Android.DownLoader.2682

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.20.origin
Android.Backdoor.333.origin
Android.Backdoor.336.origin
Android.Rooter.16.origin
Android.Exploit.12

Downloads the following detected threats from the Web:

Android.Backdoor.336.origin

Network activity:

Connecting to:

s####.####.com
d1vtofx####.####.net
ip####.io
kv####.com
d####.####.com
e####.####.com
w####.####.com
m####.####.com
a####.####.com

HTTP GET requests:

kv####.com/krt.do?model=####&hdware=####&display=####&ver=####&aid=####&...
kv####.com/krt.do?result=####&model=####&hdware=####&display=####&ver=##...
w####.####.com/rmct/jpst1
s####.####.com/s1/zbrep
d####.####.com/ad.png
s####.####.com/s1/zakef
ip####.io/json
s####.####.com/s1/?p=####
s####.####.com/s1/zrhep
e####.####.com/thinking/group/exp
d1vtofx####.####.net/redirectdown/O_SDK_1216_51.zip?model=####&hdware=##...
d####.####.com/thinking/group/rtt_0511_669.apk
d1vtofx####.####.net/redirectdown/rf_all_2_newcname_dex.jar?model=####&h...

HTTP POST requests:

a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
s####.####.com/s2/?pn=####&vc=####&md=####&ov=####&mc=####&lc=####&chn=#...
s####.####.com/ggview/rsddateindex
m####.####.com/errorview/api/601

Modified file system:

Creates the following files:

<Package Folder>/files/.z/r8
<Package Folder>/files/.snow/.zip/mkdevsh
<Package Folder>/files/.z/r2
<Package Folder>/files/.z/r3
<Package Folder>/files/.data/unzfile/DTSP_HtmlOutViewer.apk
<Package Folder>/files/.z/r1
<Package Folder>/files/.z/r6
<Package Folder>/files/.z/r4
<Package Folder>/files/.z/r5
<Package Folder>/files/.data/.root
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/Preference.xml
<Package Folder>/files/.data/unzfile/KM_JM_DY100_102.apk
<Package Folder>/app_libs/nc
<Package Folder>/files/.data/unzfile/AndroidSystemPlug2.apk
<Package Folder>/shared_prefs/store.xml.bak
<Package Folder>/files/.data/unzfile/ir
<Package Folder>/files/.z/r0
<Package Folder>/files/.snow/myshell
<Package Folder>/files/.data/root_001
<Package Folder>/files/.data/unzfile/OO_HKTW_NPT.apk
<Package Folder>/files/.data/root_005
<Package Folder>/files/.data/unzfile/GLV_Nuts_zhnan_apk1_c1_s02_zs_20160727.apk
<Package Folder>/files/.data/root_007
<Package Folder>/files/.data/root_008
<Package Folder>/files/.z/busybox
<Package Folder>/files/.data/unzfile/AEL_NgpDT_20161011_124_C001.apk
<Package Folder>/files/.snow/.dlme.apk
<Package Folder>/files/x2
<Package Folder>/files/x5
<Package Folder>/files/wddex.jar
<Package Folder>/files/32d0c3764a75d854745f1d868f8081e3.data
<Package Folder>/files/.data/unzfile/supolicy
<Package Folder>/files/.data/gfhadex.jar
<Package Folder>/shared_prefs/Local.xml.bak
<Package Folder>/files/.data/unzfile/pet
<Package Folder>/app_libs/n4
<Package Folder>/app_libs/n2
<Package Folder>/app_libs/n3
<Package Folder>/app_libs/n1
<Package Folder>/files/.snow/.zip/rt8
<Package Folder>/files/.data/unzfile/Bfa_DTCGP_ScreenProvider.apk
<Package Folder>/app_libs/download331728624.tmp
<Package Folder>/files/.snow/.dsmt.apk
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/files/.snow/exp
<Package Folder>/shared_prefs/FAVOR.xml
<Package Folder>/files/.snow/.ir
<Package Folder>/app_libs/jptst.jar
<Package Folder>/app_libs/vkd6Whm83d.apk
<Package Folder>/files/.data/unzfile/chattr
<Package Folder>/files/.data/unzfile/Cff_SERVICE_6516384_sys_release.apk
<Package Folder>/files/.snow/.uok
<Package Folder>/cache/webviewCacheChromium/index
<Package Folder>/app_libs/ndcfg
<Package Folder>/files/.snow/.service
<Package Folder>/app_libs/nsh
<Package Folder>/files/.snow/a.xml
<Package Folder>/files/.data/unzfile/TotalCmd2.apk
<Package Folder>/app_sgdex/dos.jar
<Package Folder>/files/.snow/supolicy
<Package Folder>/files/.data/unzfile/Haha_in_system_noiconapp_debug.apk
<Package Folder>/files/.z/su2
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/.data/unzfile/PEJT_DM_A4977_20161216.apk
<Package Folder>/app_libs/etemp
<Package Folder>/files/.snow/busybox
<Package Folder>/app_file/yrhna.jar
<Package Folder>/files/.data/unzfile/DIEF_HJCX_MediaPlayServices_ruixun01.apk
<Package Folder>/files/.snow/.client
<Package Folder>/files/.snow/.catr.apk
<Package Folder>/files/.data/unzfile/busybox
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/files/.data/exebin
<Package Folder>/files/memnut
<Package Folder>/app_libs/download-105579462.tmp
<Package Folder>/files/.data/rf_all_2_newcname_dex.jar
<Package Folder>/files/.work/postroot.sh
<Package Folder>/files/.data/unzfile/dg
<Package Folder>/databases/cc/cc.db-journal
<Package Folder>/files/.data/unzfile/r.sh
<Package Folder>/files/.default/32d0c3764a75d854745f1d868f8081e3.data.temp
<Package Folder>/files/.snow/b.png
<Package Folder>/files/.z/killall
<Package Folder>/files/.snow/.zip/r4
<Package Folder>/files/.snow/.zip/r1
<Package Folder>/files/.snow/.zip/r3
<Package Folder>/files/.snow/.zip/r2
<Package Folder>/files/.snow/.center.tapk
<Package Folder>/files/mda.ico
<Package Folder>/files/.data/O_SDK_1216_51.zip
<Package Folder>/files/.data/unzfile/sprot
<Package Folder>/app_libs/base.apk
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/files/.snow/.dico.apk
<Package Folder>/app_libs/et
<Package Folder>/files/.data/root_004
<Package Folder>/files/.snow/.uks
<Package Folder>/files/.snow/.dg
<Package Folder>/files/.data/root_006
<Package Folder>/files/.snow/checkFile13
<Package Folder>/app_libs/brz.zip
<Package Folder>/files/.snow/checkFile0
<Package Folder>/files/.snow/.ukd
<Package Folder>/files/.snow/.dlsb.apk
<Package Folder>/app_libs/ads.apk
<Package Folder>/shared_prefs/Local.xml
<Package Folder>/files/.data/unzfile/TotalCmd.apk
<Package Folder>/app_libs/download1845311703.tmp
<Package Folder>/app_libs/download600496309.tmp
<Package Folder>/files/.snow/.zip/rsh
<Package Folder>/app_libs/dt
<Package Folder>/files/schema
<Package Folder>/databases/offline.dataBase-journal
<Package Folder>/databases/cc/cc.db
<Package Folder>/shared_prefs/store.xml
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/webviewCacheChromium/data_3
<Package Folder>/cache/webviewCacheChromium/data_2
<Package Folder>/cache/webviewCacheChromium/data_1
<Package Folder>/cache/webviewCacheChromium/data_0

Miscellaneous:

Executes next shell scripts:

app_process /system/bin com.android.commands.pm.Pm disable org.app.info.grate
sh <Package Folder>/files/.z/r4 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
mount -o remount ro /system
chown 0.0 /system/xbin/.rainin
mount -o remount,ro /system
chmod 777 /data/data/####/files/.data/unzfile/Cff_SERVICE_6516384_sys_release.apk
chmod 777 <Package Folder>/files/.data/unzfile/Cff_SERVICE_6516384_sys_release.apk
sh <Package Folder>/files/.data/root_005 /system/bin/sh
sh <Package Folder>/files/.z/r4 -c <Package Folder>/files/.data/unzfile/r.sh
app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
/data/data/####/files/.z/su2 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh /data/data/####/files/.data/unzfile/r.sh
chmod 777 <Package Folder>/files/.data/unzfile/TotalCmd2.apk
/data/data/####/files/.data/root_007 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh
chmod 777 <Package Folder>/files/.snow/.zip/rsh
chmod 777 <Package Folder>/files/.snow/.ukd
chmod 06755 <Package Folder>/files/.data/root_006
/data/data/####/files/.data/root_004 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
chmod 777 /data/data/####/files/.data
chcon u:object_r:system_file:s0 /system/bin/debuggerd
chmod 755 <Package Folder>/files/.data/gfhadex.jar
chown 0.0 /system/app/Banner.apk
chmod 777 <Package Folder>/files/.snow/.uks
chmod 777 <Package Folder>/files/.data/unzfile/r.sh
chmod 777 /data/data/####/files/.data/unzfile/Bfa_DTCGP_ScreenProvider.apk
chown 0:0 /system/app/oneshs.apk
chmod 777 /data/data/####/files/.data/unzfile/TotalCmd2.apk
chmod 777 /data/data/####/files/.data/rf_all_2_newcname_dex.jar
/data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
/data/data/####/files/.z/r1 /data/data/####/files/.data/unzfile/r.sh
sh <Package Folder>/files/.z/r6 /system/bin/sh
app_process /system/bin com.android.commands.pm.Pm disable com.example.gpsdk
chmod 777 /data/data/####/files/.data/unzfile/ir
/data/data/####/files/.data/root_006 /system/bin/sh
chmod 777 <Package Folder>/files/.data/unzfile/GLV_Nuts_zhnan_apk1_c1_s02_zs_20160727.apk
chmod 777 <Package Folder>/files/.snow/exp
chown 0:0 /system/app/Dingps.apk
mount -ro remount,ro /system
chmod 06755 <Package Folder>/files/.data/root_008
chmod 755 <Package Folder>/files/schema
chcon u:object_r:system_file:s0 /system/xbin/supolicy
chmod 777 /data/data/####/files/.data/unzfile/AndroidSystemPlug2.apk
app_process /system/bin com.android.commands.pm.Pm disable com.fly.me.ssp.be
chmod 06755 <Package Folder>/files/.data/root_001
chmod 06755 <Package Folder>/files/.data/root_004
chmod 06755 <Package Folder>/files/.data/root_005
/data/data/####/files/.z/su2 al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh /data/data/####/files/.data/unzfile/r.sh
chmod 777 <Package Folder>/files/.data/rf_all_2_newcname_dex.jar
chown 0.0 /data/local/tmp/busybox
/data/data/####/files/.z/r2
/data/data/####/files/.z/r3
chmod 777 <Package Folder>/files/.data/unzfile/Bfa_DTCGP_ScreenProvider.apk
sh <Package Folder>/files/.z/su2 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh <Package Folder>/files/.data/unzfile/r.sh
chown 0.0 /system/app/smalin.apk
chown 0:0 /system/xbin/.cp
chown 0.0 /system/app/Lowerp.apk
chown 0.0 /system/app/Dingps.apk
/data/data/####/files/.z/r1 -auto
chcon u:object_r:system_file:s0 /system/bin/.author
chmod 777 <Package Folder>/files/.data/unzfile/sprot
app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
chmod 06755 /data/data/####/files/.data/root_005
chown 0:0 /system/bin/.author
mount -ro remount ro /system
sh <Package Folder>/files/.data/root_008
chmod 777 /data/data/####/files/.data/unzfile/GLV_Nuts_zhnan_apk1_c1_s02_zs_20160727.apk
mount -wo remount rw /system
chmod 777 /data/data/####/files/.data/unzfile/busybox
