Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.222.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) api.snail####.com:80
- TCP(HTTP/1.1) api.xima####.com:80
- TCP(HTTP/1.1) 1####.199.167.212:80
- TCP(TLS/1.0) 1####.217.17.142:443
- TCP(TLS/1.0) owe.joy-r####.com:9050
DNS requests:
- a####.u####.com
- api.snail####.com
- api.xima####.com
- cdn.joy-r####.com
- owe.joy-r####.com
HTTP GET requests:
- 1####.199.167.212/app/queryModuleState.action?&appversion=####&client_si...
- 1####.199.167.212/snaillove_lamp/getChannel.action?&sign=####
- 1####.199.167.212/snaillove_lamp/getSlide.action?&sign=####
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451027979327.png
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451027993798.png
- 1####.199.167.212/snaillove_lamp/pictures/2015/12/25/1451041437889.jpg
- api.snail####.com/cloudmusic/api/getHasCoverAd?packagename=####&language...
- api.snail####.com/snaillove_lamp/getEntranceNew.action?&sign=####
- api.snail####.com/snaillove_lamp/pictures/2015/12/25/1451027986279.png
- api.snail####.com/snaillove_lamp/pictures/2015/12/25/1451040233300.jpg
- api.snail####.com/snaillove_lamp/pictures/2015/12/25/1451040464915.jpg
- d####.c####.l####.####.com/896e8760-4b4b-44fc-96af-7eae30fe04a4bdco_60048
HTTP POST requests:
- a####.u####.com/app_logs
- api.xima####.com/oauth2/access_token
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/H4O783l.apk
- /data/data/####/bird_plugin.dex
- /data/data/####/bird_plugin.jar
- /data/data/####/bird_plugin.jar.sig
- /data/data/####/bird_plugin.tmp
- /data/data/####/bird_plugin.tmp.sig
- /data/data/####/config.xml
- /data/data/####/download.db-journal
- /data/data/####/downloadEngine.db-journal
- /data/data/####/json_cache.xml
- /data/data/####/libexec.so
- /data/data/####/music_module-journal
- /data/data/####/tMS866P3hcq
- /data/data/####/ting_data.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/media/####/-1999500433
- /data/media/####/-246565419
- /data/media/####/-479326590
- /data/media/####/.nomedia
- /data/media/####/1483928623
- /data/media/####/386865091
- /data/media/####/806362188
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/app_aqPVSg3/tMS866P3hcq -p <Package> -s com.birdads.out.BGService -t 600
- chmod 0755 <Package Folder>/app_aqPVSg3/tMS866P3hcq
- getprop ro.product.cpu.abi
- sh <Package Folder>/app_aqPVSg3/tMS866P3hcq -p <Package> -s com.birdads.out.BGService -t 600
Loads the following dynamic libraries:
- libexec
Uses the following algorithms to decrypt data:
- DES-ECB-NoPadding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
