Android.DownLoader.2828

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.433.origin
Android.Backdoor.433.origin

Downloads the following detected threats from the Web:

Android.Backdoor.433.origin
Android.Backdoor.433.origin

Network activity:

Connecting to:

1####.####.189
1####.####.189:9090
7j####.####.com
a####.####.com
a####.####.net
c####.####.com
c-h####.####.com
datacol####.####.com
g####.####.com
i####.####.com
o####.####.com
p####.####.com
r####.####.net
s####.####.com
s####.####.net
sdk-ope####.####.com
t####.####.com
t####.####.net
trac####.####.cn
u####.####.com
upa####.####.com

HTTP GET requests:

1####.####.189/ad2016/ad/getAdconfnew
1####.####.189:9090/ad2016/ad/getAdconfnew
7j####.####.com/tdata_pxK929
a####.####.com/v7/policy.php?d=####&t=####
a####.####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
a####.####.net/v3/zip_upd?s=####
c####.####.com/cdndata/similefont/similefont?ft_id=####&lang=####&channe...
c####.####.com/s?v####
c####.####.com/title.png
g####.####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&m=####&w...
i####.####.com/cimg.png?pic=####&size=####&aid=####&name=####&desc=####&...
p####.####.com/c/1496217046184
p####.####.com/t017ced5aec1f4d9949.jpg
p####.####.com/version/check?versionCode=####&channel=####
r####.####.net/spot/aos/v2/reqv3?s=####
s####.####.com/config/bj-bjv4.conf
s####.####.com/core/aos-dex/1608/6440/26b46b6e.jar
s####.####.net/aos/v3/initf?s=####
s####.####.net/stat/aos/v3/pkc?s=####
t####.####.com/guidthv600.php?uuid=####&platform=####&channel=####&kerne...
trac####.####.cn/s?type=####&r=####&tid=####&finfo=####&enup=####&mvid=#...
upa####.####.com/fontPreZip/ZJ2Qu4jR.zip

HTTP POST requests:

a####.####.com/app_logs
c-h####.####.com/api.php?format=####&t=####
datacol####.####.com/api.php?type=####&duid=####&version=####
o####.####.com/v2/get_update_time
sdk-ope####.####.com/api.php?format=####&t=####
t####.####.com/v7/dsp_stat.php
t####.####.net/v2/android/pkgtime?rt=####&sign=####
u####.####.com/frontend/web/index.php?r=####

Modified file system:

Creates the following files:

<Package Folder>/agencyss
<Package Folder>/app_cache/res.png
<Package Folder>/app_cache/res.zip
<Package Folder>/app_libs/ymdex.jar.new
<Package Folder>/app_wxdzvk/01DF92C16549557B207116B7DCEA179E.jar
<Package Folder>/cache/####/0a375cc050edac01d6c937cf22fbe3e835982161095b09ebcb17e9911012d7ca.0.tmp
<Package Folder>/cache/####/0f25ea2550492d4de45e592742dfa7c21003c45f464d17e7e1afa33398e88b9b.0.tmp
<Package Folder>/cache/####/12494329d8ca451877ccf37ee345d01e36cde53bef148b0c774be1a1751cfafb.0.tmp
<Package Folder>/cache/####/1f92676eb6e91dfa1bdfadc58eb432139c1fea6c8dd68d99ec84949a182f6d67.0.tmp
<Package Folder>/cache/####/22a570e2ee4aa2a6a6d4faf82bc5182eb9f2c0782d352ce8a60048c55b37df01.0.tmp
<Package Folder>/cache/####/356c93733b648fe93e13f4ec230d32d911e68ce56dbdce83db0241d5f5fc0240.0.tmp
<Package Folder>/cache/####/3795efd0b29e95c81e15acacaedf13356e890eb1201fdc67374ffd597459898d.0.tmp
<Package Folder>/cache/####/38e235ce88c38733ff1f0a652f1d3eb18cfa4887f074c66577f1fb3297b7c659.0.tmp
<Package Folder>/cache/####/44767c89c7fe19de79a5e421538f6669dfd37139f074722e0685ef088c6042ad.0.tmp
<Package Folder>/cache/####/4f9869b8c6aadf5759bd4576b2902f5aa986f279af768b66e1d1b822c6205bb5.0.tmp
<Package Folder>/cache/####/55324bd08aebed98c4f686ff3ddfb49163024d7d57bb47373550cb66b4b2b651.0.tmp
<Package Folder>/cache/####/59ec773ff9fa8e213f39f3bd380000254432aac41046a470c390022cc17940de.0.tmp
<Package Folder>/cache/####/7398d5ac5ab59832282412d78c1a0b3152af4410734f092bfd53f8d7adbe68c5.0.tmp
<Package Folder>/cache/####/759aa7ff89a5efb79d4af5b861430a7c757cdcdf916969255fdbd96511ee11ae.0.tmp
<Package Folder>/cache/####/88b086d505853d97689de6dee7554c6a4e0ab40bc205791548640e5f5d09e680.0.tmp
<Package Folder>/cache/####/a24c0f4be9bd34a15807b0a1a5ed9744664d42929fa684627ca63e5568db10bb.0.tmp
<Package Folder>/cache/####/aaea38e2faef743daa8fbe8c2f4bee6963e468c7c9913b1de7f86b36d14fe56f.0.tmp
<Package Folder>/cache/####/c87f0dfdb2d97de0c7c7740565532f2be72f63daae60454673ffddbd09d87c36.0.tmp
<Package Folder>/cache/####/d3a98e8cdd00dd2caaf4a4af1a5e074f252d5c40d3731aa08c34a89ceeee7113.0.tmp
<Package Folder>/cache/####/e11ae4295d3541599de72174ebd1160ef76d158793652a2c53f5f00e61c93edc.0.tmp
<Package Folder>/cache/####/e624bd813b377c9a190bd59ac5289d8bb5ec6b35326213c33887fb4d46bd7cbd.0.tmp
<Package Folder>/cache/####/fb29028c4560fe6d5cc121a6498d19166e5e9bcbde38a9795d31d075264510bc.0.tmp
<Package Folder>/cache/####/fdc6932425bf1cd1553606b7b5ba35f261b8f9ae3cd38f3a8a5cbea08e196780.0.tmp
<Package Folder>/cache/####/fdc82096cc22f381a26d9f2450d5b4800729cfffa9dfa142b02c5bb7a4cae197.0.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/code_cache/####/<Package>-1.apk.classes1075378647.zip
<Package Folder>/databases/698fd5baf0305c5b15319671ec70193d
<Package Folder>/databases/698fd5baf0305c5b15319671ec70193d-journal
<Package Folder>/databases/6feab07fe3fa1fca4da91448c2740bf8
<Package Folder>/databases/6feab07fe3fa1fca4da91448c2740bf8-journal
<Package Folder>/databases/OxgHkj2lz09F
<Package Folder>/databases/OxgHkj2lz09F-journal
<Package Folder>/databases/P15pKIjsm64m
<Package Folder>/databases/P15pKIjsm64m-journal
<Package Folder>/databases/T1oX0rhhuXWt
<Package Folder>/databases/T1oX0rhhuXWt-journal
<Package Folder>/databases/XKwVoK0huy3R
<Package Folder>/databases/XKwVoK0huy3R-journal
<Package Folder>/databases/ad_down_db-journal
<Package Folder>/databases/campaign_db
<Package Folder>/databases/campaign_db-journal
<Package Folder>/databases/download_db-journal
<Package Folder>/databases/f84a698c5549cafb3e31c272d9cb32d6-journal
<Package Folder>/databases/filedownloader.db-journal
<Package Folder>/databases/ghost_web_view.db-journal
<Package Folder>/databases/increment.db-journal
<Package Folder>/databases/jqIqJYOT3JpT
<Package Folder>/databases/jqIqJYOT3JpT-journal
<Package Folder>/databases/pushg.db-journal
<Package Folder>/databases/pushgdm.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/wIU6pTyUBYWX
<Package Folder>/databases/wIU6pTyUBYWX-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/wsUL1uCdKvjD
