Android.Backdoor.371.origin

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM ZDSRooter.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM adb.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM fastboot.exe

Modifies file system

Creates the following files

%TEMP%\nsv10f6.tmp\system.dll
%TEMP%\nsv10f6.tmp\nsexec.dll
%ProgramFiles(x86)%\zdsrooter\zdsrooter.exe
%ProgramFiles(x86)%\zdsrooter\skin\rooter.zip
%APPDATA%\microsoft\windows\start menu\programs\ГІВ»ВјГјrootВґГіГЄВ¦.lnk
%HOMEPATH%\desktop\ГІВ»ВјГјrootВґГіГЄВ¦.lnk
%ProgramFiles(x86)%\zdsrooter\zdsspriter.apk
%ProgramFiles(x86)%\zdsrooter\httpftp.dll
%ProgramFiles(x86)%\zdsrooter\duilib.dll
%ProgramFiles(x86)%\zdsrooter\zlib.dll
%ProgramFiles(x86)%\zdsrooter\libeay32.dll
%ProgramFiles(x86)%\zdsrooter\ssleay32.dll
%ProgramFiles(x86)%\zdsrooter\bin.zip.crypt
%ProgramFiles(x86)%\zdsrooter\adbwinusbapi.dll
%ProgramFiles(x86)%\zdsrooter\adbwinapi.dll
%ProgramFiles(x86)%\zdsrooter\adb.exe
%ProgramFiles(x86)%\zdsrooter\fastboot.exe
%ProgramFiles(x86)%\zdsrooter\devices.dll
%ProgramFiles(x86)%\zdsrooter\libcurl.dll
%ProgramFiles(x86)%\zdsrooter\sqlite3.dll
%ProgramFiles(x86)%\zdsrooter\data.crypt
%ProgramFiles(x86)%\zdsrooter\uninst.exe
%TEMP%\zds.tmp
%HOMEPATH%\.android\adbkey.pub
%HOMEPATH%\.android\adbkey
%TEMP%\adb.log

Deletes following files that it created itself

%TEMP%\nsv10f6.tmp\nsexec.dll
%TEMP%\nsv10f6.tmp\system.dll

Network activity

Connects to

'ap#.#fkx.net':80
'st###c.opda.com':80
'localhost':5037
'localhost':5555
'localhost':5557
'localhost':5559
'localhost':5561
'localhost':5563
'localhost':5565
'localhost':5567
'localhost':5569
'localhost':5571
'localhost':5573
'localhost':5575
'localhost':5577
'localhost':5579
'localhost':5581
'localhost':5583
'localhost':5585

TCP

HTTP GET requests

Other

'localhost':5037
'localhost':49708
'localhost':49709
'localhost':49710
'localhost':49713
'localhost':49714
'localhost':49715
'localhost':49716
'localhost':49718
'localhost':49719
'localhost':49720
'localhost':49721
'localhost':49723
'localhost':49724
'localhost':49725
'localhost':49726
'localhost':49728
'localhost':49729
'localhost':49730
'localhost':49731
'localhost':49733
'localhost':49734
'localhost':49735
'localhost':49736
'localhost':49739
'localhost':49740
'localhost':49741
'localhost':49742
'localhost':49744
'localhost':49745
'localhost':49747
'localhost':49748
'localhost':49750
'localhost':49751
'localhost':49752
'localhost':49753
'localhost':49755
'localhost':49756
'localhost':49758
'localhost':49759
'localhost':49761
'localhost':49762
'localhost':49763
'localhost':49764
'localhost':49766
'localhost':49767
'localhost':49768
'localhost':49769
'localhost':49771
'localhost':49772
'localhost':49773
'localhost':49774
'localhost':49776
'localhost':49777
'localhost':49778
'localhost':49779
'localhost':49780
'localhost':49781
'localhost':49782
'localhost':49783
'localhost':49784
'localhost':49785
'localhost':49786
'localhost':49787
'localhost':49788
'localhost':49789
'localhost':49790
'localhost':49791
'localhost':49792
'localhost':49793
'localhost':49794
'localhost':49795
'localhost':49796
'localhost':49797
'localhost':49798
'localhost':49799
'localhost':49800
'localhost':49801
'localhost':49803
'localhost':49804
'localhost':49806
'localhost':49807
'localhost':49808
'localhost':49809
'localhost':49810
'localhost':49811
'localhost':49812
'localhost':49813
'localhost':49814
'localhost':49815
'localhost':49816
'localhost':49817
'localhost':49818
'localhost':49819
'localhost':49820
'localhost':49821
'localhost':49822
'localhost':49823
'localhost':49824
'localhost':49825
'localhost':49826
'localhost':49827
'localhost':49828
'localhost':49829
'localhost':49830
'localhost':49831
'localhost':49832
'localhost':49833
'localhost':49834
'localhost':49835
'localhost':49836
'localhost':49837
'localhost':49838
'localhost':49839
'localhost':49840
'localhost':49841
'localhost':49842
'localhost':49843
'localhost':49844
'localhost':49845
'localhost':49846
'localhost':49847
'localhost':49848
'localhost':49849
'localhost':49850
'localhost':49851
'localhost':49852
'localhost':49853
'localhost':49854
'localhost':49855
'localhost':49857
'localhost':49858
'localhost':49859
'localhost':49860
'localhost':49861
'localhost':49862
'localhost':49863
'localhost':49864
'localhost':49865
'localhost':49866
'localhost':49867
'localhost':49868
'localhost':49869
'localhost':49870
'localhost':49871
'localhost':49872
'localhost':49873
'localhost':49874
'localhost':49875
'localhost':49876
'localhost':49877
'localhost':49878
'localhost':49879
'localhost':49880

UDP

DNS ASK ap#.#fkx.net
DNS ASK st###c.opda.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\zdsrooter\zdsrooter.exe'

Executes the following

'%ProgramFiles(x86)%\zdsrooter\adb.exe' fork-server server
'%WINDIR%\syswow64\taskkill.exe' /F /IM ZDSRooter.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM adb.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /IM fastboot.exe' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial