Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.443.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sl.zhang####.com:80
- TCP(HTTP/1.1) gp.sh####.com:80
- TCP(HTTP/???) gp.sh####.com:80
- TCP(TLS/1.0) 1####.217.20.110:443
DNS requests:
- gp.sh####.com
- gp.sj####.com
- sl.zhang####.com
HTTP GET requests:
- gp.sh####.com/cr/sv/getGoFile?name=####
- gp.sh####.com/cr/sv/getRltNew?eid=####
- gp.sh####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=####...
- sl.zhang####.com/apk/des_v171204_32.zip
- sl.zhang####.com/apk/goplaysdk_v171201_sp2.dat
- sl.zhang####.com/rtf/408b845b63828fe074b39ecd1cba374c.slze
- sl.zhang####.com/rtf/42108637bf1aa8173608aa9259693c1b.slze
- sl.zhang####.com/rtf/43048420199e0767a10a7a1a25e65e32.slze
- sl.zhang####.com/rtf/611939f8c2ec5798458a1b43c5d12c08.slze
- sl.zhang####.com/rtf/6172e4a32338b1deed308f899acf3ce1.slze
- sl.zhang####.com/rtf/640adb88b11aaa31cef58f201f381b03.slze
- sl.zhang####.com/rtf/8063d9d8538ce6248951fd430b6c7632.slze
- sl.zhang####.com/rtf/95039bf01df7c9832986cba2bad47076.slze
HTTP POST requests:
- gp.sh####.com/cr/sv/getEPList
Modified file system:
Creates the following files:
- /data/data/####/.md
- /data/data/####/1537814694046_beta32.so
- /data/data/####/27AF223B666DD18DF8DD4CBDDB20716E
- /data/data/####/408.jar
- /data/data/####/421.jar
- /data/data/####/430.jar
- /data/data/####/58D74CBC121EE40760DC7A188AF6D056
- /data/data/####/5adsdemo2DB8520H46
- /data/data/####/611.jar
- /data/data/####/617.jar
- /data/data/####/640.jar
- /data/data/####/6AD6FD6C666D47670FF51A53CBF61861
- /data/data/####/799EF3B5D226ED5BD16DD16C4BBD6412
- /data/data/####/806.jar
- /data/data/####/80C2A3143C9D81F585346BE87F2E4736
- /data/data/####/950.jar
- /data/data/####/A159B0C28AE1CB803901FD775D928DED
- /data/data/####/EC311584DEE33DD96EBE4A338AC87658
- /data/data/####/F6DA6C93949BA356D7781C1F118066B0
- /data/data/####/device_gpid.xml.xml
- /data/data/####/gpdu
- /data/data/####/hftJcw46N.jar
- /data/data/####/ntmp22672280
- /data/data/####/pro.sdk.inmobi.qh.com.adsdemo12golden2
- /data/data/####/pro.sdk.inmobi.qh.com.adsdemo_preferences.xml
- /data/data/####/pro.sdk.inmobi.qh.com.adsdemo_preferences.xml.bak
- /data/data/####/samsung112.jar
- /data/data/####/test
- /data/data/####/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/files/.play/test <Package Folder>/files/.play/ b075121dcc0c431bbf10418808c27e75
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h b075121dcc0c431bbf10418808c27e75 <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- chmod 770 <Package Folder>/files/.play/test
- getenforce
- ls -l /system/xbin/su
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ b075121dcc0c431bbf10418808c27e75
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h b075121dcc0c431bbf10418808c27e75 <Package Folder>/.syslib-
Loads the following dynamic libraries:
- 1537814694046_beta32
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
