Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.348.origin
Network activity:
Connecting to:
- koapk####.com:8081
HTTP POST requests:
- koapk####.com:8081/sm/sr/ad/ey
Modified file system:
Creates the following files:
- <Package Folder>/databases/cHJvdGVjdDIwMT.db-journal
- <Package Folder>/files/.tmpkcol
- <Package Folder>/files/201708071750.apk
- <Package Folder>/files/c201708071750.apk
- <Package Folder>/files/imp
- <Package Folder>/shared_prefs/AD_HELP_SP_RUNINFO.xml
Miscellaneous:
Executes next shell scripts:
- <error:2>
- adb_yzgq_hd
- adb_yzgq_hd -c id
- c201708071750.apk
- logcat -d -v time
- ps
- sh
Loads the following dynamic libraries:
- libcom.adb.filebackup.yzgq
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
