Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.558.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.558.origin
Network activity:
Connecting to:
- c####.####.com
- do####.####.com
- s####.####.com
HTTP GET requests:
- c####.####.com/vmupdate/pack/empty/empty/30200/vm_generic/102/-1/-1/vm.zip
- do####.####.com/getdomain.php?chid=####&subchid=####&cpmeta=####&type=##...
- s####.####.com/gensdkuser.php?chid=####&cpmeta=####&vercode=####&md5=###...
Modified file system:
Creates the following files:
- /data/media/####/11f24fa9d79a15dba2958dcc51170c9c.meta
- /data/media/####/11f24fa9d79a15dba2958dcc51170c9c.zip
- /data/media/####/apk.cfg (deleted)
- /data/media/####/compVersion
- /data/media/####/conveying
- /data/media/####/mainVersion
- <Package Folder>/.platformcache/####/kxqpplatform.jar.tmp
- <Package Folder>/.platformcache/####/libapplypatch.so
- <Package Folder>/.platformcache/####/main2.jar.tmp
- <Package Folder>/.platformcache/####/tmp.Ft2345
- <Package Folder>/.platformcache/####/tmp.Kq2345
- <Package Folder>/.platformcache/####/tmp.Yb2219
- <Package Folder>/.platformcache/####/tmp.ZN2328
- <Package Folder>/.platformcache/####/tmp.et2202
- <Package Folder>/.platformcache/####/tmp.wF2219
- <Package Folder>/.platformcache/####/tmp.xg2328
- <Package Folder>/.platformcache/lbextjartag
- <Package Folder>/.zmvmp/####/libkxqpzmvmpinf.30787134.217900000.so
- <Package Folder>/.zmvmp/####/libkxqpzmvmpinf.30787134.217900000.so.flag
- <Package Folder>/.zmvmp/####/libkxqpzmvmpinf.30787134.217900000.so.lock
- <Package Folder>/.zmvmp/####/libzmvmpcls.30787134.217900000.so
- <Package Folder>/.zmvmp/####/libzmvmpcls.30787134.217900000.so.flag
- <Package Folder>/.zmvmp/####/libzmvmpcls.30787134.217900000.so.lock
- <Package Folder>/.zmvmp_2072_905033/classes.dex
- <Package Folder>/.zmvmp_2115_906049/classes.dex
- <Package Folder>/.zmvmp_2138_906772/classes.dex
- <Package Folder>/.zmvmp_2155_906900/classes.dex
- <Package Folder>/.zmvmp_2171_907027/classes.dex
- <Package Folder>/.zmvmp_2202_910372/classes.dex
- <Package Folder>/.zmvmp_2219_910604/classes.dex
- <Package Folder>/.zmvmp_2328_966394/classes.dex
- <Package Folder>/.zmvmp_2345_966524/classes.dex
- <Package Folder>/apk/main.zip.dload
- <Package Folder>/apk/vm.zip.dload
- <Package Folder>/shared_prefs/excl_lb_chInfo.xml
- <Package Folder>/shared_prefs/excl_lb_domain.xml
- <Package Folder>/shared_prefs/excl_lb_extractInfo.xml
- <Package Folder>/shared_prefs/excl_lb_gameInfo.xml
- <Package Folder>/shared_prefs/excl_lb_kxqp.xml
- <Package Folder>/shared_prefs/excl_lb_kxqpChannal.xml
- <Package Folder>/shared_prefs/excl_lb_lbmain.xml
- <Package Folder>/shared_prefs/excl_lb_platform.xml
- <Package Folder>/shared_prefs/excl_lb_soUpdate.xml
- <Package Folder>/shared_prefs/excl_lb_updateInfo.xml
- <Package Folder>/shared_prefs/excl_lb_userInfo.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 755 /data/data/com.mars.fktzd/.platformcache/tmp/main/main2.jar
- chmod 755 /data/data/com.mars.fktzd/.platformcache/tmp/vm/kxqpplatform.jar
- chmod 755 <Package Folder>/.platformcache/tmp/main/main2.jar
- chmod 755 <Package Folder>/.platformcache/tmp/vm/kxqpplatform.jar
- chmod 777 /data/data/com.mars.fktzd/apk
- chmod 777 /data/data/com.mars.fktzd/apk/main.zip.dload
- chmod 777 /data/data/com.mars.fktzd/apk/vm.zip.dload
- chmod 777 <Package Folder>/apk
- chmod 777 <Package Folder>/apk/main.zip.dload
- chmod 777 <Package Folder>/apk/vm.zip.dload
