Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Hmad.2
- Android.Hmad.7.origin
- Android.Backdoor.336.origin
- Android.Xiny.10.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.336.origin
Network activity:
Connecting to:
- epup####.####.com:7013
- d2h8j6q####.####.net
- ecup####.####.com
- i####.####.com
- epre####.####.com:7012
- e####.####.com:8011
- p####.####.com
- ecup####.####.com:8013
- l####.####.net
- d####.####.com
- e####.####.com
- s####.####.com
- e####.####.com:7011
- t####.####.net
- o####.####.com:7070
- b####.####.net
- epre####.####.com
- ecre####.####.com:8012
- b####.####.net:5050
- m####.####.COM
- a####.####.com
HTTP GET requests:
- i####.####.com/creative/1607/19/28dc55abfb400153-icon1024.png
- ecup####.####.com:8013/ukup.do?mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networkname=####&operatorsn...
- d2h8j6q####.####.net/oversea/lockad/logo/1481096613742.png
- p####.####.com/stat/aos/v3/active/req?s=####
- d2h8j6q####.####.net/oversea/pushad/logo/73f37fb6-4223-4d4e-8e21-966b691a3290.png
- i####.####.com/creative/1701/07/de65189f690faf8e-unnamed.jpg
- d2h8j6q####.####.net/oversea/lockad/logo/1481247530897.png
- d####.####.com/thinking/group/rtt0123_652.apk
- d2h8j6q####.####.net/oversea/lockad/logo/1481880152867.png
- i####.####.com/creative/1701/07/82e4b2bc19619844-unnamed.jpg
- d2h8j6q####.####.net/oversea/lockad/img/1481787089203.jpg
- p####.####.com/push/aos/v1/req?s=####
- d2h8j6q####.####.net/oversea/lockad/img/1481880152922.jpg
- e####.####.com:8011/ugetad.do?kitmd=####&count=####&mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networ...
- ecup####.####.com/getccontrol.do?mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networkname=####&operator...
- ecre####.####.com:8012/upostdata.do?data=####&mid=####&uuid=####&imid=####&kv=####&sv=####&appkey=####&appname=####&pname=####&model=####&networkname=...
- p####.####.com/popot/aos/v2/eff?s=####
- d2h8j6q####.####.net/oversea/lockad/img/1481247530884.png
- i####.####.com/creative/1511/13/b3de5a793147a4a7-icon.png
- i####.####.com/creative/1701/10/c9f52d29e4daa19b-unnamed.png
- i####.####.com/creative/1611/29/ece911ad096e08fb-hot.png
- p####.####.com/popot/aos/v2/req?s=####
- d2h8j6q####.####.net/oversea/pushad/logo/18a8ec2b-621d-446d-af54-f745ee19be8a.jpg
- i####.####.com/creative/1701/10/98547187eced0f66-unnamed.png
- p####.####.com/push/aos/v1/eff?s=####
HTTP POST requests:
- epre####.####.com/ppostdata.do
- a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- m####.####.COM/gcview/api/910
- m####.####.COM/pmsg/api/20
- e####.####.com/pcheckvalid.do
- p####.####.com/v1/android/packages?rt=####&sign=####
- t####.####.net/g/d
- b####.####.net/
- o####.####.com:7070/chnos/ospay/pytstart.do
- l####.####.net/gkview/info/601
- epre####.####.com:7012/ppostdata.do
- s####.####.com/ggview/rsddateindex
- b####.####.net:5050/
- e####.####.com:7011/pgetad.do
- epup####.####.com:7013/pkup.do
- ecup####.####.com/getccontrol.do
Modified file system:
Creates the following files:
- /sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418293688.log
- /data/data/####/shared_prefs/pref_longtime.xml
- /data/data/####/shared_prefs/flowapp_shared.xml
- /data/data/####/shared_prefs/time_preferences.xml
- /sdcard/.s_d_p/.im
- /data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml.bak
- /data/data/####/shared_prefs/pref_shorttime.xml
- /data/data/####/files/.snow/b.png
- /data/data/####/shared_prefs/initdata.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/467f628f2cdb577710d670694664b726-journal
- /sdcard/Android/data/.dataycache/i42d45df023jnkdd93la483f9xGFKXI
- /data/data/####/files/.snow/myshell
- /data/data/####/files/armeabi/libmonitor.so
- /data/data/####/shared_prefs/gfprf.xml
- /data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/files/mylala/.p.apk
- /data/data/####/files/.snow/.client
- /data/data/####/files/ZQAgenttcagent.db-journal
- /data/data/####/files/.snow/.zip/rt8
- /sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/312eaf960118256849dadda3503cf47e
- /data/data/####/files/cpf/cpf.txt
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/99852ec079e0666451fbe69c94d38d0b
- /sdcard/Android/data/un/1e4hai1k78qpc50enpydr2a80.png.bak
- /data/data/####/databases/XKwVoK0huy3R
- /sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418303499.log
- /data/data/####/shared_prefs/indion.xml
- /sdcard/Android/data/com.osms.pay/plugins/com.osms.pay.msplugin.apk
- /data/data/####/shared_prefs/fpksp.xml.bak
- /data/data/####/files/.androidod/ac.jar.a
- /data/data/####/lj/cl.zip
- /data/data/####/shared_prefs/w4dw9t5c4.xml
- /data/data/####/files/.snow/.dico.apk
- /data/data/####/databases/MF_CFG-journal
- /data/data/####/databases/fx_dd.db-journal
- /data/data/####/shared_prefs/id_preferences.xml
- /data/data/####/files/.snow/.service
- /data/data/####/databases/P15pKIjsm64m-journal
- /data/data/####/.lib/libexecmain.so
- /data/data/####/databases/74ede8691f1a3aa2d5ea3e287641e108
- /data/data/####/databases/gpab.db-journal
- /data/data/####/files/.snow/.ir
- /data/data/####/app_jc/tfp.jar
- /data/data/####/files/.snow/checkFile0
- /data/data/####/app_jni/libskin
- /data/data/####/app_libs/libabcde.so
- /data/data/####/databases/fp.db-journal
- /sdcard/.s_d_p/.ual
- /data/data/####/databases/wIU6pTyUBYWX-journal
- /data/data/####/files/.snow/.center.tapk
- /sdcard/Android/data/un/631dm3h2272rybxgwybl7a6s3.png.bak
- /data/data/####/files/.snow/.dlme.apk
- /data/data/####/shared_prefs/fx2016_shared.xml.bak
- /sdcard/com/android/system/uid.sys
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/databases/wsUL1uCdKvjD
- /data/data/####/shared_prefs/fpksp.xml
- /sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/d1bdec8c0ff7b9d0d66207a0ae40c3ef
- /sdcard/Android/data/shard/.UUID
- /data/data/####/databases/467f628f2cdb577710d670694664b726
- /sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418298460.log
- /data/data/####/files/.snow/.uks
- /sdcard/cpf/cpf.txt
- /data/data/####/files/.snow/.dg
- /sdcard/Android/data/un/6hg718nd6hjeer95n04b4v5be.png.bak
- /data/data/####/databases/XKwVoK0huy3R-journal
- /data/data/####/files/.snow/.dlsb.apk
- /sdcard/Android/data/un/6yb225p6fy54z25ppyx3fi1fj.png.bak
- /data/data/####/dj/cd.zip
- /sdcard/Android/data/.dataycache/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
- /data/data/####/shared_prefs/flowapp_shared.xml.bak
- /data/data/####/app_jc/dfx.jar
- /data/data/####/databases/T1oX0rhhuXWt-journal
- /data/data/####/shared_prefs/data.xml
- /data/data/####/shared_prefs/initdata.xml.bak
- /sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418312410.log
- /data/data/####/files/ZQAgenttcagent.db
- /sdcard/Android/data/un/7dauoe6ibf5j1mzazgzdpz4td.png.bak
