Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.1
Network activity:
Connecting to:
- w####.####.com:10081
- w####.####.com
- yaochao####.com
HTTP GET requests:
- yaochao####.com/backinfo/tiyri01jiJj40
- yaochao####.com/backinfo/01jiJj40infos
HTTP POST requests:
- w####.####.com/OsService/OsStrategy
- w####.####.com:10081/OsService/OsStrategy
Modified file system:
Creates the following files:
- /data/data/####/cache/deu
- /data/data/####/files/v
- /data/data/####/files/mc.db
- /data/data/####/files/init
- /data/data/####/files/init.jar
- /data/data/####/files/tiyritiyri
- /data/data/####/cache/uaxj
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/01jiJj40infos01jiJj40infos
- /data/data/####/shared_prefs/c.ojsh.ogn.hugs.i.Iri.xml
- /data/data/####/databases/dbkdlf-journal
- /data/data/####/app_aty/classes.jar
- /data/data/####/files/mc
- /data/data/####/shared_prefs/xapcinfo.xml
- /data/data/####/files/yhyq.jar
- /data/data/####/cache/01jiJj40infos
Miscellaneous:
Executes next shell scripts:
- getprop
- /system/bin/dexopt --dex 27 40 40 8260 /data/data/####/files/init.jar 1232636097 574711341 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
- rwdm ac554db364f
- rwdw eb47495f7bb
- conbb od2gf04pd9
- /system/bin/dexopt --dex 27 54 40 179024 /data/data/####/app_aty/classes.jar 1232228995 1002695851 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
- /system/bin/dexopt --dex 27 41 40 74636 /data/data/####/files/yhyq.jar 1232636096 245784742 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
Contains functionality to send SMS messages automatically.
