Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.288.origin
Downloads the following detected threats from the Web:
- Android.Triada.288.origin
Network activity:
Connecting to:
- a####.####.cn
- a####.####.cn:12956
- a####.####.com
- c####.####.cn
- d####.####.com
- d####.####.in:83
- h####.####.com
- hid####.####.cn
- im####.####.com
- s####.####.in
- s####.####.in:83
HTTP GET requests:
- c####.####.cn/timg?v####&size=####&imgtype=####&quality=####&e####&sec=#...
- d####.####.com/hm/hms.png
- hid####.####.cn/R4562458532240021?e=####&token=F####
- im####.####.com/anxun/pic/item/b3fb43166d224f4abff7d47a01f790529822d169....
HTTP POST requests:
- a####.####.cn/v1/api/setSolutionRes
- a####.####.cn:12956/v1/pub/regist
- a####.####.com/appsrv?uid=####&f=####&native_api=####&psize=####&abi=###...
- d####.####.in:83/api/hms_ctrl.php?ch=####&ver=####
- h####.####.com/app.gif
- s####.####.in/api/report.php
- s####.####.in:83/api/report.php
Modified file system:
Creates the following files:
- <Package Folder>/app_outdex/libdexprotector.niundr.2055.so
- <Package Folder>/app_outdex/libdexprotector.niundr.2084.so
- <Package Folder>/app_outdex/libdexprotector.niundr.2123.so
- <Package Folder>/databases/app_property_settings.db-journal
- <Package Folder>/databases/bddownloads.db-journal
- <Package Folder>/databases/downloads.db-journal
- <Package Folder>/databases/server_config.db-journal
- <Package Folder>/databases/statistics.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/0bfff1acf6a67b1acceee4f807e889de
- <Package Folder>/files/libcuid.so
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/basestatistics_pref.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/sapi_system.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
Miscellaneous:
Executes next shell scripts:
- /data/data/com.baidu.appsearch/files/libprocmox_v1_7.so /data/data/com.baidu.appsearch /data/app-lib/com.baidu.appsearch-1 ba72e9383d4267e35473283a24e1055d https://appc.baidu.com/app?uid=luSw8gi6B8_laSfWlaHmu08Ivt0OOB8Rga2M8_O1H8qLuSiTYOvgigOg2i_Ou2iyQSqqC&psize=1&abi=x86&cll=_hv19g8O2NAVA&usertype=1&is_support_webp=true&ver=16793302&from=1020200j&operator=250026&network=2G&pkname=com.baidu.appsearch&country=US&cen=cuid_cut_cua_uid&gms=true&platform_version_id=18&action=uninstall&pu=cua%40_avjhga7vCI-JEjPkJAiC_hV-Ng-NviOAqqqB%2Cosname%40baiduappsearch%2Cctv%401%2Ccfrom%401020200j%2Ccuid%40luSw8gi6B8_laSfWlaHmu08Ivt0OOB8Rga2M8_O1H86QuviJlu-6fguZvf_qu2i1_uv7iqq6B%2Ccut%400ksIOjuH-8ygasibouLl8jN2F69DpmjXfqqSB&language=en&apn=cmnet& 1 com.android.browser/com.android.browser.BrowserActivity
- <dexopt>
- cat /proc/mounts
- cat /proc/version
- chmod -R 777 /data/data/com.baidu.appsearch/files/pl/.Solution
- chmod -R 777 <Package Folder>/files/pl/.Solution
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/10010
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/20008
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/24793
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/37325
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/40021
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/40040
- chmod 777 /data/data/com.baidu.appsearch/files/pl/.Solution/53469
- chmod 777 <Package Folder>/files/pl/.Solution/10010
- chmod 777 <Package Folder>/files/pl/.Solution/20008
- chmod 777 <Package Folder>/files/pl/.Solution/24793
- chmod 777 <Package Folder>/files/pl/.Solution/37325
- chmod 777 <Package Folder>/files/pl/.Solution/40021
- chmod 777 <Package Folder>/files/pl/.Solution/40040
- chmod 777 <Package Folder>/files/pl/.Solution/53469
- getprop ro.board.platform
- getprop ro.product.cpu.abi
- ls -l /system/bin/su
- sh
- sh <Package Folder>/files/libprocmox_v1_7.so <Package Folder> /data/app-lib/<Package>-1 ba72e9383d4267e35473283a24e1055d https://appc.baidu.com/app?uid=luSw8gi6B8_laSfWlaHmu08Ivt0OOB8Rga2M8_O1H8qLuSiTYOvgigOg2i_Ou2iyQSqqC&psize=1&abi=x86&cll=_hv19g8O2NAVA&usertype=1&is_support_webp=true&ver=16793302&from=1020200j&operator=250026&network=2G&pkname=<Package>&country=US&cen=cuid_cut_cua_uid&gms=true&platform_version_id=18&action=uninstall&pu=cua%40_avjhga7vCI-JEjPkJAiC_hV-Ng-NviOAqqqB%2Cosname%40baiduappsearch%2Cctv%401%2Ccfrom%401020200j%2Ccuid%40luSw8gi6B8_laSfWlaHmu08Ivt0OOB8Rga2M8_O1H86QuviJlu-6fguZvf_qu2i1_uv7iqq6B%2Ccut%400ksIOjuH-8ygasibouLl8jN2F69DpmjXfqqSB&language=en&apn=cmnet& 1 com.android.browser/com.android.browser.BrowserActivity
- sysspm Cfdszgtews
- sysspm Odfzgkelzd
Uses special library to hide executable bytecode.
