Android.DownLoader.2173

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Mixi.16.origin
Android.Xiny.184.origin
Android.Loki.15.origin
Android.Backdoor.336.origin
Android.MulDrop.84.origin
Android.DownLoader.304.origin

Downloads the following detected threats from the Web:

Android.Backdoor.336.origin

Network activity:

Connecting to:

s####.####.com
t####.####.com
g####.####.com
ip####.io
d####.####.com
e####.####.com
and####.####.com
m####.####.com
a####.####.com

HTTP GET requests:

s####.####.com/rtf/4303e8e0c1feae973da3a9e9f6774365.slze
s####.####.com/cr/sdk/dynV17041701D/des_onlydyV17041701Dj1so32.zip
g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
s####.####.com/rtf/6115c9af6b1c30917b41f5c378956f40.slze
s####.####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
s####.####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
s####.####.com/rtf/180562885f3e4c613c5e9844caef22755.slze
g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
d####.####.com/thinking/group/rtt0421_662.apk
s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
a####.####.com/pull/top_offer?gaid=####&id=####
ip####.io/json
s####.####.com/rtf/806a6b70c891c315e00b5dfd26af42ed.slze
g####.####.com/cr/sv/getGoFile?name=####
e####.####.com/thinking/group/exp
s####.####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
s####.####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
s####.####.com/rtf/6408c259f823e8db8ced83ef353a06b4.slze

HTTP POST requests:

g####.####.com/cr/sv/getEPList
a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
a####.####.com/subscribe/api/1110
and####.####.com/rqd/async
t####.####.com/ggview/rsddateindex
g####.####.com/pilot/api/300102
m####.####.com/errorview/api/601
a####.####.com/app_logs

Modified file system:

Creates the following files:

/data/data/####/databases/cc.db-journal
/data/data/####/files/1493729027707_onlydyV17041701Dj1so32.so
/data/data/####/databases/cc.db
/data/data/####/files/.snow/b.png
/data/data/####/files/.S1CH1S/611E9A41717CEEE048E4AE210100CA33
/data/data/####/files/wifi_configuration2DB8520H4/5wifi_configuration2DB8520H46
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/.S1CH1S/B9715B7918D2D279EFCC5D0D892DFA3A
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/408.jar
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/files/.S1CH1S/1C6146ECCF85DE5D6A343ABE109AC76D
/data/data/####/databases/ua.db.mirror
/data/data/####/files/611.jar
/data/data/####/files/806.jar
/data/data/####/files/.snow/.zip/rt8
/data/data/####/files/exid.dat
/data/data/####/files/hello.apk
/data/data/####/databases/webview.db-journal
/data/data/####/files/source.apk
/data/data/####/files/awsrabf/libLDyARNDidKiYcqzxdynamicloader.so
/data/data/####/files/430.jar
/data/data/####/shared_prefs/share_data.xml
/data/data/####/files/.snow/.dico.apk
/data/data/####/files/na1l2t/ntmp21342190
/data/data/####/files/hftJcw46N.jar
/data/data/####/files/.snow/.service
/sdcard/.windy/508e8558f784e3a21d3368e4763e2693.dat
/data/data/####/files/.snow/myshell
/data/data/####/files/.snow/.ir
/data/data/####/files/.snow/checkFile0
/data/data/####/shared_prefs/googlesdk.xml.bak
/data/data/####/databases/webviewCookiesChromium.db.mirror
/data/data/####/files/.S1CH1S/4BE0DCBCE845EDA30A4A7CBC6A2E86C4
/data/data/####/files/awsrabf/libbcVPHHDpaVhsxLGUlala.so
/data/data/####/files/.snow/.center.tapk
/data/data/####/files/.snow/exp
/data/data/####/files/.snow/.dlme.apk
/data/data/####/files/.S1CH1S/301B743A25916CB9DA3C6199B2E0506E
/data/data/####/files/umeng_it.cache
/data/data/####/files/.snow/.catr.apk
/data/data/####/files/security_info
/data/data/####/files/.snow/.ukd
/data/data/####/databases/bugly_db_legu.mirror
/data/data/####/files/.work/postroot.sh
/data/data/####/files/local_crash_lock
/data/data/####/files/native_record_lock
/data/data/####/files/95d3861ebbd38c2dc8795952cc6c4d37.data
/sdcard/.windy/508e8558f784e3a21d3368e4763e2693.tmp
/data/data/####/files/.snow/.uks
/data/data/####/files/.snow/.dg
/data/data/####/files/awsrabf/libqBikvXzxORCegosEzxc.so
/data/data/####/shared_prefs/googlesdk.xml
/data/data/####/databases/ua.db
/data/data/####/files/.snow/.dlsb.apk
/data/data/####/files/617.jar
/data/data/####/files/640.jar
/data/data/####/files/.default/95d3861ebbd38c2dc8795952cc6c4d37.data.temp
/data/data/####/files/awsrabf/libUniUxqsTCxkMnvngbt.so
/data/data/####/files/.play/test
/data/data/####/files/.S1CH1S/C32F925E36EF6D6723BA863618B860E6
/data/data/####/shared_prefs/internal.xml
/data/data/####/files/.play/.md
/data/data/####/files/1805.jar
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/.snow/.zip/rsh
/data/data/####/databases/webview.db.mirror
/data/data/####/files/421.jar
/data/data/####/files/libhjdSsDMxuUQaCVMDbootstrap.so
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/files/23DB8520H32/####12x862
/data/data/####/files/.snow/supolicy
/data/data/####/tx_shell/libufix.so
/data/data/####/files/.snow/busybox
/data/data/####/mix.dex
/data/data/####/files/.snow/.zip/r4
/data/data/####/files/.snow/.zip/r1
/data/data/####/files/.snow/.zip/r3
/data/data/####/files/.snow/.zip/r2
/data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
/data/data/####/files/tzcar.apk
/data/data/####/databases/ua.db-journal
/data/data/####/tx_shell/libnfix.so
/data/data/####/files/.snow/.client
/data/data/####/files/.S1CH1S/77C88DAB96A79BD7EA89098DEBA88F21
/data/data/####/files/.imprint
/data/data/####/files/.snow/checkFile13
/data/data/####/files/.snow/.zip/mkdevsh
/data/data/####/files/610.jar
/data/data/####/files/.gepd/gpdu
/data/data/####/tx_shell/libshella-2.10.2.3.so
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/files/.snow/a.xml
/data/data/####/databases/bugly_db_legu-journal
/data/data/####/files/.snow/.uok
/data/data/####/files/.S1CH1S/DAE162B8F5BD577ECEBC6108599F20CC
/data/data/####/files/.S1CH1S/92A3CECF3802288A78D870D83988D064
/data/data/####/files/LDyARNDidKiYcqzxdynamicloader.jar
/data/data/####/files/Android-x86112.jar
/data/data/####/databases/cc.db.mirror

