Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Loki.15.origin
- Android.Xiny.184.origin
- Android.MulDrop.84.origin
- Android.Backdoor.336.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.336.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- t####.####.com
- set####.####.com
- g####.####.com
- ip####.io
- d####.####.com
- pulsead####.com
- m####.####.com
- a####.####.com
- anastas####.####.org
HTTP GET requests:
- pulsead####.com/a/display.php?r=####
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- anastas####.####.org/aff_c?aff_id=####&aff_sub=####&aff_sub2=####&offer_...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- a####.####.com/pull/top_offer?gaid=####&id=####
- ip####.io/json
- d####.####.com/thinking/group/rtt0509_664.apk
- pulsead####.com/a/display.php?stamat=####
- pulsead####.com/a/display.php?r=####&treqn=####&runauction=####&crr=####...
- a####.####.com/request/?z=####&cid=####&subid=####
- a####.####.com/request/?z=####&if=####&uh=####&ab=####&w=####&h=####&sub...
HTTP POST requests:
- a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- a####.####.com/subscribe/api/1110
- m####.####.com/smartview/api/920
- t####.####.com/ggview/rsddateindex
- g####.####.com/pilot/api/300102
- m####.####.com/errorview/api/601
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/files/IQPFsmOUChmkwhbDdynamicloader.jar
- /data/data/####/files/libswbqgonYxEgdlSXzbootstrap.so
- /data/data/####/files/.snow/.dg
- /data/data/####/files/.default/6d60510c4c605f79093662f1b1ba9ebb.data.temp
- /data/data/####/files/.snow/busybox
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.snow/.dico.apk
- /data/data/####/files/.snow/.zip/r4
- /data/data/####/files/.snow/.dlsb.apk
- /data/data/####/files/.snow/.zip/r1
- /data/data/####/files/.snow/.service
- /data/data/####/files/.snow/.zip/r3
- /data/data/####/files/.snow/.zip/r2
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/wrhlrci/libhMEnYimzyYJbxvhuzxc.so
- /data/data/####/files/.snow/b.png
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/databases/webview.db
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/hello/hello.dex
- /data/data/####/databases/webviewCookiesChromium.db
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.snow/checkFile0
- /data/data/####/files/.snow/.dsmt.apk
- /data/data/####/files/.default/.p.dex
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/databases/mobvista.msdk.db
- /data/data/####/files/IQPFsmOUChmkwhbDdynamicloader.dex
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/files/.snow/.client
- /data/data/####/databases/mobvista.msdk.db-journal
- /data/data/####/files/.snow/.zip/rt8
- /data/data/####/files/source/source.dex
- /data/data/####/shared_prefs/mobvista.xml
- /data/data/####/files/hello.apk
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/.snow/.center.tapk
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/wrhlrci/libKueWuLGqMMnRgVVgbt.so
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /data/data/####/files/wrhlrci/libRppEcpLJpRVcTveVlala.so
- /data/data/####/files/source.apk
- /data/data/####/files/.snow/myshell
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/wrhlrci/libIQPFsmOUChmkwhbDdynamicloader.so
- /data/data/####/files/.snow/.dlme.apk
- /data/data/####/files/.snow/a.xml
- /data/data/####/files/.snow/.ukd
- /data/data/####/files/.snow/.uok
- /data/data/####/files/.default/.p.apk
- /data/data/####/files/6d60510c4c605f79093662f1b1ba9ebb.data
- /data/data/####/shared_prefs/share_data.xml
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/files/.snow/supolicy
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/.snow/.uks
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.snow/.catr.apk
- /data/data/####/files/.snow/.ir
- /data/data/####/files/.snow/.zip/rsh
- /data/data/####/files/.snow/busybox
- /data/data/####/files/.snow/.zip/mkdevsh
- /data/data/####/files/.snow/b.png
Miscellaneous:
Executes next shell scripts:
- chmod 777 /data/data/####/files/.snow/myshell
- /system/bin/dexopt --dex 27 41 40 3093848 /data/data/####/files/source.apk 1252606695 -365804867 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- chmod 777 /data/data/####/files/.snow/.ukd
- chmod 777 /data/data/####/files/.snow/.dg
- chmod 777 /data/data/####/files/.snow/.service
- chmod 777 /data/data/####/files/.snow/b.png
- chmod 777 /data/data/####/files/.snow/.uok
- /system/bin/dexopt --dex 27 58 40 2568000 /data/data/####/files/.default/.p.apk 1252625383 -2071152982 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- chmod 777 /data/data/####/files/.snow/.client
- chmod 777 /data/data/####/files/.snow/.zip/r4
- chmod 777 /data/data/####/files/.snow/.zip/r1
- chmod 777 /data/data/####/files/.snow/.zip/r3
- chmod 777 /data/data/####/files/.snow/.zip/r2
- /system/bin/dexopt --dex 27 46 40 30568 /data/data/####/files/IQPFsmOUChmkwhbDdynamicloader.jar 1252228451 -613874949 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syste
- chmod 777 /data/data/####/files/.snow/.uks
- /system/bin/dexopt --dex 27 40 40 10544 /data/data/####/files/hello.apk 1252606695 1311588194 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.ja
- df /system
- chmod 777 /data/data/####/files/.snow/busybox
- chmod 777 /data/data/####/files/.snow/.catr.apk
- chmod 777 /data/data/####/files/.snow/supolicy
- chmod 777 /data/data/####/files/.snow/.zip/rsh
- sh
- chmod 777 /data/data/####/files/.snow/.zip/mkdevsh
- chmod 777 /data/data/####/files/.snow/.zip/rt8
- chmod 777 /data/data/####/files/.snow/.zip/
Contains functionality to send SMS messages automatically.
