Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.288.origin
Downloads the following detected threats from the Web:
- Android.Triada.288.origin
Network activity:
Connecting to:
- a####.####.cn
- a####.####.cn:12956
- d####.####.in:83
- hid####.####.cn
- j####.####.com
- s####.####.in
- s####.####.in:83
HTTP GET requests:
- hid####.####.cn/N7467685875537325?e=####&token=F####
- j####.####.com/hm/hms.png
HTTP POST requests:
- a####.####.cn/v1/api/getSolutions
- a####.####.cn:12956/v1/pub/regist
- d####.####.in:83/api/hms_ctrl.php?ch=####&ver=####
- s####.####.in/api/report.php
- s####.####.in:83/api/report.php
Modified file system:
Creates the following files:
- <Package Folder>/app_outdex/libdexprotector.pmt68n.2740.so
- <Package Folder>/databases/download.db-journal
- <Package Folder>/databases/token.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/10010
- <Package Folder>/files/####/24793
- <Package Folder>/files/####/37325
- <Package Folder>/files/####/40021
- <Package Folder>/files/####/40040
- <Package Folder>/files/####/53469
- <Package Folder>/files/####/Agcr.tmp
- <Package Folder>/files/hms_tmp.jar
- <Package Folder>/files/mySdk.jar
- <Package Folder>/hms.png
- <Package Folder>/shared_prefs/FirstConfig.xml
- <Package Folder>/shared_prefs/RootFlag.xml
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /proc/version
- chmod -R 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution
- chmod -R 777 <Package Folder>/files/pl/.Solution
- chmod 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution/10010
- chmod 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution/24793
- chmod 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution/37325
- chmod 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution/40021
- chmod 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution/40040
- chmod 777 /data/data/com.gmail.gailjordan0526.trianglenumbers/files/pl/.Solution/53469
- chmod 777 <Package Folder>/files/pl/.Solution/10010
- chmod 777 <Package Folder>/files/pl/.Solution/24793
- chmod 777 <Package Folder>/files/pl/.Solution/37325
- chmod 777 <Package Folder>/files/pl/.Solution/40021
- chmod 777 <Package Folder>/files/pl/.Solution/40040
- chmod 777 <Package Folder>/files/pl/.Solution/53469
- getprop ro.board.platform
- getprop ro.product.cpu.abi
- sh
- sysspm Cfdszgtews
- sysspm Odfzgkelzd
Uses special library to hide executable bytecode.
