Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.32
Downloads the following detected threats from the Web:
- Android.RemoteCode.32
Network activity:
Connecting to:
- i####.####.cn
- i####.####.com
HTTP GET requests:
- i####.####.cn/iplookup/iplookup.php?format=####
- i####.####.com/service/getIpInfo2.php?ip=####
Modified file system:
Creates the following files:
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/libus.so
- <Package Folder>/files/####/libvia_pay.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <SD-Card>/pvnew/####/journal.tmp
Miscellaneous:
Executes next shell scripts:
- <dexopt>
