Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.102.origin
- Android.Loki.15.origin
- Android.Backdoor.336.origin
- Android.MulDrop.84.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.336.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- adr####.com
- buzzade####.com
- technol####.net
- pixp####.com
- mycampt####.com
- c####.####.media
- t####.####.online
- w####.####.com
- pu####.com
- trackme####.com
- prizeme####.men
- ping-####.####.com
- pha####.info
- u####.####.com
- theway####.club
- 9699-26####.####.net
- p####.####.com
- ip####.io
- f####.####.com
- x####.####.com
- m####.####.com
- statist####.com
- pop####.net
- spxt####.com
- tango####.com
- a####.####.net
- z####.com
- f####.com
- c####.####.info
- r####.####.com
- h####.com
- a####.####.com
- nanoade####.com
- t####.####.com
- 5####.####.209
- g####.####.com
- c####.com
- c4track####.com
- traktra####.com
- adplexm####.####.com
- c####.####.com
- d####.####.com
- e####.####.com
- 3####.####.gdn
HTTP GET requests:
- x####.####.com/click?i=####
- g####.####.com/afu.php?zoneid=####
- t####.####.com/zp-redirect?target=####&caid=####&zpid=####&cid=####&rt=#...
- pha####.info/redirect?tid=####&ref=####&subid=####&q=####
- c4track####.com/aff/ep.php?act=####&prog=####&site=####&skin=####&t=####...
- c####.com/m/nl/straight/offer10/?act=####&utm_source=####&utm_medium=###...
- pu####.com/www/delivery/directads.php?zoneid=####&sub_zoneid=####&sub_oc...
- adplexm####.####.com/ul_cb/imp?p=####&ct=####&ap=####&psid=####&referrer...
- adr####.com/?placement=####&redi####&cookie=####&domain=####
- c####.####.info/12213?subaffiliate_id=####&session_id=####
- traktra####.com/?a_aid=####&page=####&clickid=####&pubid=####
- r####.####.com/t/clk?id=####&s2=####&s3=####&s4=####&_uu=####
- a####.####.com/pull/top_offer?gaid=####&id=####
- c####.####.com/tag/implement-r.js?org=H781SiHNjvymQBd3c257&p=1&a=400728&...
- a####.####.com/c/1e1f1a6121f2d5af
- ping-####.####.com/bidder/cpv_click.php?bid=####&a_id=####&uip=bB0####&u...
- spxt####.com/d/5186560ac86a19195?source=####&sub3=####&sub=####&do=####&...
- ip####.io/json
- d####.####.com/thinking/group/rtt_0525_666.apk
- 5####.####.209/pixel.js?d=####
- prizeme####.men/?brand=####&model=####&browser=####&td=####&voluumdata=#...
- e####.####.com/thinking/group/exp
- buzzade####.com/a/display.php?r=####
- 3####.####.gdn/?v=####&KW=####&s1=####
- z####.com/zp-redirect?target=####&caid=####&zpid=####&cid=####&rt=####
- nanoade####.com/a/display.php?stamat=####
- u####.####.com/zcvisitor/00100a9e-4770-11e7-8a19-0a2be071469e?campaignid...
- f####.####.com/?utm_medium=####&utm_campaign=####&cid=####
- t####.####.online/proc.php?5322e89####
- tango####.com/402150?adTagId=####
- a####.####.net/red?id=rz9h####
- trackme####.com/r/00d74d62-4770-11e7-b145-114222ea1614/0/
- u####.####.com/zcvisitor/d8c599ac-476f-11e7-988e-12673d5246b6?campaignid...
- theway####.club/afa98b0a-a104-416c-9f1d-ce11ef427508/index.html?tracker=...
- pixp####.com/?id=####&to=####&ta=####
- c####.####.media/adplexmedia/tags/xdirect/xdirect.html?p=####&serverdoma...
- c####.####.com/redirect?target=####&ts=####&hash=####&rm=####
- mycampt####.com/path/lp.php?trvid=####&trvx=####&extid=####&zoneid=####&...
- t####.####.com/ck.php?line_item_id=####&subid_spx=####&rcid=####
- technol####.net/science-tech/gadgets/mixed-reality-future-technology/?su...
- h####.com/?id=####&clickid=####
- a####.####.com/?utm_term=####&clickverify=####&utm_content=####
- u####.####.com/zcvisitor/dd7bcebb-476f-11e7-aa95-0a0e49ee7968?campaignid...