chmod 777 /data/data/####/files/.data/unzfile/KM_JM_DY100_102.apk
chmod 777 <Package Folder>/files/.snow/.zip/rt8
/data/data/####/files/.z/r2 -c /data/data/####/files/.data/unzfile/r.sh
/data/data/####/files/.data/root_007 al1s7jBFNtn9faBmC0Jb9A9NslGZSg== /system/bin/sh
app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
chown 0:0 /system/xbin/.ci.pm
/system/xbin/.memnut
chmod 777 /data/data/####/files/.data/unzfile/DIEF_HJCX_MediaPlayServices_ruixun01.apk
/data/data/####/files/.z/r8
chmod 06755 /data/data/####/files/.data/root_001
chmod 06755 /data/data/####/files/.data/root_004
chmod 777 <Package Folder>/files/.data/unzfile/chattr
chmod 06755 /data/data/####/files/.data/root_006
chmod 06755 /data/data/####/files/.data/root_007
chmod 06755 /data/data/####/files/.data/root_008
chmod 777 <Package Folder>/files/.data/unzfile/DIEF_HJCX_MediaPlayServices_ruixun01.apk
/data/data/####/files/.z/r1 -C '/data/data/####/files/.data/unzfile/r.sh'
/data/data/####/files/.data/root_008
chown 0:0 /system/app/smalin.apk
chmod 755 /data/data/####/files/.data/gfhadex.jar
/data/data/####/files/.z/r5 /system/bin/sh
chmod 777 <Package Folder>/files/.data/unzfile/dg
/data/data/####/files/.z/r0 -c /data/data/####/files/.data/unzfile/r.sh
chmod 777 <Package Folder>/files/.data/O_SDK_1216_51.zip
<error:2>
chown 0.0 /system/app/Treese.apk
app_process /system/bin com.android.commands.pm.Pm enable org.app.info.grate
chmod 777 <Package Folder>/files/.data/unzfile/Haha_in_system_noiconapp_debug.apk
sh <Package Folder>/files/.z/r2 -c <Package Folder>/files/.data/unzfile/r.sh
chown 0:0 /system/app/Treese.apk
chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
sh <Package Folder>/files/.z/r5 /system/bin/sh
chmod 06755 <Package Folder>/files/.data/root_007
/data/data/####/files/.data/root_001 –auto
chown 0:0 /system/xbin/supolicy
sh <Package Folder>/files/.data/.root
chmod 777 /data/data/####/files/.data/unzfile/dg
chmod 777 /data/data/####/files/.data/unzfile/sprot
app_process /system/bin com.android.commands.pm.Pm enable com.example.gpsdk
/data/data/####/files/.z/r4 -c /data/data/####/files/.data/unzfile/r.sh
/data/data/####/files/.data/.root
app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
cp
sh <Package Folder>/files/.z/su2 al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh <Package Folder>/files/.data/unzfile/r.sh
chcon u:object_r:system_file:s0 /system/xbin/.rainin
chown 0:0 /data/local/tmp/busybox
/data/data/####/files/.z/r6 /system/bin/sh
chown 0:0 /system/lib/libsoon.so
chmod 777 <Package Folder>/files/.snow/.uok
chmod 777 <Package Folder>/files/.snow/.dg
sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
chmod 777 <Package Folder>/files/.data/unzfile/AndroidSystemPlug2.apk
chmod 777 <Package Folder>/files/.snow/.zip/
chmod 777 /data/data/####/files/.data/unzfile/chattr
/system/bin/dupcat
chown 0:0 /system/app/Lowerp.apk
chown 0.0 /system/bin/debuggerd
chown 0.0 /system/xbin/supolicy
sh <Package Folder>/files/.z/su2 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh <Package Folder>/files/.data/unzfile/r.sh
chmod 777 /data/data/####/files/.data/unzfile/Haha_in_system_noiconapp_debug.apk
chmod 777 <Package Folder>/files/.snow/.zip/r1
chmod 777 <Package Folder>/files/.snow/.zip/r3
chmod 777 <Package Folder>/files/.snow/.zip/r2
chmod 777 <Package Folder>/files/.snow/.zip/r4
chmod 777 <Package Folder>/files/.data/unzfile
chmod 777 /data/data/####/files/.data/unzfile
chmod 777 <Package Folder>/files/.snow/b.png
chmod 777 /data/data/####/files/.data/unzfile/PEJT_DM_A4977_20161216.apk
chmod 777 /data/data/####/files/.data/unzfile/OO_HKTW_NPT.apk
chmod 777 <Package Folder>/files/.data/unzfile/supolicy
chmod 777 <Package Folder>/files/.snow/a.xml
