Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.258
- Android.Triada.266.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
DNS requests:
- b####.52####.com
- ksf.sd####.com
- mt####.go####.com
Modified file system:
Creates the following files:
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/files/bcux
- <Package Folder>/files/bcux.jar
- <Package Folder>/files/btbe.png
- <Package Folder>/files/ru
- <Package Folder>/files/ru.apk
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/config.xml.bak (deleted)
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/xapcinfo.xml
Miscellaneous:
Executes next shell scripts:
- conbb od2gf04pd9
- cufsdosck ac554db364f
- cufsmgr eb47495f7bb
- service call appops 0 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 1 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 10 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 11 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 12 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 13 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 14 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 15 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 16 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 17 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 18 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 19 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 2 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 3 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 4 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 5 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 6 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 7 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 8 i32 15 i32 10044 s16 <Package> i32 0
- service call appops 9 i32 15 i32 10044 s16 <Package> i32 0
- sh
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Gains access to information about sent/received SMS messages.
