Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.363.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.363.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) cq####.rewaard####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) www.go####.nl:443
DNS requests:
- a####.u####.com
- adser####.go####.com
- cq####.rewaard####.com
- oc.u####.com
- ssl.gst####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
- z####.heyc####.net
HTTP GET requests:
- cq####.rewaard####.com/R7CCh/346b315b614cc6d4e4cc1d6723b5c830?aid=####
HTTP POST requests:
- a####.u####.com/app_logs
- oc.u####.com/check_config_update
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/configs.xml
- /data/data/####/dpi
- /data/data/####/hid.db
- /data/data/####/mobclick_agent_online_setting_com.CJrql.SiDTT.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/updatedata.jar
- /data/media/####/.nid
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- getprop
- ls -l /dev
- ls -l /dev/block
- ls -l /dev/block/vold
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuctl/apps
- ls -l /dev/cpuctl/apps/bg_non_interactive
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/log
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ps
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
