Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mixi.16.origin
- Android.Mixi.13.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- g####.####.com
- w####.####.com:8080
- o####.####.com
- o####.####.com:8080
- stra####.####.com
- w####.####.com:55555
- w####.####.com
- 1####.####.69:8080
- st####.####.com
- mon####.####.com
HTTP GET requests:
- g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
- st####.####.com/17661/24c1e9d296ce84e5ae91d0bcd6289072.apk?fsname=####
HTTP POST requests:
- o####.####.com/analytics/upload
- 1####.####.69:8080/
- w####.####.com:8080/
- o####.####.com:8080/analytics/upload
- mon####.####.com/analytics/upload
- w####.####.com/
- stra####.####.com/analytics/upload?mType=####
- w####.####.com:55555/
- g####.####.com/cr/sv/getEPList
Modified file system:
Creates the following files:
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/PreExcuModsInfo.txt
- <Package Folder>/shared_prefs/DENGTA_META.xml
- <Package Folder>/databases/theme.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/4LqSs12GT.jar
- <Package Folder>/files/Beacon_sig_1.lock
- <Package Folder>/files/1495005856185.jar
- <Package Folder>/databases/eup_db-journal
- <Package Folder>/shared_prefs/DENGTA_META.xml.bak
- <Package Folder>/files/wupData/wup_pref.ini
- <Package Folder>/ReadyHost.txt
- <Package Folder>/databases/download_database1.db-journal
- <Package Folder>/databases/eup_db
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/files/1495005848573_cgr.so
- <Package Folder>/databases/beacon_db-journal
- <Package Folder>/files/wupData/wup_user_info_app.inf
- <Package Folder>/databases/beacon_db
- <Package Folder>/files/us.4LqSs12GTRVt1K5ygIxUw7osx7Ik2
Miscellaneous:
Executes next shell scripts:
- getenforce
- /system/bin/sh -c getprop ro.build.fingerprint
- sh <Package Folder>/files/us.4LqSs12GTRVt1K5ygIxUw7osx7Ik2 -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- getprop ro.product.cpu.abi
- chmod 0771 <Package Folder>/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.4LqSs12GTRVt1K5ygIxUw7osx7Ik2 > /dev/null 2>&1
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /data/data/####/files/us.4LqSs12GTRVt1K5ygIxUw7osx7Ik2 -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- su -v
- getprop ro.qrom.build.version.number
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/4LqSs12GT.jar > /dev/null 2>&1
- getprop ro.build.fingerprint
- chmod 0771 /data/data/####/.syslib-
- /system/bin/cat /proc/cpuinfo
- getprop ro.qrom.build.version.day
- getprop ro.qrom.build.tcmhost
- getprop ro.qrom.product.device
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/4LqSs12GT.dex > /dev/null 2>&1
- sh
- getprop ro.qrom.build.version.snver
- getprop ro.qrom.build.brand
- <dexopt>
Contains functionality to send SMS messages automatically.