- w####.####.com/afu.php?zoneid=####
- 9699-26####.####.net/red?id=####&alias=####&1=####
- d####.####.com/afu.php?zoneid=####&var=####&1####
- statist####.com/adv_pxl?pid=####&id=####
- pop####.net/world/sgo/61946/337708/bc2c5b95ca94d106
HTTP POST requests:
- m####.####.com/smartview/api/920
- t####.####.com/ggview/rsddateindex
- g####.####.com/pilot/api/300102
- p####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- a####.####.com/app_logs
- f####.com/pixel?s=####
Droppers:
Downloaded by the following detected threats from the Web:
- Android.Packed.10336
Modified file system:
Creates the following files:
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/files/.snow/.ir
- <Package Folder>/files/.snow/.dsmt.apk
- <Package Folder>/files/IQPFsmOUChmkwhbDdynamicloader.jar
- <Package Folder>/files/exid.dat
- <Package Folder>/files/.imprint
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/files/.snow/busybox
- <Package Folder>/files/.snow/exp
- <Package Folder>/files/.snow/.dico.apk
- <Package Folder>/files/hello/hello.dex
- <Package Folder>/files/.snow/.zip/mkdevsh
- <Package Folder>/files/.snow/.client
- <Package Folder>/files/.snow/.catr.apk
- <Package Folder>/files/.snow/.uks
- <Package Folder>/files/.snow/.dg
- <Package Folder>/files/.snow/checkFile13
- <Package Folder>/files/dbcbd7361f0fdf0d3db91bd4710f63ca.data
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/files/.snow/checkFile0
- <Package Folder>/files/source.apk
- <Package Folder>/files/.snow/.ukd
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/.snow/.dlsb.apk
- <Package Folder>/files/.snow/.uok
- <Package Folder>/files/wrhlrci/libRppEcpLJpRVcTveVlala.so
- <Package Folder>/files/wrhlrci/libIQPFsmOUChmkwhbDdynamicloader.so
- <Package Folder>/files/hello.apk
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/.snow/myshell
- <Package Folder>/files/.work/postroot.sh
- <Package Folder>/files/.default/dbcbd7361f0fdf0d3db91bd4710f63ca.data.temp
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/files/wrhlrci/libhMEnYimzyYJbxvhuzxc.so
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/.snow/.service
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/databases/ua.db
- <Package Folder>/files/.snow/.dlme.apk
- <Package Folder>/files/.snow/.zip/rsh
- <Package Folder>/files/.snow/a.xml
- <Package Folder>/files/wrhlrci/libKueWuLGqMMnRgVVgbt.so
- <Package Folder>/files/.default/.p.apk
- <Package Folder>/files/.snow/supolicy
- <Package Folder>/files/.snow/b.png
- <Package Folder>/files/.snow/.zip/r1
- <Package Folder>/files/.snow/.zip/r4
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/.snow/.zip/r3
- <Package Folder>/files/.snow/.zip/r2
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/libswbqgonYxEgdlSXzbootstrap.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/.snow/.center.tapk
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/.snow/.zip/rt8
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- chmod 777 <Package Folder>/files/.snow/supolicy
- chown 0:0 /system/bin/debuggerd
- chmod 777 <Package Folder>/files/.snow/.zip/rsh
- chown 0.0 /system/bin/.author
- chown 0:0 /system/app/Lowerp.apk
- chown 0:0 /system/app/Linkcai.apk
- chmod 777 <Package Folder>/files/.snow/.zip/
- app_process /system/bin com.android.commands.pm.Pm disable com.kai.kia.dou.ye.cai
- mount -o remount ro /system
- app_process /system/bin com.android.commands.pm.Pm disable com.wo.ai.girl.huy.wp
- chmod 777 <Package Folder>/files/.snow/b.png
- chown 0:0 /system/xbin/.cp
- chcon u:object_r:system_file:s0 /system/lib/libsoon.so
- app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
- chown 0:0 /system/app/LocalFacebook.apk
- app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm disable com.num.hum.kong.ui.op.er
- mount -ro remount ro /system
- chmod 777 <Package Folder>/files/.snow/a.xml
- /data/data/####/files/.snow/exp /data/data/####/files/.snow /data/data/####/files/.work
- chown 0:0 /data/local/tmp/busybox
- chown 0:0 /system/lib/libsoon.so
- mount -wo remount rw /system
- chmod 777 <Package Folder>/files/.snow/.ukd
- chmod 777 <Package Folder>/files/.snow/.uok
- chmod 777 <Package Folder>/files/.snow/.dg
- sh
- sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
- app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
- chown 0:0 /system/xbin/.ci.pm
- chmod 777 <Package Folder>/files/.snow/.uks
- chown 0:0 /data/local/tmp/.catr.apk
- chmod 777 <Package Folder>/files/.snow/.zip/rt8
- chown 0:0 /system/app/oneshs.apk
- chmod 777 <Package Folder>/files/.snow/exp
- chown 0:0 /system/xbin/supolicy
- app_process /system/bin com.android.commands.pm.Pm enable com.num.hum.kong.ui.op.er
- chmod 777 <Package Folder>/files/.snow/.service
- chmod 777 <Package Folder>/files/.work/postroot.sh
- chmod 777 <Package Folder>/files/.snow/.zip/r1
- chmod 777 <Package Folder>/files/.snow/.zip/r3
- chmod 777 <Package Folder>/files/.snow/.zip/r2
- chmod 777 <Package Folder>/files/.snow/.client
- chmod 777 <Package Folder>/files/.snow/.zip/r4
- mount -o remount rw /system
- chmod 777 <Package Folder>/files/.snow/busybox
- chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
- mount -wo remount,rw /system
- mount -o remount,ro /system
- chmod 777 <Package Folder>/files/.snow/myshell
- df /system
- chown 0:0 /system/app/RomterFacebook.apk
- app_process /system/bin com.android.commands.pm.Pm enable com.wo.ai.girl.huy.wp
- chown 0:0 /system/app/Dingps.apk
- chown 0:0 /system/xbin/.rainin
- app_process /system/bin com.android.commands.pm.Pm enable com.kai.kia.dou.ye.cai
- chown 0.0 /system/lib/libsoon.so
- mount -ro remount,ro /system
- app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
- chown 0:0 /system/bin/.author
- chmod 777 <Package Folder>/files/.snow/.catr.apk
- chown 0.0 /system/app/Linkcai.apk
- <error:2>
- /system/bin/sh ./mkdevsh
- <dexopt>
Contains functionality to send SMS messages automatically.