<Package Folder>/databases/wsUL1uCdKvjD-journal
<Package Folder>/databases/zitiguanjia.db-journal
<Package Folder>/files/####/arrow-left.png
<Package Folder>/files/####/arrow-right.png
<Package Folder>/files/####/blank.gif
<Package Folder>/files/####/close-icon.png
<Package Folder>/files/####/default.png
<Package Folder>/files/####/detail-wx.html
<Package Folder>/files/####/detail-wx.js
<Package Folder>/files/####/detail.html
<Package Folder>/files/####/detail.js
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/feedback.html
<Package Folder>/files/####/feedback.js
<Package Folder>/files/####/finalcore.jar
<Package Folder>/files/####/flow_pack.apk
<Package Folder>/files/####/form.css
<Package Folder>/files/####/global.js
<Package Folder>/files/####/lists.css
<Package Folder>/files/####/lists.html
<Package Folder>/files/####/lists.js
<Package Folder>/files/####/md5.js
<Package Folder>/files/####/pic_m.png
<Package Folder>/files/####/pic_tips_01.png
<Package Folder>/files/####/pic_tips_02.png
<Package Folder>/files/####/result.png
<Package Folder>/files/####/rule.html
<Package Folder>/files/####/sdetail.html
<Package Folder>/files/####/share.css
<Package Folder>/files/####/share.html
<Package Folder>/files/####/share.js
<Package Folder>/files/####/sprite-face.png
<Package Folder>/files/####/sprite-icons.png
<Package Folder>/files/####/sprite-icons2.png
<Package Folder>/files/####/wx-step1.jpg
<Package Folder>/files/####/wx-step2.jpg
<Package Folder>/files/####/wx-step3.jpg
<Package Folder>/files/####/wx-step4.jpg
<Package Folder>/files/####/wx-step5.jpg
<Package Folder>/files/.imprint
<Package Folder>/files/INSTALLATION
<Package Folder>/files/bpxenn
<Package Folder>/files/f16aa53997476bdf0bdd4596c918f481.zip
<Package Folder>/files/init.pid
<Package Folder>/files/mobclick_agent_cached_<Package>358
<Package Folder>/files/pid
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/tdata_NDe635.jar
<Package Folder>/files/tdata_NDe635.tmp
<Package Folder>/files/tdata_pxK929.jar
<Package Folder>/files/tdata_pxK929.tmp
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
<Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
<Package Folder>/shared_prefs/DEVICE_UNIQ_FILE.xml
<Package Folder>/shared_prefs/FontManager.xml
<Package Folder>/shared_prefs/FontManager.xml.bak
<Package Folder>/shared_prefs/META_INFO.xml
<Package Folder>/shared_prefs/META_INFO.xml.bak
<Package Folder>/shared_prefs/OFFERSCONFIG1.xml
<Package Folder>/shared_prefs/SP_CACHE.xml
<Package Folder>/shared_prefs/SP_CACHE.xml.bak
<Package Folder>/shared_prefs/advisers.xml
<Package Folder>/shared_prefs/dcSharedPreferences.dat.xml
<Package Folder>/shared_prefs/file_message.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/onlineconfig_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/policy.xml
<Package Folder>/shared_prefs/policy.xml.bak
<Package Folder>/shared_prefs/post_info.xml
<Package Folder>/shared_prefs/sdk_config.xml
<Package Folder>/shared_prefs/sdk_config.xml.bak
<Package Folder>/shared_prefs/spotData.xml
<Package Folder>/shared_prefs/startCount.xml
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml
<Package Folder>/shared_prefs/umeng_feedback_user_info.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
<SD-Card>/.sfp/.sfp
<SD-Card>/.testf (deleted)
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1496d616fb0b4875cdf07a560e700555.0.tmp
<SD-Card>/Android/####/1496d616fb0b4875cdf07a560e700555.1.tmp
<SD-Card>/Android/####/373240561418738c721572c1da14b85e
<SD-Card>/Android/####/373240561418738c721572c1da14b85e.ymtf
<SD-Card>/Android/####/8355c633babea8c70074871908e77950.0.tmp
<SD-Card>/Android/####/8355c633babea8c70074871908e77950.1.tmp
<SD-Card>/Android/####/87d483d9b65a54479091ad23ca2640c7.0.tmp
<SD-Card>/Android/####/87d483d9b65a54479091ad23ca2640c7.1.tmp
<SD-Card>/Android/####/9a2cf48a9b85d6a0e6d54c18fb49ee6c.0.tmp
<SD-Card>/Android/####/9a2cf48a9b85d6a0e6d54c18fb49ee6c.1.tmp
<SD-Card>/Android/####/9ce68a6b1ff4fac2ff74493c7358d083.0.tmp