Sets the 'executable' attribute to the following files:

/data/data/####/files/.snow/.catr.apk
/data/data/####/files/.work/postroot.sh
/data/data/####/files/.snow/.ir
/data/data/####/files/.snow/.zip/rsh
/data/data/####/files/.snow/busybox
/data/data/####/files/.snow/.zip/mkdevsh
/data/data/####/files/.snow/b.png
/data/data/####/tx_shell/libshella-2.10.2.3.so

Miscellaneous:

Executes next shell scripts:

sh -c rm /data/data/####/files/hftJcw46N.jar > /dev/null 2>&1
chown 0.0 /system/bin/.author
mount -wo remount rw /system
app_process /system/bin com.android.commands.pm.Pm disable org.app.info.grate
mount -o remount ro /system
/system/bin/sh -c getprop ro.meizu.product.model
chown 0.0 /system/xbin/.rainin
mount -o remount,ro /system
chmod 700 /data/data/####/tx_shell/libufix.so
getprop ro.gn.gnromvernumber
/system/bin/dexopt --dex 27 57 40 30568 /data/data/####/files/LDyARNDidKiYcqzxdynamicloader.jar 1251703873 325286116 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system
getenforce
sh /data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
/system/bin/sh -c getprop ro.miui.ui.version.name
chcon u:object_r:system_file:s0 /system/bin/debuggerd
getprop ro.build.nubia.rom.name
chown 0.0 /system/app/Banner.apk
sh -c rm -f /data/data/####/files/hftJcw46N.jar > /dev/null 2>&1
chown 0:0 /system/app/oneshs.apk
chmod 777 /data/data/####/files/.snow/.zip/r4
/data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
chmod 777 /data/data/####/files/.snow/.zip/r1
getprop ro.build.version.opporom
chmod 777 /data/data/####/files/.snow/.zip/r2
sh -c rm -f /data/data/####/files/hftJcw46N.dex > /dev/null 2>&1
/system/bin/sh -c getprop ro.gn.gnromvernumber
mount -o remount,rw /system
chmod 777 /data/data/####/files/.snow/.zip/mkdevsh
chmod 777 /data/data/####/files/.snow/busybox
chmod 777 /data/data/####/files/.work/postroot.sh
chown 0:0 /system/app/Dingps.apk
mount -ro remount,ro /system
chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
chcon u:object_r:system_file:s0 /system/xbin/supolicy
app_process /system/bin com.android.commands.pm.Pm disable com.fly.me.ssp.be
chmod 777 /data/data/####/files/.snow/myshell
getprop ro.lewa.version
chown 0:0 /system/xbin/.cp
chown 0.0 /system/app/Lowerp.apk
chown 0.0 /system/app/Dingps.apk
app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
chcon u:object_r:system_file:s0 /system/bin/.author
app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
/system/bin/sh -c getprop ro.aa.romver
mount -ro remount ro /system
/system/bin/dexopt --dex 27 65 40 23552 /data/data/####/files/hftJcw46N.jar 1251050865 -405892272 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
rm /data/data/####/files/hftJcw46N.dex
sh -c /system/usr/toolbox rm -f /data/data/####/files/hftJcw46N.jar > /dev/null 2>&1
app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
chown 0:0 /system/xbin/.ci.pm
rm -f /data/data/####/files/hftJcw46N.dex
chmod 777 /data/data/####/files/.snow/.ukd
chmod 777 /data/data/####/files/.snow/.client
chown 0.0 /data/local/tmp/busybox
/system/bin/sh -c getprop ro.lewa.version
chmod 777 /data/data/####/files/.snow/.uks
chmod 777 /data/data/####/files/.snow/a.xml
chown 0.0 /system/app/Treese.apk
app_process /system/bin com.android.commands.pm.Pm enable org.app.info.grate
chmod 700 /data/data/####/tx_shell/libnfix.so
getprop ro.miui.ui.version.name
/system/bin/dexopt --dex 27 51 40 10544 /data/data/####/files/hello.apk 1251708389 1311588194 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
chown 0:0 /system/app/Treese.apk
/system/bin/sh -c getprop ro.build.version.emui
rm -f /data/data/####/files/hftJcw46N.jar
rm -f /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
chown 0:0 /system/bin/.author
/data/data/####/files/.play/test /data/data/####/files/.play/ 22a66d1676604160b855343cd9b269fe
/system/bin/sh -c getprop ro.build.fingerprint
