Android.Hidden.4790

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cg####.com:80

DNS requests:

cg####.com

HTTP POST requests:

cg####.com/admin/hr/pu//pu.php?do=####

Modified file system:

Creates the following files:

/data/anr/traces.txt
<Package Folder>/files/10_d20171116122811.json
<Package Folder>/files/10_d20171116122811.jsonx
<Package Folder>/files/10_d20171116122816.json
<Package Folder>/files/10_d20171116122816.jsonx
<Package Folder>/files/10_d20171116122818.json
<Package Folder>/files/10_d20171116122818.jsonx
<Package Folder>/files/20_d20171116122811.json
<Package Folder>/files/20_d20171116122811.jsonx
<Package Folder>/files/20_d20171116122816.json
<Package Folder>/files/20_d20171116122816.jsonx
<Package Folder>/files/20_d20171116122818.json
<Package Folder>/files/20_d20171116122818.jsonx
<Package Folder>/files/80_d20171116122810.txt
<Package Folder>/files/80_d20171116122810.txtx
<Package Folder>/files/80_d20171116122811.txt
<Package Folder>/files/80_d20171116122816.txt
<Package Folder>/files/80_d20171116122818.txt
<Package Folder>/files/90_d20171116122811.json
<Package Folder>/files/90_d20171116122811.jsonx
<Package Folder>/files/90_d20171116122816.json
<Package Folder>/files/90_d20171116122816.jsonx
<Package Folder>/files/90_d20171116122818.json
<Package Folder>/files/90_d20171116122818.jsonx
<Package Folder>/files/a0_d20171116122811.json
<Package Folder>/files/a0_d20171116122811.jsonx
<Package Folder>/files/a0_d20171116122816.json
<Package Folder>/files/a0_d20171116122816.jsonx
<Package Folder>/files/a0_d20171116122818.json
<Package Folder>/files/a0_d20171116122818.jsonx
<Package Folder>/files/f3_d20171116122811.zip
<Package Folder>/files/f3_d20171116122816.zip
<Package Folder>/files/f3_d20171116122818.zip
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml

Miscellaneous:

Executes next shell scripts:

/system/bin/su -c cd /
/system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122810.txt
/system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122811.txt
/system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122816.txt
/system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122818.txt
cat /proc/self/status | grep Cap
cd /
id
ls acct cache config d data default.prop dev etc file_contexts init init.rc init.superuser.rc init.trace.rc init.usb.rc init.x86.rc lib mnt proc property_contexts sbin sdcard seapp_contexts selinux sepolicy storage sys system ueventd.android_x86.rc ueventd.rc vendor x86.prop -R -a -l
sh -c cd /
sh -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122811.txt
sh -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122816.txt
sh -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122818.txt