Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.371.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.371.origin
Network activity:
Connecting to:
- doud####.com
- a####.####.com
- placem####.####.com
- p####.####.com
HTTP GET requests:
- p####.####.com/s/18E2tH
- doud####.com/update.html?version=####
- a####.####.com/a4d7bfeed0556e351450428584122.dex
HTTP POST requests:
- doud####.com/adCenter/app/get
- a####.####.com/app_logs
- placem####.####.com/v1/apps/613aa87a-6572-4530-944d-f600286abd20/content
- doud####.com/adCenter/ad/get
- doud####.com/adCenter/seo/get
Modified file system:
Creates the following files:
- /data/data/####/files/Tapjoy/Cache/6c974ead6b403a4ccc27ff1980e8b1f385e335f617df38276ae7fd36a13b45bd
- /data/data/####/shared_prefs/fiverocks.xml
- /data/data/####/cache/ads1320935398.jar
- /data/data/####/files/Tapjoy/Cache/720f1c13bb5f274a42c765e1531f80cbfe3b9f2f173e0884a7251342ba52aca8
- /data/data/####/shared_prefs/admob.xml
- /data/data/####/files/Tapjoy/Cache/ae6bc38af361a64d34222516d61ce883a148f02af1cbe74b3828dcd36dcdf205
- /sdcard/Download/MonsterTruckJunkyard.txt
- /data/data/####/files/Tapjoy/Cache/363fd2a890cfb629dc7aa8febfe5d4371581d327dde4ab5a080a24f27fbbfb83
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/tjcPrefrences.xml
- /data/data/####/files/settings2
- /data/data/####/files/Tapjoy/Cache/399324a6cd38aaf37b1ee969d82c98c8f490db0508da2603cc18bca1ad037419
- /data/data/####/files/Tapjoy/Cache/f2389f076324d476fca6986e4c026c94005b1cebbbad2eec4b1e695b9ddea1c1
- /data/data/####/shared_prefs/ddspname.xml
- /data/data/####/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/Tapjoy/Cache/ce474ca9929115d27d111456840875861155d65ed2597440016c9d821b1a88dc
- /data/data/####/files/Tapjoy/Cache/f9027d6142eee7f05b9477d1be4013394dc6dfb8ed10b2bf1876deb2e1aa16bd
- /data/data/####/files/.imprint
- /data/data/####/files/Tapjoy/Cache/c536f32f5f9f27437a094bebc7dccd76307ede5f715040e14fa75448ee9eb1cc
- /data/data/####/files/Tapjoy/Cache/d4680d455a95c9ff6822ab0dc2f91dada368ce4c14ac1da5df9508dc2c85908f
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/tapjoyCacheData.xml
- /data/data/####/databases/dbname
- /data/data/####/databases/dbname-journal
- /data/data/####/files/Tapjoy/Cache/64eaca2d359f5fce1a96a628758a92dc0ca8c08557926457f80b3ff230765767
- /sdcard/a/####/b.dex
- /data/data/####/shared_prefs/d.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/tapjoyCacheData.xml.bak
- /data/data/####/files/Tapjoy/Cache/d4df85a13557f81dec31fa4f3e36410449fd46a0feeae980494f063eec9e1836
- /data/data/####/cache/d.dex
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/Tapjoy/Cache/25e8b8ab02eccf9915da4e770222c806ac0e4d51640ce9a32191412ccfc6e83b
- /data/data/####/files/Tapjoy/Cache/b2dbf695282cf51e2a9df8b14b68d70b6bad94eed347aa291a697128a08c5640
- /data/data/####/app_fiverocks/install
- /data/data/####/files/Tapjoy/Cache/c5e1706cd4387fea718e9ae3d0e9cbc687af83e83dd64534f40abc0fdf27e8f4
- /data/data/####/files/Tapjoy/Cache/fcb4c0267f2b358bd223e03ea8b1f34d1571bf9d12bf0d0217b82a9ea11f9b69
- /data/data/####/app_fiverocks/events2-journal
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/Tapjoy/Cache/760771fbd572a4fea4fb5958c473c4cdbe5d459bdbc53b244bc2e32e9b822804
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 45 40 7640 /data/data/####/cache/ads1320935398.jar 1161982705 -1866963778 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 95 40 435676 /data/data/####/cache/d.dex 1493298739 1583832747 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
Contains functionality to send SMS messages automatically.