- /sdcard/Android/data/un/2y9o56vvzx715l7cjvscwrhby.png.bak
- /data/data/####/shared_prefs/fx2016_shared.xml
- /sdcard/.tcookieid
- /data/data/####/shared_prefs/fpssp.xml
- /data/data/####/app_jc/tfx.jar
- /data/data/####/databases/T1oX0rhhuXWt
- /sdcard/Android/data/fp/38522.png
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/databases/statistics_db-journal
- /data/data/####/databases/gpab.db
- /data/data/####/shared_prefs/appstarttwo.xml
- /sdcard/Android/data/.mycache/.C2655DBDD5C7328BA5EF149B2A8261A0/b3f692e2857d0241278e60282f73ea0a
- /data/data/####/files/.snow/.ukd
- /data/data/####/databases/74ede8691f1a3aa2d5ea3e287641e108-journal
- /data/data/####/files/.snow/supolicy
- /sdcard/Android/data/fp/287538.png
- /data/data/####/.lib/libexec.so
- /data/data/####/qj/cq.zip
- /sdcard/Android/data/.doujincache/.ECDF5D7F3EB26A54256D1994F72EEB4D/876eb4740f336f06ae2733ca9ffcae33
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/busybox
- /data/data/####/shared_prefs/gfprf.xml.bak
- /data/data/####/yj/cy.zip
- /sdcard/Android/data/.mycache/.C2655DBDD5C7328BA5EF149B2A8261A0/28be79019ec68f3237ccf6e943e2067d
- /data/data/####/databases/wIU6pTyUBYWX
- /data/data/####/databases/c13937b2d660a6975f7a512952c2e306
- /data/data/####/databases/wsUL1uCdKvjD-journal
- /data/data/####/databases/jqIqJYOT3JpT-journal
- /data/data/####/files/dd0c3e10c47fe15157815e8a7bb5546b.data
- /data/data/####/files/.androidod/ac.jar
- /data/data/####/shared_prefs/moertry.xml
- /data/data/####/databases/P15pKIjsm64m
- /data/data/####/shared_prefs/appstartone.xml
- /sdcard/.4d02db8e14/crash/crash-2017-01-26-1485418308039.log
- /data/data/####/shared_prefs/initdata_stats.xml
- /data/data/####/shared_prefs/fxssp.xml
- /data/data/####/app_jc/dfp.jar
- /data/data/####/databases/c13937b2d660a6975f7a512952c2e306-journal
- /data/data/####/jj/cj.zip
- /data/data/####/files/mylala/dd0c3e10c47fe15157815e8a7bb5546b.data.temp
- /data/data/####/shared_prefs/gpac.xml
- /data/data/####/files/.snow/a.xml
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/pref_shorttime.xml.bak
- /data/data/####/files/.snow/.uok
- /data/data/####/databases/fpdown.db-journal
- /data/data/####/databases/DATA_MF_CFG-journal
- /data/data/####/xj/cx.zip
- /data/data/####/files/.snow/.zip/mkdevsh
- /sdcard/Android/data/.mycache/.C2655DBDD5C7328BA5EF149B2A8261A0/cdf9465b879edaea1dfd4bc260f5ef5a
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.snow/.dg
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/busybox
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.service
- /data/data/####/qj/cq.zip
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/dj/cd.zip
- /data/data/####/files/.snow/b.png
- /data/data/####/files/.snow/.client
- /data/data/####/files/.snow/.ir
- /data/data/####/yj/cy.zip
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/jj/cj.zip
- /data/data/####/files/.snow/myshell
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/.snow/a.xml
- /data/data/####/files/.snow/.ukd
- /data/data/####/lj/cl.zip
- /data/data/####/files/.snow/.uok
- /data/data/####/xj/cx.zip
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/files/.snow/supolicy
- /data/data/####/files/.snow/.uks
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- sh
- getprop ro.build.description
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