<SD-Card>/Android/####/9ce68a6b1ff4fac2ff74493c7358d083.1.tmp
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF.ymtf
<SD-Card>/Android/####/a3257ef0e788c062d4037d2a1fecd9df.0.tmp
<SD-Card>/Android/####/a3257ef0e788c062d4037d2a1fecd9df.1.tmp
<SD-Card>/Android/####/adv
<SD-Card>/Android/####/c22fb4fa526fe99f9fb4b3852797fbb1
<SD-Card>/Android/####/config
<SD-Card>/Android/####/deviceId
<SD-Card>/Android/####/ee37078cacbc3560c4ba00b0b5b626f9.0.tmp
<SD-Card>/Android/####/ee37078cacbc3560c4ba00b0b5b626f9.1.tmp
<SD-Card>/Android/####/fcaf8612e2ed1295a90dceb7e66ebcbd.0.tmp
<SD-Card>/Android/####/fcaf8612e2ed1295a90dceb7e66ebcbd.1.tmp
<SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
<SD-Card>/Android/####/journal
<SD-Card>/Android/####/journal.tmp
<SD-Card>/Android/####/master
<SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
<SD-Card>/Android/####/sys_install
<SD-Card>/com.qisi.koala/####/1496217040649
<SD-Card>/com.qisi.koala/####/1496217042958
<SD-Card>/com.qisi.koala/meta_data.dat
<SD-Card>/font/####/011f469bc937a69b5a098fe84ba9f26c.dat
<SD-Card>/font/####/03f542e25314b22745132ede43a8da79.dat
<SD-Card>/font/####/0d5614e10390787fc6b3d5fbc32b2d63.dat
<SD-Card>/font/####/1496217066389.txt
<SD-Card>/font/####/1496217066694.txt
<SD-Card>/font/####/1758a39d79e8832d0ee12b9aff412979.dat
<SD-Card>/font/####/1972fef3059e205b55cf5260390571a7.dat
<SD-Card>/font/####/27b19f766ebcac1059be3670d50230c9.dat
<SD-Card>/font/####/30227b8a369dcf725bd3cfd61ebddfc8.dat
<SD-Card>/font/####/31e037e801ea190695634794fcfec1e6.dat
<SD-Card>/font/####/33c942298aa1907821d116a0b6db1a1b.dat
<SD-Card>/font/####/4dff46803355c479709f6dc591e74727.dat
<SD-Card>/font/####/55fe60699ba39164d8c3cbd0fd110ee1.dat
<SD-Card>/font/####/5eec735503618662cfe05df457766383.dat
<SD-Card>/font/####/7490058dbe0e370a2ef630b87c51829f.dat
<SD-Card>/font/####/80373562e889cbf5388bc1b6b93027e8.dat
<SD-Card>/font/####/9bfcacada8473be10e9a55533cd9000c.dat
<SD-Card>/font/####/DroidNaskh-Regular.ttf
<SD-Card>/font/####/DroidNaskhUI-Regular.ttf
<SD-Card>/font/####/DroidSans-Bold.ttf
<SD-Card>/font/####/DroidSans.ttf
<SD-Card>/font/####/DroidSansFallback.ttf
<SD-Card>/font/####/DroidSansMono.ttf
<SD-Card>/font/####/MTLmr3m.ttf
<SD-Card>/font/####/Roboto-BoldItalic.ttf
<SD-Card>/font/####/Roboto-Light.ttf
<SD-Card>/font/####/Roboto-Regular.ttf
<SD-Card>/font/####/RobotoCondensed-Regular.ttf
<SD-Card>/font/####/a2fa8d5caa4eb41961ea28e8fd253a23.dat
<SD-Card>/font/####/b2ebe844426152e142def68943b8176d.apk
<SD-Card>/font/####/b2ebe844426152e142def68943b8176d.apk.tmp
<SD-Card>/font/####/b5f697da934576a3949a3500aa0c7c7f.dat
<SD-Card>/font/####/be73f47bd404d560d51a97214983fcc9.dat
<SD-Card>/font/####/bee537f2952893ff512c8c19fb64d10c.dat
<SD-Card>/font/####/bf8fdc0505255721f03e7288539ee918.dat
<SD-Card>/font/####/db2031babf565dd9570a07338186698e.dat
<SD-Card>/font/####/db2706b655e18d79fe3cace09a4bde1c.dat
<SD-Card>/font/####/f2120d99157f500905955bb9ed253f5d.dat
<SD-Card>/font/.font_download_count_cache
<SD-Card>/font/2d42738260f780d3cc2ac1ffb06d882f-en.ttf
<SD-Card>/font/2d42738260f780d3cc2ac1ffb06d882f-zh.ttf
<SD-Card>/font/2d42738260f780d3cc2ac1ffb06d882f.apk
<SD-Card>/font/2d42738260f780d3cc2ac1ffb06d882f.apk.tmp
<SD-Card>/font/2d42738260f780d3cc2ac1ffb06d882f.meta
<SD-Card>/libs/<Package>.db
<SD-Card>/libs/app.db
<SD-Card>/libs/com.igexin.sdk.deviceId.db
<SD-Card>/slc_log.txt
<SD-Card>/system/####/tdata_NDe635
<SD-Card>/system/####/tdata_pxK929

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/kernel_max
<Package Folder>/agencyss <Package>/open.lib.supplies.daemon.ProtectService
<dexopt>
<su-internal:request>
<su-internal:result>
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/open.lib.supplies.daemon.ProtectService
cat /sys/class/net/wlan0/address
chmod 777 <Package Folder>/agencyss
dd if=<Package Folder>/lib/libnativeservices.so of=<Package Folder>/agencyss
getprop
getprop ro.vivo.os.name
ls -l /system/bin/su
sh
su

Uses elevated priveleges.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial