Android.DownLoader.3505

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Adtiming.1.origin
Android.HiddenAds.246.origin
Android.Xiny.1.origin
Android.Xiny.231.origin

Downloads the following detected threats from the Web:

Android.HiddenAds.246.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) img.adti####.com:80
TCP(HTTP/1.1) s.grav####.com:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) www.you####.com:80
TCP(HTTP/1.1) api-ce####.coo####.org:80
TCP(HTTP/1.1) stat####.face####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) r1.b####.co:80
TCP(HTTP/1.1) www.esq####.tw:80
TCP(HTTP/1.1) con####.face####.net:80
TCP(HTTP/1.1) s####.wp.com:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) c####.api.coo####.org:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) www.google-####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) sdk.adti####.com:80
TCP(TLS/1.0) ma####.bootstr####.com:443
TCP(TLS/1.0) box.jom####.com:443
TCP(TLS/1.0) mbd.b####.com:443
TCP(TLS/1.0) ti####.jom####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443
TCP(TLS/1.0) hpd.b####.com:443
TCP(TLS/1.0) s####.wp.com:443
TCP(TLS/1.0) stat####.face####.com:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) api.insta####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) ss2.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) www.you####.com:443
TCP(TLS/1.0) i####.wp.com:443
TCP(TLS/1.0) sdk.adti####.com:443

DNS requests:

aexcep####.b####.qq.com
ali.f####.cdn.####.com
and####.b####.qq.com
api-ce####.coo####.org
api.insta####.com
c####.api.coo####.org
con####.face####.net
ea.sno####.1####.com
en.sno####.1####.com
f####.b####.com
f####.google####.com
g####.bdst####.com
hpd.b####.com
i####.wp.com
i####.wp.com
i####.wp.com
img.adti####.com
m.b####.com
ma####.bootstr####.com
mbd.b####.com
mt####.go####.com
p####.wp.com
r1.b####.co
r1.s####.co
s####.wp.com
s####.wp.com
s.bdst####.com
s.grav####.com
s.y####.com
scon####.cdninst####.com
sdk.adti####.com
ss0.b####.com
ss1.b####.com
ss2.b####.com
stat####.face####.com
timg####.b####.com
www.b####.com
www.esq####.tw
www.face####.com
www.google-####.com
www.you####.com

HTTP GET requests:

ali.f####.cdn.####.com/2018/02/28/182023699.zip
api-ce####.coo####.org/v2/content/getItemDetails-49309845.json?&id=####&...
api-ce####.coo####.org/v2/content/getItemList-cn.json?&min=####&category...
api-ce####.coo####.org/v2/content/getLangList.json
api-ce####.coo####.org/v3/system/querytopicBycountry.json?&countryCode=#...
c####.api.coo####.org/v2/contentss/getListbyKeywords?&keywords=####
con####.face####.net/en_GB/sdk.js
f####.google####.com/css?family=####&subset=####&ver=####
img.adti####.com/upload/sdk/hotfix/7890itrename-90.jar
r1.b####.co/c/d_ab
r1.b####.co/de
r1.b####.co/v1/c/sf
s####.wp.com/g.gif?v=####&j=####&blog=####&post=####&tz=####&srv=####&ho...
s.grav####.com/css/hovercard.css?ver=####
s.grav####.com/css/services.css?ver=####
s.grav####.com/js/gprofiles.js?ver=####
sdk.adti####.com/hotfix?v=####&a=####&sv=####
stat####.face####.com/connect/xd_arbiter/r/Nh1oH0K63yz.js?version=####
www.esq####.tw/esq-choice/歲月的洗禮/
www.esq####.tw/esq-choice/歲月的洗禮/?relatedposts=####
www.esq####.tw/wp-content/plugins/instagram-feed/css/sb-instagram.min.cs...
www.esq####.tw/wp-content/plugins/instagram-feed/img/loader.png
www.esq####.tw/wp-content/plugins/instagram-feed/img/small-logo.png
www.esq####.tw/wp-content/plugins/instagram-feed/js/sb-instagram.min.js?...
www.esq####.tw/wp-content/plugins/jetpack/_inc/social-logos/social-logos...
www.esq####.tw/wp-content/plugins/jetpack/css/jetpack.css?ver=####
www.esq####.tw/wp-content/plugins/jetpack/modules/related-posts/related-...
www.esq####.tw/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?...
www.esq####.tw/wp-content/plugins/jetpack/modules/wpgroho.js?ver=####
www.esq####.tw/wp-content/plugins/lazy-load/images/1x1.trans.gif
www.esq####.tw/wp-content/plugins/lazy-load/js/jquery.sonar.min.js?ver=#...
www.esq####.tw/wp-content/plugins/lazy-load/js/lazy-load.js?ver=####
www.esq####.tw/wp-content/plugins/photo-gallery/css/bwg_frontend.css?ver...
www.esq####.tw/wp-content/plugins/photo-gallery/css/font-awesome/font-aw...
www.esq####.tw/wp-content/plugins/photo-gallery/css/font-awesome/fonts/f...
www.esq####.tw/wp-content/plugins/photo-gallery/css/jquery.mCustomScroll...
www.esq####.tw/wp-content/plugins/photo-gallery/css/sumoselect.css?ver=#...
www.esq####.tw/wp-content/plugins/photo-gallery/js/bwg_frontend.js?ver=#...
www.esq####.tw/wp-content/plugins/photo-gallery/js/bwg_gallery_box.js?ve...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.fullscreen-0.4...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.mCustomScrollb...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.mobile.js?ver=...
www.esq####.tw/wp-content/plugins/photo-gallery/js/jquery.sumoselect.min...
www.esq####.tw/wp-content/plugins/tablepress/css/default.min.css?ver=####
www.esq####.tw/wp-content/plugins/youtube-channel-gallery/magnific-popup...
www.esq####.tw/wp-content/plugins/youtube-channel-gallery/styles.css?ver...
www.esq####.tw/wp-content/plugins/youtube-embed/css/main.min.css?ver=####
www.esq####.tw/wp-content/themes/GRay/library/css/fontawesome/css/font-a...
www.esq####.tw/wp-content/themes/GRay/library/css/fontawesome/fonts/font...
www.esq####.tw/wp-content/themes/GRay/library/css/style.css?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/cb-scripts.js?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/cookie.min.js?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/jquery.ext.js?ver=####
www.esq####.tw/wp-content/themes/GRay/library/js/jquery.flexslider-min.j...
www.esq####.tw/wp-content/themes/GRay/library/js/jquery.fs.boxer.min.js?...
www.esq####.tw/wp-content/themes/GRay/library/js/modernizr.custom.min.js...
www.esq####.tw/wp-content/themes/GRay/library/js/selectivizr-min.js?ver=...
www.esq####.tw/wp-content/themes/GRay/plugins/login-with-ajax/login-with...
www.esq####.tw/wp-content/themes/GRay/plugins/login-with-ajax/widget.css...
www.esq####.tw/wp-content/uploads/2015/07/ESQUIRE_360xH500pix-01.jpg
www.esq####.tw/wp-content/uploads/2015/07/ESQUIRElogo-1.png
www.esq####.tw/wp-content/uploads/2015/07/Esquire-club360x215.jpg
www.esq####.tw/wp-content/uploads/2015/08/3381.jpg
www.esq####.tw/wp-content/uploads/2016/03/IMG_0985-480x240.jpg
www.esq####.tw/wp-content/uploads/2016/03/w-480x240.jpg
www.esq####.tw/wp-content/uploads/2017/03/江宏傑網頁大圖比例-480x240.jpg
www.esq####.tw/wp-content/uploads/2017/04/2017-04-06_152835-480x240.png
www.esq####.tw/wp-content/uploads/2017/08/2017-08-16_145525-480x240.png
www.esq####.tw/wp-content/uploads/2017/10/網頁大圖比例-烏鴉-80x60.jpg
www.esq####.tw/wp-content/uploads/2017/11/網頁大圖比例-2-80x60.jpg
www.esq####.tw/wp-content/uploads/2017/12/11-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/01/44443-480x240.jpg
www.esq####.tw/wp-content/uploads/2018/02/2018-02-23_185011-80x60.png
www.esq####.tw/wp-content/uploads/2018/02/27751718_1779880275390901_2540...
www.esq####.tw/wp-content/uploads/2018/02/DSC1094拷貝-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/02/Lady-M特別在情人節前一週的週末三天，推出限定雙人套餐，...
www.esq####.tw/wp-content/uploads/2018/02/Street-Style-主視覺-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/02/UNADJUSTEDNONRAW_thumb_1c32-80...
www.esq####.tw/wp-content/uploads/2018/02/UNADJUSTEDNONRAW_thumb_1d96-80...
www.esq####.tw/wp-content/uploads/2018/02/VCE-To-Go巡迴貨櫃正於台中UNO市集巡迴中！-80x...
www.esq####.tw/wp-content/uploads/2018/02/sc01_17_valentinesday_pr_shots...
www.esq####.tw/wp-content/uploads/2018/02/網頁大圖比例-3-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/2.adidas鼓勵每個人專注眼前挑戰，管他誰的眼光，堅持「...
www.esq####.tw/wp-content/uploads/2018/03/SP18_19D_IvoryGold_Group_17090...
www.esq####.tw/wp-content/uploads/2018/03/TAG-Heuer發表全鑲鑽Connected-Modula...
www.esq####.tw/wp-content/uploads/2018/03/annihilation-movie-poster-snip...
www.esq####.tw/wp-content/uploads/2018/03/普吉島邁考安納塔拉度假會-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/網頁大圖比例-1-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/網頁大圖比例-80x60.jpg
www.esq####.tw/wp-content/uploads/2018/03/設計師網頁大圖比例-80x60.jpg
www.esq####.tw/wp-includes/js/comment-reply.min.js?ver=####
www.esq####.tw/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
www.esq####.tw/wp-includes/js/jquery/jquery.js?ver=####
www.esq####.tw/wp-includes/js/wp-embed.min.js?ver=####
www.esq####.tw/wp-includes/js/wp-emoji-release.min.js?ver=####
www.google-####.com/yts/jsbin/www-widgetapi-vflZ8rDo4/www-widgetapi.js
www.you####.com/iframe_api

HTTP POST requests:

aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/msg/error
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/sdk/api/ad/hull_v2
en.sno####.1####.com:8088/sdk/api/log/record

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/index
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/####/sf_file_provider.dat
<Package Folder>/files/<Package>.zip
<Package Folder>/files/<Package>.zip (deleted)
<Package Folder>/files/cache_v1.jar
<Package Folder>/files/coolook_bk.db
<Package Folder>/files/coolook_bk.db-journal
<Package Folder>/files/dat.dat
<Package Folder>/files/lib_v22h1.dat
<Package Folder>/files/local_crash_lock
<Package Folder>/files/mesosphere_v22h1.jar
<Package Folder>/files/native_record_lock
<Package Folder>/files/new_v1.jar
<Package Folder>/files/security_info
<Package Folder>/files/snowfox_mid_v22h1.so
<Package Folder>/files/snowfox_sdk_so-v22h1.jar
<Package Folder>/files/snowfox_v22h1.jar
<Package Folder>/files/snowfox_v22h1.so
<Package Folder>/mix.dex
<Package Folder>/servi
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/adtiminginfo.xml
<Package Folder>/shared_prefs/appKey.xml
<Package Folder>/shared_prefs/appshell.xml
<Package Folder>/shared_prefs/coolook.xml
<Package Folder>/shared_prefs/crash_log_sp.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/tx_shell/libnfix.so
<Package Folder>/tx_shell/libshella-2.10.7.1.so
<Package Folder>/tx_shell/libufix.so
<SD-Card>/Android/####/dev_7aa0fb27.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/pid

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/<Package>.init.NewsService
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.7.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
chmod 777 <Package Folder>/servi
dd if=<Package Folder>/lib/libservi.so of=<Package Folder>/servi
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
sh

Loads the following dynamic libraries:

Bugly
libnfix
libshella-2.10.7.1
libufix
nfix
servi
ufix

Uses the following algorithms to encrypt data:

AES
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial