Android.DownLoader.2700

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Packed.21432
Android.Backdoor.433.origin
Android.DownLoader.552.origin

Downloads the following detected threats from the Web:

Android.Backdoor.433.origin

Network activity:

Connecting to:

s####.####.com
t####.####.com
u####.####.com
g####.####.com
trac####.####.cn
p####.####.com:6088
upa####.####.com
datacol####.####.com
t####.####.net
a####.####.net
7j####.####.com
p####.####.com
c####.####.com
sdk-ope####.####.com
o####.####.com
s####.####.net
c-h####.####.com
a####.####.com

HTTP GET requests:

upa####.####.com/newwfs/banner_pic/%E6%B5%B7%E6%B4%8B%E4%BD%932.jpg
c####.####.com/title.png
upa####.####.com/fontPreZip/6UagIzqM.zip
7j####.####.com/tdata_pxK929
upa####.####.com/newwfs/banner_pic/%E4%B8%8D%E6%95%A2%E8%AF%B4%E7%9A%84%...
upa####.####.com/newwfs/banner_pic/%E5%B0%8F%E6%98%9F%E6%98%9F2.png
upa####.####.com/fipre/vZ9JXYI4_zh_0.jpg
upa####.####.com/newwfs/banner_pic/%E4%B8%80%E8%B5%B7%E5%8E%BB%E6%97%85%...
a####.####.com/v7/policy.php?d=####&t=####
a####.####.net/v3/zip_upd?s=####
upa####.####.com/newwfs/banner_pic/111.jpg
upa####.####.com/newwfs/banner_pic/%E7%90%B4%E7%91%9F%E7%91%9F6.png
upa####.####.com/fontPreZip/mVn694EQ.zip
s####.####.com/config/bj-bjv4.conf
p####.####.com//lnk/desktop/create?appKey=####&channel=####&v=####
upa####.####.com/newwfs/previewfile/lanfengqianrouyulan.zip
upa####.####.com/wfs/2013-06/fe48ec652f8540c6b3d915b936a295b1.zip
t####.####.com/update.php?channel=####&uid=####&from=####&kernelVersion=...
p####.####.com/version/check?versionCode=####&channel=####
upa####.####.com/newwfs/banner_pic/banner338x222.png
upa####.####.com/newwfs/banner_pic/%E5%A5%87%E6%80%9D%E4%B9%94%E4%B9%94%...
upa####.####.com/wfs/2013-06/4f8538c22b144da1a41467ca60f9b1b3.zip
p####.####.com/c/1496217074100
p####.####.com/t0100e8cf8bd10ed8c7.jpg
a####.####.com/v7/switch.php?type=####&app_channel=####&ckey=####
upa####.####.com/wfs/2014-05/qingshupianpianyulan.zip
s####.####.net/stat/aos/v3/pkc?s=####
upa####.####.com/wfs/2013-06/a100ae3cadfc48769a4f68b92f724a4f.zip
upa####.####.com/wfs/2013-09/62c9bbf7d7cc4966980671a08b011f89.zip
upa####.####.com/newwfs/banner_pic/%E5%8D%8E%E5%BA%B7%E7%AE%80%E4%BB%BF%...
c####.####.com/cdndata/support/support?lang=####&ab=####
upa####.####.com/newwfs/banner_pic/%E5%A5%87%E6%80%9D%E5%98%89%E4%B8%BD%...
upa####.####.com/newwfs/banner_pic/222.jpg
upa####.####.com/files/2012-04-25/a41cef5029ac4aeea795c1a5237a2580.zip
s####.####.net/stat/v3/udt2?appid=####&s=####
upa####.####.com/wfs/2013-06/d8d88720bff64a32ba58a1e5b3ab1b3d.zip
upa####.####.com/fontPreZip/GN8s3KEJ.zip
upa####.####.com/wfs/2013-06/e3e45146427640d69e7dbc797c9db824.zip
upa####.####.com/newwfs/banner_pic/%E8%A1%A3%E6%9E%B6%E4%BD%938.png
upa####.####.com/fipre/2a0zZ7hB_zh_0.jpg
7j####.####.com/tdata_XEV804
a####.####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
upa####.####.com/fontPreZip/2a0zZ7hB.zip
a####.####.net/spot/aos/v2/reqv3?s=####
7j####.####.com/tdata_JsY425
upa####.####.com/fontPreZip/iyJp3xUP.zip
s####.####.com/core/aos-dex/1608/6440/26b46b6e.jar
g####.####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&m=####&w...
c####.####.com/cdndata/banner/banner?version=####&type=####&channel_mark...
upa####.####.com/fontPreZip/0QiwS6mT.zip
upa####.####.com/newwfs/banner_pic/%E5%90%83%E8%B4%A7%E5%A4%A7%E8%81%94%...
c####.####.com/cdndata/similefont/similefont?ft_id=####&lang=####&channe...
7j####.####.com/tdata_ibT567
s####.####.com/config/hz-bjv4.conf
t####.####.com/guidthv600.php?uuid=####&platform=####&channel=####&kerne...
p####.####.com/cdndata/fontdetail/fontdetail?ft_id=####
a####.####.net/v3/get?s=####
p####.####.com//auto/OpenApkList
upa####.####.com/fontPreZip/52NnRZpf.zip
upa####.####.com/newwfs/banner_pic/%E5%BF%83%E8%8A%B1%E6%80%92%E6%94%BE2...
s####.####.net/stat/aos/v3/pku?s=####
s####.####.net/aos/v3/initf?s=####
upa####.####.com/newwfs/banner_pic/%E5%AD%97%E4%BD%93%E7%AE%A1%E5%AE%B6%...
c####.####.com/s?v####
p####.####.com/t01c3b0066de27d1339.jpg
upa####.####.com/newwfs/previewfile/yulan.zip
upa####.####.com/fontPreZip/yS4dYBsN.zip
trac####.####.cn/s?type=####&r=####&tid=####&finfo=####&enup=####&mvid=#...
upa####.####.com/newwfs/banner_pic/%E5%AD%99%E8%BF%90%E5%92%8C%E6%A5%B7%...

HTTP POST requests:

c####.####.com//cdndata/hotdata/hotdata?channel_mark=####&version=####&l...
o####.####.com/v2/get_update_time
sdk-ope####.####.com/api.php?format=####&t=####
u####.####.com/frontend/web/index.php?r=####
t####.####.com/v7/dsp_stat.php
o####.####.com/v2/check_config_update
datacol####.####.com/api.php?type=####&duid=####&version=####
p####.####.com//internal/getaclistv2.php?needNewType=####&stamp=####
c####.####.com//cdndata/newdata/newdata?channel_mark=####&version=####&l...
t####.####.net/v1/android/packages?rt=####&sign=####
p####.####.com:6088/s/
p####.####.com//font/all?channelMark=####&lang=####&ftType=####&start=##...
p####.####.com//internal/queryPosts.php?device_id=####&count=####&page=#...
t####.####.com/checkRG.php
p####.####.com/p/1496217074381
a####.####.com/app_logs
t####.####.net/v2/android/pkgtime?rt=####&sign=####
c-h####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

<Package Folder>/databases/T1oX0rhhuXWt
<Package Folder>/shared_prefs/advisers.xml
<Package Folder>/cache/image_manager_disk_cache/3795efd0b29e95c81e15acacaedf13356e890eb1201fdc67374ffd597459898d.0.tmp
<Package Folder>/databases/698fd5baf0305c5b15319671ec70193d-journal
<Package Folder>/databases/6feab07fe3fa1fca4da91448c2740bf8-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/databases/OxgHkj2lz09F
<Package Folder>/databases/f84a698c5549cafb3e31c272d9cb32d6-journal
<Package Folder>/cache/image_manager_disk_cache/68e8929944610d5bab221a0c4e2437c22be43256160028b75675fda14fe4c585.0.tmp
<Package Folder>/cache/image_manager_disk_cache/90a283549d413c04a7203258cc98440051e4cd6f77b44236ccbf4c37aebc02ec.0.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/lists/2.6.1/lists.css
<Package Folder>/databases/ad_down_db-journal
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/tdata_XEV804.jar
<Package Folder>/cache/image_manager_disk_cache/fb29028c4560fe6d5cc121a6498d19166e5e9bcbde38a9795d31d075264510bc.0.tmp
<Package Folder>/files/c148dc09fb3cb074221ef4afa0df4644/offer/dist/aos/share/0.2.0/share.css
<Package Folder>/shared_prefs/META_INFO.xml
<Package Folder>/files/INSTALLATION
<Package Folder>/databases/tmpd8.db-journal
<Package Folder>/shared_prefs/policy.xml
<Package Folder>/app_libs/ymdex.jar.new
<Package Folder>/files/c148dc09fb3cb074221ef4afa0df4644/offer/dist/aos/share/0.2.0/share.js
<Package Folder>/files/.imprint
<Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
<Package Folder>/shared_prefs/file_message.xml
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/pic_tips_02.png
<Package Folder>/cache/image_manager_disk_cache/5a88774e9b42e2d9f5e7be1f8a42c5edf1321fb6b9a577bbd50a02eedaa0aadb.0.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/sprite-icons2.png
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/detail-wx.html
<Package Folder>/databases/jqIqJYOT3JpT
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/arrow-left.png
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/lists/2.6.1/detail.js
<Package Folder>/databases/campaign_db-journal
<Package Folder>/files/tdata_pxK929.tmp
<Package Folder>/cache/image_manager_disk_cache/88b086d505853d97689de6dee7554c6a4e0ab40bc205791548640e5f5d09e680.0.tmp
<Package Folder>/shared_prefs/FontManager.xml
<Package Folder>/databases/T1oX0rhhuXWt-journal
<Package Folder>/databases/download_db-journal
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/close-icon.png
<Package Folder>/files/tdata_JsY425
<Package Folder>/files/tdata_JsY425.jar
<Package Folder>/databases/pushext.db-journal
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/pic_tips_01.png
<Package Folder>/shared_prefs/spotData.xml
<Package Folder>/files/tdata_pxK929.jar
<Package Folder>/files/.umeng/exchangeIdentity.json
