Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.247.origin
- Android.Triada.248.origin
Downloads the following detected threats from the Web:
- Android.Triada.247.origin
- Android.Triada.248.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- 1####.####.75
- 6####.####.140
- a####.####.com
- c####.####.com
- gamean####.####.com
- huangda####.com
- mei####.####.com
- p####.####.cc
- p####.####.com
- pa####.####.com
- w####.####.com
HTTP GET requests:
- c####.####.com/20170712/tongyu-pay-lib-2158-ymt.apk
- gamean####.####.com/photo/156.png
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- mei####.####.com/wodeanjila/tongyuwodeanjila.apk
- p####.####.com/sdkMis/getRdoUrl
- w####.####.com/rdo/order?mcpid=####&orderNo=####&feeCode=####&reqTime=##...
HTTP POST requests:
- 1####.####.75/GameAnswer/comment/getCommentsByPage
- 6####.####.140/ando/x/liv?app_id=####&r=####
- a####.####.com/app_logs
- p####.####.cc/index.php/API
- pa####.####.com/mobile-service/getOpenImsiMobilePhone.json
Modified file system:
Creates the following files:
- /data/anr/traces.txt
Miscellaneous:
Executes next shell scripts:
- /data/data/com.four.pet.color.hm/code-3161569/gCs74RtqiavWdXHx -p com.four.pet.color.hm -c com.sadf.wjbfq.ufzhaq.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- cat /sys/class/net/wlan0/address
