Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.252.origin
Gains access to the ITelephony private interface
Network activity:
Connecting to:
- a####.####.info
- acc####.####.com
- acc####.####.com:8100
- d####.####.com
- e####.####.info
- hijo####.####.com
HTTP GET requests:
- a####.####.info/OffersApi/getruleconfig
- e####.####.info/Uploads/service/si/2403_3201_10000_32_1.0_271_072116.apk
- hijo####.####.com/soft/597800f368485.zip
HTTP POST requests:
- acc####.####.com/Update/packageUpdateResult
- acc####.####.com:8100/Update/packageManageUpdate
- d####.####.com/androidplus/?c=####&a=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/active.db
- <Package Folder>/databases/active.db-journal
- <Package Folder>/databases/dollargetter.db
- <Package Folder>/databases/dollargetter.db-journal
- <Package Folder>/databases/xUtils.db-journal
- <Package Folder>/files/####/596f533e87e55.zip
- <Package Folder>/files/####/597800f368485.zip
- <Package Folder>/files/####/classes.dex
- <Package Folder>/files/####/com.tapinator.multi.storey.car.parking3d
- <Package Folder>/files/####/error
- <Package Folder>/files/####/libso1.so
- <Package Folder>/files/####/runtime
- <Package Folder>/files/aa9d1f480c7a4c4f589ef1129c7ac7dd
- <Package Folder>/files/qevmzgYxkn
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/SharedPreferences_cache.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/curtain_sp.xml
- <Package Folder>/shared_prefs/interval_config.xml
- <Package Folder>/shared_prefs/log.xml
- <Package Folder>/shared_prefs/public_sp.xml
- <Package Folder>/shared_prefs/share_params.xml
- <SD-Card>/.android/juuid.bk
- <SD-Card>/.temp/pureSdk
- <SD-Card>/Download/####/dyData
- <SD-Card>/joyappstore/####/2403_3201_10000_32_1.0_271_072116.apk
Miscellaneous:
Executes next shell scripts:
- /system/bin/app_process /system/bin com.ddos.ks.protect.GuardProcess 2074 <Package> { model : <System Property> , androidId : 57611bfab2e4c694 , sdcard : true , SystemTotal :16904777728, fingerprint : <System Property>/<System Property>/<System Property>:4.3.1/JZO54K/I8190XXAMA2:eng/test-keys , simOperator : 310004 , parentGid : 202 , buildTime : 1495112467000 , counrty : US , appPackname : <Package> , appvername : 2.0 , screen : 800-552 , SystemAvailable :15193624576, androidVersion : 18 , appvercode : 2 , networkOperatorName : Verizon , simSerialNumber : <ICCID> , gaid : , channelId : 10000 , osv : 18 , imei : <IMEI> , gameId : 202 , networkOperator : 310004 , parentCid : 10000 , operator : 310004 , product : <System Property> , manufacturer : unknown , macAddr : , brand : <System Property> , imsi : <IMSI> , language : en , uuid : 00000000-1180-8fb6-6773-c75150ca6f57 , serial : <System Property> , release : 4.3.1 , SDAvailable :15193624576, SDTotal :16904777728, vercode : 171 }
- app_process /system/bin com.android.commands.pm.Pm install -r -s <SD-Card>/joyappstore/downloads/2403_3201_10000_32_1.0_271_072116.apk
- app_process /system/bin com.android.commands.pm.Pm install -r /storage/emulated/0/joyappstore/downloads/2403_3201_10000_32_1.0_271_072116.apk
- app_process /system/bin com.android.commands.pm.Pm install -r <SD-Card>/joyappstore/downloads/2403_3201_10000_32_1.0_271_072116.apk
- bart f66a97a35253a0552849dfc5832f56ac
- bart f66a97a35253a055ac18a3798ffe6b00
- sh
Loads the following dynamic libraries:
- qevmzgYxkn
- so1
Uses the following algorithms to encrypt data:
- DES
Uses the following algorithms to decrypt data:
- DES
Gains access to geolocation
Gains access to network information
Gains access to telephone information (number, imei, etc.)
Adds tasks to the system scheduler