app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
chmod 777 /data/data/####/files/.snow/.dg
chcon u:object_r:system_file:s0 /system/xbin/.rainin
chown 0:0 /data/local/tmp/busybox
chown 0:0 /system/lib/libsoon.so
chown 0.0 /system/xbin/supolicy
getprop ro.build.rom.id
getprop ro.yunos.version
/system/bin/dexopt --dex 27 65 40 234420 /data/data/####/files/tzcar.apk 1247969587 301827261 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
/system/bin/sh -c getprop ro.board.platform
chown 0:0 /system/app/Lowerp.apk
chown 0.0 /system/bin/debuggerd
chmod 777 /data/data/####/files/.snow/.uok
/data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 22a66d1676604160b855343cd9b269fe /data/data/####/.syslib-
getprop ro.build.fingerprint
chmod 777 /data/data/####/files/.snow/b.png
/system/bin/sh -c getprop ro.vivo.os.build.display.id
sh -c rm /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh /data/data/####/files/.play/test /data/data/####/files/.play/ 22a66d1676604160b855343cd9b269fe
chown 0.0 /system/app/oneshs.apk
getprop ro.board.platform
rm /data/data/####/files/hftJcw46N.jar
chown 0.0 /system/xbin/.cp
df /system
rm /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
chown 0:0 /system/xbin/.rainin
/system/bin/sh -c getprop ro.lenovo.series
chmod 777 /data/data/####/files/.snow/.catr.apk
chmod 777 /data/data/####/files/.snow/supolicy
chmod 777 /data/data/####/files/.snow/.zip/rsh
sh -c /system/usr/toolbox rm -f /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
chmod 777 /data/data/####/files/.snow/exp
chown 0.0 /system/xbin/.ci.pm
chmod 777 /data/data/####/files/.snow/.zip/rt8
getprop ro.build.version.emui
chown 0:0 /system/bin/debuggerd
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.opporom
chcon u:object_r:system_file:s0 /system/xbin/.cp
chcon u:object_r:system_file:s0 /system/lib/libsoon.so
/system/bin/dexopt --dex 27 67 40 2504384 /data/data/####/files/.default/.p.apk 1251299633 -1585053023 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext
app_process /system/bin com.android.commands.pm.Pm enable com.fly.me.ssp.be
rm /system/bin/debuggerd
chmod 777 /data/data/####/files/.snow/.service
/system/bin/sh -c getprop ro.build.rom.id
sh -c rm -f /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
/system/bin/dexopt --dex 27 81 40 66944 /data/data/####/files/Android-x86112.jar 1251052727 1662001824 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext
chmod 770 /data/data/####/files/.play/test
getprop ro.aa.romver
/data/data/####/app_bin/daemon -p #### -s com.dzlp.we.c.a -t 180
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/dexopt --dex 27 52 40 1859444 /data/data/####/files/source.apk 1251708388 -1359275103 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
/system/bin/sh -c type su
/system/bin/dexopt --dex 27 51 40 292 /data/data/####/mix.dex 1493729024 -49011495 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
chown 0.0 /data/local/tmp/.catr.apk
chown 0:0 /system/xbin/supolicy
chmod 0771 /data/data/####/.syslib-
getprop ro.lenovo.series
chown 0:0 /data/local/tmp/.catr.apk
sh /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 22a66d1676604160b855343cd9b269fe /data/data/####/.syslib-
logcat -d -v threadtime
getprop ro.build.tyd.kbstyle_version
getprop ro.meizu.product.model
chmod 777 /data/data/####/files/.snow/.zip/r3
mount -wo remount,rw /system
getprop ro.vivo.os.build.display.id
mount -o remount rw /system
chmod 700 /data/data/####/tx_shell/libshella-2.10.2.3.so
chown 0.0 /system/lib/libsoon.so
sh
sh -c /system/usr/toolbox rm -f /data/data/####/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm /data/data/####/files/hftJcw46N.dex > /dev/null 2>&1
/system/bin/sh ./mkdevsh
chmod 777 /data/data/####/files/.snow/.zip/
chown 0:0 /system/app/Banner.apk

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial