <SD-Card>/Android/####/-948039391.0.tmp
- <SD-Card>/Android/####/-948962912.0.tmp
- <SD-Card>/Android/####/-949886433.0.tmp
- <SD-Card>/Android/####/-950809954.0.tmp
- <SD-Card>/Android/####/-951733475.0.tmp
- <SD-Card>/Android/####/-972050937.0.tmp
- <SD-Card>/Android/####/-972974458.0.tmp
- <SD-Card>/Android/####/-973897979.0.tmp
- <SD-Card>/Android/####/-974821500.0.tmp
- <SD-Card>/Android/####/-975745021.0
- <SD-Card>/Android/####/-976668542.0.tmp
- <SD-Card>/Android/####/-977592063.0
- <SD-Card>/Android/####/-978515584.0.tmp
- <SD-Card>/Android/####/-979439105.0.tmp
- <SD-Card>/Android/####/-980362626.0
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
Miscellaneous:
Executes next shell scripts:
- <dexopt>
