Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.162
Downloads the following detected threats from the Web:
- Android.Triada.162
Network activity:
Connecting to:
- p####.####.com
- 1####.####.45:10002
- 2####.####.134:8080
- reso####.####.com
- res####.####.com
- 1####.####.45
- m####.####.cn
HTTP GET requests:
- m####.####.cn/mtin.db.unacc_TH_2017011601.zip
- m####.####.cn/mtin.db.shcut.zip
- res####.####.com/v3/ip?output=####&key=####
- reso####.####.com/gslb/gslb/getbucket.asp
HTTP POST requests:
- 2####.####.134:8080/mtin/home
- 1####.####.45:10002/admgr/admgrsurvey.do
- p####.####.com/sdkMis/init-submit
- 1####.####.45/playstat/a.do
Modified file system:
Creates the following files:
- /data/data/####/files/mtin.db.shcut.zip
- /data/data/####/shared_prefs/gud.xml
- /data/data/####/shared_prefs/port.xml.bak
- /data/data/####/shared_prefs/port.xml
- /data/data/####/files/mtin.db.unacc_TH_2017011601.zip
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 52 40 88924 /data/data/####/files/mtin.db.unacc_TH_2017011601.zip 1252291804 -692792220 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /s
- /system/bin/dexopt --dex 27 48 40 29808 /data/data/####/files/mtin.db.shcut.zip 1251825351 -1802210082 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- cat /sys/class/net/wlan0/address
Contains functionality to send SMS messages automatically.