chmod 777 <Package Folder>/files/.data/unzfile/busybox
df /system
sh <Package Folder>/files/.data/root_004 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
chown 0:0 /system/xbin/.rainin
/data/data/####/files/.data/root_005 /system/bin/sh
app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
chmod 777 /data/data/####/files/.data/unzfile/AEL_NgpDT_20161011_124_C001.apk
/data/data/####/files/.z/r3 -c /data/data/####/files/.data/unzfile/r.sh
chmod 06755 /data/data/####/files/.data/.root
sh <Package Folder>/files/.z/r3 -c <Package Folder>/files/.data/unzfile/r.sh
chown 0.0 /system/xbin/.ci.pm
sh <Package Folder>/files/.data/root_001 auto
chmod 777 /data/data/####/files/.data/unzfile/TotalCmd.apk
chown 0:0 /system/bin/debuggerd
chmod 777 <Package Folder>/files/.data/unzfile/pet
chcon u:object_r:system_file:s0 /system/xbin/.cp
chcon u:object_r:system_file:s0 /system/lib/libsoon.so
app_process /system/bin com.android.commands.pm.Pm enable com.fly.me.ssp.be
rm /system/bin/debuggerd
sh <Package Folder>/files/.data/exebin
id
chmod 777 <Package Folder>/files/.data/unzfile/TotalCmd.apk
chmod 777 /data/data/####/files/.data/unzfile/r.sh
sh <Package Folder>/files/.data/root_007 al1s7jBFNtn9faBmC0Jb9A9NslGZSg== /system/bin/sh
/data/data/####/files/.data/exebin
chmod 777 <Package Folder>/files/.data/unzfile/KM_JM_DY100_102.apk
chown 0.0 /system/xbin/.cp
chmod 777 /data/data/####/files/.data/unzfile/pet
chmod 06755 <Package Folder>/files/.data/.root
chmod 777 <Package Folder>/files/.snow/.catr.apk
app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
chmod 777 <Package Folder>/files/.data/unzfile/AEL_NgpDT_20161011_124_C001.apk
/data/data/####/files/.z/r4 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
sh <Package Folder>/files/.data/root_007 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh
chmod 777 <Package Folder>/files/.snow/.client
chown 0.0 /data/local/tmp/.catr.apk
chmod 777 <Package Folder>/files/.snow/supolicy
chmod 755 /data/data/####/files/schema
/data/data/####/files/.data/root_007 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh
sh <Package Folder>/files/.z/r0 -c <Package Folder>/files/.data/unzfile/r.sh
chmod 777 <Package Folder>/files/.snow/.service
chmod 777 <Package Folder>/files/.work/postroot.sh
chown 0:0 /data/local/tmp/.catr.apk
sh <Package Folder>/files/.z/r1 -auto
chmod 777 <Package Folder>/files/.data/unzfile/DTSP_HtmlOutViewer.apk
sh <Package Folder>/files/.z/r1 -C '<Package Folder>/files/.data/unzfile/r.sh'
sh <Package Folder>/files/.z/r2
sh <Package Folder>/files/.z/r3
sh <Package Folder>/files/.z/r1 <Package Folder>/files/.data/unzfile/r.sh
chmod 777 <Package Folder>/files/.snow/busybox
chmod 755 /data/data/####/files/.data/exebin
sh <Package Folder>/files/.data/root_007 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh
mount -wo remount,rw /system
chmod 777 <Package Folder>/files/.data/unzfile/ir
sh <Package Folder>/files/.z/r8
chmod 777 /data/data/####/files/.data/O_SDK_1216_51.zip
chmod 777 /data/data/####/files/.data/unzfile/supolicy
mount -o remount rw /system
chmod 777 <Package Folder>/files/.snow/myshell
chmod 755 <Package Folder>/files/.data/exebin
chmod 777 /data/data/####/files/.data/unzfile/DTSP_HtmlOutViewer.apk
/data/data/####/files/.z/su2 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh /data/data/####/files/.data/unzfile/r.sh
chown 0.0 /system/lib/libsoon.so
chmod 777 <Package Folder>/files/.data
sh
chmod 777 <Package Folder>/files/.data/unzfile/OO_HKTW_NPT.apk
/system/bin/sh ./mkdevsh
<dexopt>
chown 0:0 /system/app/Banner.apk
chmod 777 <Package Folder>/files/.data/unzfile/PEJT_DM_A4977_20161216.apk

Contains functionality to send SMS messages automatically.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial