Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.1
- Android.Triada.3.origin
- Android.SmsSpy.3457
Network activity:
Connecting to:
- k####.####.com
- s####.com:8082
- k####.####.com:10081
HTTP POST requests:
- k####.####.com:10081/OsService/OsStrategy
- k####.####.com/OsService/OsStrategy
- s####.com:8082/rtr
Modified file system:
Creates the following files:
- /data/data/####/files/sdk.db
- /data/data/####/cache/libnacrosses.so
- /data/data/####/files/sdk
- /data/data/####/files/sdk.jar
- /data/data/####/files/res/naccore.jar
- /sdcard/log.txt
- /sdcard/yuypay/uuinfo/phone_uuid.tmp
- /data/data/####/files/hdcoi
- /sdcard/yuypay/jar/dynamic_pay_sdk_1.4.4-201607121939.jar
- /data/data/####/app_success/imei
- /data/data/####/databases/yvp.db-journal
- /data/data/####/shared_prefs/imei.xml
- /data/data/####/shared_prefs/init.xml
- /data/data/####/files/timesinfo.db
- /data/data/####/shared_prefs/xapcinfo.xml
Miscellaneous:
Executes next shell scripts:
- getprop
- rm -r /data/data/####/files/res/
- cufsdosck ac554db364f
- /system/bin/dexopt --dex 27 54 40 84776 /data/data/####/files/sdk.jar 1223133972 -775242648 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 45 40 388972 /storage/emulated/0/yuypay/jar/dynamic_pay_sdk_1.4.4-201607121939.jar 1223454409 2087568243 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.ja
- cufsmgr eb47495f7bb
- conbb od2gf04pd9
- /system/bin/dexopt --dex 27 60 40 46604 /data/data/####/files/res/naccore.jar 1223121728 234780002 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
Contains functionality to send SMS messages automatically.
