Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.243.origin
- Android.Hmad.1
- Android.Backdoor.345.origin
- Android.Hmad.1.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.345.origin
Network activity:
Connecting to:
- d2h8j6q####.####.net
- epup####.####.com:7013
- e####.####.com:8011
- 1####.####.228:8006
- epre####.####.com:7012
- dl7kuuk####.####.net
- t####.####.net
- p####.####.com
- ecup####.####.com:8013
- l####.####.io
- e####.####.com
- wina####.com:8006
- 1####.####.228
- usdf####.com:32090
- usdf####.com
- epup####.####.com
- i####.####.cn
- c####.####.net
- up####.####.net
HTTP GET requests:
- dl7kuuk####.####.net/data/apk_ad_system_server/0/1.0.6/ads_system_server_1.0.6_3_encrypt.apk
- d2h8j6q####.####.net/oversea/pushad/logo/73f37fb6-4223-4d4e-8e21-966b691a3290.png
- d2h8j6q####.####.net/oversea/lockad/img/1481247530884.png
- d2h8j6q####.####.net/oversea/lockad/logo/1481247530897.png
- c####.####.net/batmobi/sdk/batcloud-push-sdk-impl_160_165-20160304133016-4001latest.jar
- i####.####.cn/iplookup/iplookup.php?format=####
- up####.####.net/update?v=####&sdk=####&debug=####&pkg=####&aid=####&local=####&lang=####&net=####&imei=####&imsi=####&sys=####&mode=####&ram=####&rom=...
- d2h8j6q####.####.net/oversea/pushad/logo/18a8ec2b-621d-446d-af54-f745ee19be8a.jpg
HTTP POST requests:
- l####.####.io/common?funid=####&rd=####
- epup####.####.com/upostdata.do
- 1####.####.228:8006/service/com.ads.basic.model.ServerAddress?type=####
- wina####.com:8006/service/com.ads.basic.model.ServerAddress?type=####
- e####.####.com:8011/ugetad.do
- p####.####.com/
- t####.####.net/g/d
- 1####.####.228/service/com.ads.sales.model.Installed
- 1####.####.228/service/com.ads.basic.model.BeatInterval?code=####
- usdf####.com/adroot/client
- usdf####.com:32090/adroot/client
- epre####.####.com:7012/ppostdata.do
- 1####.####.228/service/com.like.system.model.ChipBind
- epup####.####.com:7013/pkup.do
- 1####.####.228/service/com.ads.sales.model.Mobile
- e####.####.com/pgetad.do
- ecup####.####.com:8013/ukup.do
Modified file system:
Creates the following files:
- /data/data/####/app_jc/tfx.jar
- /data/data/####/shared_prefs/uid####.xml
- /data/data/####/.cache/classes.jar
- /data/data/####/shared_prefs/hdplayer.xml
- /data/data/####/shared_prefs/pref_longtime.xml
- /data/data/####/shared_prefs/flowapp_shared.xml.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_bangcleplugin/container.apk
- /data/data/####/databases/fp.db
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/shared_prefs/pref_shorttime.xml
- /data/data/####/app_jc/dfp.jar
- /data/data/####/databases/umplayer.db-journal
- /data/data/####/shared_prefs/intelligent.xml
- /data/data/####/app_krsdk/__krsdk.res__
- /data/data/####/databases/fp.db-journal
- /data/data/####/files/td.lock
- /data/data/####/.cache/libsecexe.x86.so
- /data/data/####/shared_prefs/ads_share_cache.pref.xml
- /data/data/####/app_krsdk/krsdk.res
- /data/data/####/app_jc/dfx.jar
- /data/data/####/.cache/####
- /data/data/####/app_jc/tfp.jar
- /data/data/####/shared_prefs/cached.pref.xml
- /data/data/####/files/libkrsdk.1.0.163.so
- /data/data/####/files/batcloud-push-sdk-impl_160_165-20160304133016-4001latest.jar
- /data/data/####/.md5
- /sdcard/Android/data/un/358851_imgs.png
- /data/data/####/.cache/libsecmain.x86.so
- /sdcard/.batcloud/uid
- /data/data/####/shared_prefs/batcloud.xml
- /data/data/####/shared_prefs/c_profile_sharepreference.xml
- /sdcard/kr-stock-conf
- /data/data/####/shared_prefs/fxkit.xml.bak
- /data/data/####/shared_prefs/pref_shorttime.xml.bak
- /data/data/####/databases/fxlock.db-journal
- /data/data/####/files/kr-stock-conf
- /sdcard/.tcookieid
- /sdcard/.batcloud/log/bat_log.txt
- /data/data/####/shared_prefs/ads_share_cache.pref.xml.bak
- /data/data/####/shared_prefs/fpssp.xml
- /data/data/####/files/batcloud.jar
- /data/data/####/.sec_version
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/Android/data/fp/38522.png
- /data/data/####/shared_prefs/fxssp.xml
- /data/data/####/shared_prefs/cached.pref.xml.bak
- /data/data/####/app_slog/actsts
- /data/data/####/shared_prefs/TD_CHANNEL_ID.xml
- /data/data/####/files/TDtcagent.db
- /data/data/####/shared_prefs/device.xml
- /sdcard/Android/data/un/358851_icon.png
- /data/data/####/app_krsdk/kd
- /sdcard/.batcloud/log/XSCQ8IYHV4QV9HTKS2GLT9G3_log.txt
- /data/data/####/databases/fx_kit_unlock-journal
- /sdcard/Android_htb/ads_system_server_1.0.6_3_encrypt.apk
- /data/data/####/.cache/classes.dex
- /data/data/####/app_krsdk/krsdk.cert
- /data/data/####/app_krsdk/ku-config
- /data/data/####/shared_prefs/pref_longtime.xml.bak
- /data/data/####/.cache/####.art
- /data/data/####/.cache/####.art.20
- /data/data/####/files/TDtcagent.db-journal
- /data/data/####/databases/fpdown.db-journal
- /data/data/####/shared_prefs/fpksp.xml
- /data/data/####/.cache/libsecpreload.x86.so
- /data/data/####/databases/usage.db-journal
- /data/data/####/shared_prefs/kingrootsdk.xml
- /sdcard/Android/data/shard/.UUID
- /data/data/####/er/cr.zip
- /data/data/####/shared_prefs/fpksp.xml.bak
- /data/data/####/shared_prefs/umplayer_NewVerPrompt.xml
- /sdcard/Android/data/fp/287538.png
- /data/data/####/shared_prefs/fxkit.xml
Sets the 'executable' attribute to the following files:
- /data/data/####/.cache/####
- /data/data/####/er/cr.zip
Miscellaneous:
Executes next shell scripts:
- getprop
- sh -c ln -s /data/data/####/app_bangcleplugin /data/data/####/app_nneomodule
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- chmod 755 /data/data/####/.cache/####
- su
- chmod 755 /data/data/####/.cache/####.art.20
- getprop ro.product.cpu.abi
- sh
- chmod 755 /data/data/####/.cache/####.art
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
