Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.455.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.455.origin
Network activity:
Connecting to:
- a####.####.com
- d####.####.com
- f####.####.com
- p####.####.cn
- sdkco####.####.com
- trac####.####.com
- v####.####.com
HTTP GET requests:
- d####.####.com/f/3z2p.png
- f####.####.com/download/AdCenter/0091553a11afece938fbeb3cd02185d9da943a9...
- f####.####.com/f/3x6v.apk
- p####.####.cn/gdt/0/DAAOIaBAUAALQAAsBZL-ihDW3v3_JF.jpg/0?ck=####
- sdkco####.####.com/api/detail/668d9db84e526b1a3fc9b66976bd7ffb?ts=####&n...
- v####.####.com/gdt_stats.fcg?count=####&viewid0=####
HTTP POST requests:
- a####.####.com/union/uploadLogAdSDK
- trac####.####.com/track/v1
Modified file system:
Creates the following files:
- <Package Folder>/app_AdServer/AdServer_asset.apk
- <Package Folder>/app_analytics/####/libanalytics.so
- <Package Folder>/app_analytics/analytics.apk.tmp
- <Package Folder>/app_analytics/analytics_asset.apk
- <Package Folder>/cache/####/policy.cache
- <Package Folder>/databases/0<IMEI>1.db
- <Package Folder>/databases/0<IMEI>1.db-journal
- <Package Folder>/databases/E_ID<IMEI>.db
- <Package Folder>/databases/E_ID<IMEI>.db-journal
- <Package Folder>/databases/analytics.db-journal
- <Package Folder>/databases/data.db-journal
- <Package Folder>/databases/requests.db-journal
- <Package Folder>/files/014962128464611.jar
- <Package Folder>/files/149621284731901496212847319.jar
- <Package Folder>/shared_prefs/ReporterService.xml
- <Package Folder>/shared_prefs/apkloader.xml
- <Package Folder>/shared_prefs/apkloader.xml.bak
- <Package Folder>/shared_prefs/cn.kunpeng.paipai.k.a.xml
- <Package Folder>/shared_prefs/fac_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fappInfo_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml
- <Package Folder>/shared_prefs/fconf_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/finfo_f_<IMEI>.xml
- <Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml
- <Package Folder>/shared_prefs/ftrategy_f_<IMEI>.xml.bak
- <Package Folder>/shared_prefs/heartbeat.xml
- <Package Folder>/shared_prefs/i.xml
- <Package Folder>/shared_prefs/i_fac_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_finfo_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml
- <Package Folder>/shared_prefs/i_fionf_pre<IMEI>.xml.bak
- <Package Folder>/shared_prefs/moduleupdater.xml
- <Package Folder>/shared_prefs/updater.xml
- <SD-Card>/Download/####/3z2p.png.dat
- <SD-Card>/d/####/3z2s.jpg.dat
- <SD-Card>/d/####/it_3x6v.apk.tmp
- <SD-Card>/miad/####/3788831803
Miscellaneous:
Executes next shell scripts:
- <dexopt>