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/global/2.5.1/global.js
<Package Folder>/app_cache/res.zip
<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-220578064.zip
<Package Folder>/databases/wsUL1uCdKvjD-journal
<Package Folder>/app_cache/res.png
<Package Folder>/shared_prefs/SP_CACHE.xml.bak
<Package Folder>/cache/image_manager_disk_cache/e624bd813b377c9a190bd59ac5289d8bb5ec6b35326213c33887fb4d46bd7cbd.0.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/arrow-right.png
<Package Folder>/databases/P15pKIjsm64m-journal
<Package Folder>/cache/image_manager_disk_cache/55324bd08aebed98c4f686ff3ddfb49163024d7d57bb47373550cb66b4b2b651.0.tmp
<Package Folder>/files/tdata_ibT567.jar
<Package Folder>/files/c148dc09fb3cb074221ef4afa0df4644/offer/dist/aos/share/0.2.0/detail.js
<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-21542112.zip
<Package Folder>/shared_prefs/sdk_config.xml
<Package Folder>/shared_prefs/rg_sp_cache.xml
<Package Folder>/shared_prefs/sdk_config.xml.bak
<Package Folder>/databases/pushgdm.db-journal
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/lists/2.6.1/detail-wx.js
<Package Folder>/files/mobclick_agent_cached_<Package>368
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/tdata_ibT567.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/wx-step5.jpg
<Package Folder>/databases/pushg.db-journal
<Package Folder>/files/tdata_XEV804.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/static/rule.html
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/global/2.5.1/form.css
<Package Folder>/databases/ghost_web_view.db-journal
<Package Folder>/databases/wsUL1uCdKvjD
<Package Folder>/files/init.pid
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/lists/2.6.1/feedback.js
<Package Folder>/databases/wIU6pTyUBYWX-journal
<Package Folder>/files/run.pid
<Package Folder>/cache/image_manager_disk_cache/4f9869b8c6aadf5759bd4576b2902f5aa986f279af768b66e1d1b822c6205bb5.0
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/lists.html
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/pic_m.png
<Package Folder>/shared_prefs/policy.xml.bak
<Package Folder>/cache/image_manager_disk_cache/fdc6932425bf1cd1553606b7b5ba35f261b8f9ae3cd38f3a8a5cbea08e196780.0.tmp
<Package Folder>/cache/image_manager_disk_cache/153af7a27b40c221a6431d7f2efbea220ebc93a52b0d7ecd34628bdf787482c2.0.tmp
<Package Folder>/cache/image_manager_disk_cache/12494329d8ca451877ccf37ee345d01e36cde53bef148b0c774be1a1751cfafb.0.tmp
<Package Folder>/shared_prefs/SP_CACHE.xml
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/result.png
<Package Folder>/cache/image_manager_disk_cache/c87f0dfdb2d97de0c7c7740565532f2be72f63daae60454673ffddbd09d87c36.0.tmp
<Package Folder>/cache/image_manager_disk_cache/0a375cc050edac01d6c937cf22fbe3e835982161095b09ebcb17e9911012d7ca.0.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/global/2.5.1/md5.js
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/static/feedback.html
<Package Folder>/cache/image_manager_disk_cache/0f25ea2550492d4de45e592742dfa7c21003c45f464d17e7e1afa33398e88b9b.0.tmp
<Package Folder>/cache/image_manager_disk_cache/759aa7ff89a5efb79d4af5b861430a7c757cdcdf916969255fdbd96511ee11ae.0.tmp
<Package Folder>/cache/image_manager_disk_cache/1f92676eb6e91dfa1bdfadc58eb432139c1fea6c8dd68d99ec84949a182f6d67.0.tmp
<Package Folder>/cache/image_manager_disk_cache/356c93733b648fe93e13f4ec230d32d911e68ce56dbdce83db0241d5f5fc0240.0.tmp
<Package Folder>/shared_prefs/OFFERSCONFIG1.xml
<Package Folder>/shared_prefs/onlineconfig_agent_online_setting_<Package>.xml
<Package Folder>/files/sllak/core/finalcore.jar
<Package Folder>/files/flow/flow_pack.apk
<Package Folder>/shared_prefs/dcSharedPreferences.dat.xml
<Package Folder>/cache/image_manager_disk_cache/38e235ce88c38733ff1f0a652f1d3eb18cfa4887f074c66577f1fb3297b7c659.0.tmp
<Package Folder>/databases/6feab07fe3fa1fca4da91448c2740bf8
<Package Folder>/databases/campaign_db
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/wx-step4.jpg
<Package Folder>/databases/XKwVoK0huy3R
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml
<Package Folder>/files/qhcgfl
<Package Folder>/shared_prefs/startCount.xml
<Package Folder>/shared_prefs/gx_sp.xml
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481.zip
<Package Folder>/files/pid
<Package Folder>/shared_prefs/META_INFO.xml.bak
<Package Folder>/cache/image_manager_disk_cache/e11ae4295d3541599de72174ebd1160ef76d158793652a2c53f5f00e61c93edc.0.tmp
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/sprite-face.png
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/sprite-icons.png
<Package Folder>/files/gdaemon_20161017
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/sdetail.html
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/detail.html
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/wx-step3.jpg
<Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
<Package Folder>/cache/image_manager_disk_cache/59ec773ff9fa8e213f39f3bd380000254432aac41046a470c390022cc17940de.0.tmp
<Package Folder>/databases/OxgHkj2lz09F-journal
<Package Folder>/databases/P15pKIjsm64m
<Package Folder>/databases/jqIqJYOT3JpT-journal
<Package Folder>/databases/XKwVoK0huy3R-journal
<Package Folder>/databases/wIU6pTyUBYWX
<Package Folder>/cache/image_manager_disk_cache/journal.tmp
<Package Folder>/shared_prefs/rg_sp_cache.xml.bak
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/aos/share.html
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/wx-step2.jpg
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/wx-step1.jpg
<Package Folder>/app_yoqdqb/9EECDD0C7E90C078409FE2FFC4A0F09E.jar
<Package Folder>/cache/image_manager_disk_cache/d3a98e8cdd00dd2caaf4a4af1a5e074f252d5c40d3731aa08c34a89ceeee7113.0.tmp
<Package Folder>/cache/image_manager_disk_cache/22a570e2ee4aa2a6a6d4faf82bc5182eb9f2c0782d352ce8a60048c55b37df01.0.tmp
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/lists/2.6.1/lists.js
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/blank.gif
<Package Folder>/databases/698fd5baf0305c5b15319671ec70193d
<Package Folder>/databases/increment.db-journal
<Package Folder>/shared_prefs/DEVICE_UNIQ_FILE.xml
<Package Folder>/cache/image_manager_disk_cache/7398d5ac5ab59832282412d78c1a0b3152af4410734f092bfd53f8d7adbe68c5.0.tmp
<Package Folder>/databases/zitiguanjia.db-journal
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/agencyss
<Package Folder>/shared_prefs/umeng_feedback_user_info.xml
<Package Folder>/shared_prefs/post_info.xml
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481/offer/dist/aos/img/default.png
<Package Folder>/files/sllak/opt/2100/finalcore.jar
<Package Folder>/files/push.pid

Miscellaneous:

Executes next shell scripts:

getprop
chmod 700 /data/data/####/files/gdaemon_20161017
dd if=<Package Folder>/lib/libnativeservices.so of=<Package Folder>/agencyss
getprop ro.vivo.os.name
<su-internal:request>
<error:2>
/system/bin/cat /sys/devices/system/cpu/kernel_max
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/open.lib.supplies.daemon.ProtectService
<su-internal:result>
sh
/data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24658 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
su
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24658 300 0
ls -l /system/bin/su
<dexopt>

Uses elevated priveleges.

Contains functionality to send SMS messages automatically.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial