Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.433.origin
- Android.DownLoader.552.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.433.origin
- Android.DownLoader.552.origin
Network activity:
Connecting to:
- 7j####.####.com
- a####.####.com
- a####.####.net
- c####.####.com
- c-h####.####.com
- co####.####.com
- datacol####.####.com
- i####.####.com
- m####.####.com
- o####.####.com
- p####.####.com
- p####.####.com:6088
- r####.####.net
- s####.####.com
- s####.####.net
- sdk-ope####.####.com
- t####.####.com
- trac####.####.cn
- u####.####.com
- upa####.####.com
HTTP GET requests:
- 7j####.####.com/tdata_NDe635
- a####.####.com/v7/switch.php?type=####&app_channel=####&ckey=####
- a####.####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
- a####.####.net/v3/zip_upd?s=####
- c####.####.com/cdndata/banner/banner?version=####&type=####&channel_mark...
- c####.####.com/s?v####
- c####.####.com/title.png
- m####.####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&m=####&w...
- p####.####.com/c/1496213142531
- p####.####.com/cdndata/fontdetail/fontdetail?ft_id=####
- r####.####.net/spot/aos/v2/reqv3?s=####
- s####.####.com/config/hz-bjv4.conf
- s####.####.net/aos/v3/initf?s=####
- s####.####.net/stat/aos/v3/pkc?s=####
- t####.####.com/update.php?channel=####&uid=####&from=####&kernelVersion=...
- trac####.####.cn/s?type=####&r=####&tid=####&finfo=####&enup=####&mvid=#...
- upa####.####.com/newwfs/banner_pic/%E5%AD%97%E4%BD%93%E7%AE%A1%E5%AE%B6%...
HTTP POST requests:
- a####.####.com/app_logs
- c-h####.####.com/api.php?format=####&t=####
- co####.####.com/config-server/v1/config/secure.cfg
- datacol####.####.com/api.php?type=####&duid=####&version=####
- i####.####.com/showad.asm
- o####.####.com/v2/get_update_time
- p####.####.com:6088/s/
- sdk-ope####.####.com/api.php?format=####&t=####
- u####.####.com/frontend/web/index.php?r=####
Modified file system:
Creates the following files:
- <Package Folder>/app_libs/ymdex.jar.new
- <Package Folder>/code_cache/####/<Package>-1.apk.classes1069955533.zip
- <Package Folder>/databases/6feab07fe3fa1fca4da91448c2740bf8
- <Package Folder>/databases/6feab07fe3fa1fca4da91448c2740bf8-journal
- <Package Folder>/databases/OxgHkj2lz09F
- <Package Folder>/databases/OxgHkj2lz09F-journal
- <Package Folder>/databases/P15pKIjsm64m
- <Package Folder>/databases/P15pKIjsm64m-journal
- <Package Folder>/databases/T1oX0rhhuXWt
- <Package Folder>/databases/T1oX0rhhuXWt-journal
- <Package Folder>/databases/XKwVoK0huy3R
- <Package Folder>/databases/XKwVoK0huy3R-journal
- <Package Folder>/databases/ad_down_db-journal
- <Package Folder>/databases/com.im_6.2.0.db-journal
- <Package Folder>/databases/jqIqJYOT3JpT
- <Package Folder>/databases/jqIqJYOT3JpT-journal
- <Package Folder>/databases/wIU6pTyUBYWX
- <Package Folder>/databases/wIU6pTyUBYWX-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/wsUL1uCdKvjD
- <Package Folder>/databases/wsUL1uCdKvjD-journal
- <Package Folder>/databases/zitiguanjia.db-journal
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/finalcore.jar
- <Package Folder>/files/####/flow_pack.apk
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- <Package Folder>/shared_prefs/DEVICE_UNIQ_FILE.xml
- <Package Folder>/shared_prefs/META_INFO.xml
- <Package Folder>/shared_prefs/OFFERSCONFIG1.xml
- <Package Folder>/shared_prefs/advisers.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/com.im.keyValueStore.sdk_version_store.xml
- <Package Folder>/shared_prefs/com.im.keyValueStore.sdk_version_store.xml.bak
- <Package Folder>/shared_prefs/com.im.keyValueStore.uid_store.xml
- <Package Folder>/shared_prefs/com.im.keyValueStore.uid_store.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/onlineconfig_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/policy.xml
- <Package Folder>/shared_prefs/sdk_config.xml
- <Package Folder>/shared_prefs/sdk_config.xml.bak
- <Package Folder>/shared_prefs/spotData.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.sfp/.sfp
- <SD-Card>/.testf
- <SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
- <SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Miscellaneous:
Executes next shell scripts:
- /data/data/com.xinmei365.font/files/gdaemon_20161017 0 com.xinmei365.font/com.igexin.sdk.PushService 24658 300 0
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- <su-internal:request>
- <su-internal:result>
- cat /sys/class/net/wlan0/address
- chmod 700 /data/data/com.xinmei365.font/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop
- getprop ro.vivo.os.name
- su
Uses elevated priveleges.
