Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.456.origin
Network activity:
Connecting to:
- ad####.####.com
- k####.####.pw
- s####.####.pw
HTTP GET requests:
- ad####.####.com/sdk/ybx/lib_v4.0.9.zip
HTTP POST requests:
- k####.####.pw/D470F30AAB5F4EACADE0DFD5004BB705
- k####.####.pw/FA193DF6DFDF511DCB16AEA4AA91E793
- s####.####.pw/CD382781B46D648D05B8C219784B4DD1
Modified file system:
Creates the following files:
- <Package Folder>/databases/sh.db
- <Package Folder>/databases/sh.db-journal
- <Package Folder>/files/<Package>rt.apk
- <Package Folder>/files/F_1501850197507_-1260267459.zip
- <Package Folder>/files/rtell.jar
- <Package Folder>/shared_prefs/admainlib.xml
- <Package Folder>/shared_prefs/common_shell34.xml
- <Package Folder>/shared_prefs/inslib.xml
- <SD-Card>/lysy/####/config.ini
Miscellaneous:
Loads the following dynamic libraries:
- update-jni-1.0.1
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
