Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Click.136.origin
Downloads the following detected threats from the Web:
- Android.Click.136.origin
Network activity:
Connecting to:
- a####.####.com
- c####.####.com
- imgc####.####.com
- l####.####.cn
- l####.####.cn:88
- m####.####.com
- mo####.####.com
- p####.####.com
- p####.####.com:8066
- s####.####.com
HTTP GET requests:
- c####.####.com/s?z####
- imgc####.####.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- l####.####.cn/m/7vW52mta4PPv2SPsX1A8G-U73d0WMsNRVxPZJQ
- m####.####.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datat...
- mo####.####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####&...
- p####.####.com/c/1501141172354
HTTP POST requests:
- a####.####.com/app_logs
- l####.####.cn/i/ls/v1/1671936876953902751?t=####
- l####.####.cn:88/i/nu/v1/1671936876953902751?t=####
- p####.####.com:8066/s/
- s####.####.com/err
Modified file system:
Creates the following files:
- <Package Folder>/.lib/libexec.so
- <Package Folder>/.lib/libexecmain.so
- <Package Folder>/.wn/####/8820e77e-ed39-4010-9909-22878a9435b1.a
- <Package Folder>/.wn/####/apk_install_sc_db
- <Package Folder>/.wn/####/apk_install_sc_db-journal
- <Package Folder>/.wn/####/apk_install_tip.db
- <Package Folder>/.wn/####/apk_install_tip.db-journal
- <Package Folder>/.wn/####/app_stats.db
- <Package Folder>/.wn/####/app_stats.db-journal
- <Package Folder>/.wn/####/app_track.db
- <Package Folder>/.wn/####/app_track.db-journal
- <Package Folder>/.wn/####/common_cfg.prefs
- <Package Folder>/.wn/####/common_rundata.prefs
- <Package Folder>/.wn/####/download.db
- <Package Folder>/.wn/####/download.db-journal
- <Package Folder>/.wn/####/exception
- <Package Folder>/.wn/####/ext4-snail-5
- <Package Folder>/.wn/####/extra
- <Package Folder>/.wn/####/lconfig
- <Package Folder>/.wn/####/lconfig.bak
- <Package Folder>/.wn/####/libsnail_c2_e4_zip.so
- <Package Folder>/.wn/####/locconfig
- <Package Folder>/.wn/####/log_cfg.prefs
- <Package Folder>/.wn/####/log_index.db
- <Package Folder>/.wn/####/log_index.db-journal
- <Package Folder>/.wn/####/log_temp.db
- <Package Folder>/.wn/####/log_temp.db-journal
- <Package Folder>/.wn/####/main.prefs
- <Package Folder>/.wn/####/phone_dataer.prop
- <Package Folder>/.wn/####/run_status.prefs
- <Package Folder>/.wn/####/run_status_hb_request.gz
- <Package Folder>/.wn/####/run_status_hb_response.gz
- <Package Folder>/.wn/####/sconfig
- <Package Folder>/.wn/####/sconfig.bak
- <Package Folder>/.wn/####/server_req_hb_response.gz
- <Package Folder>/.wn/####/statistics.db
- <Package Folder>/.wn/####/statistics.db-journal
- <Package Folder>/.wn/####/win_ad.db
- <Package Folder>/.wn/####/win_ad.db-journal
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_plugin/update_lc
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/app_hyifue/C08F59C092D7108A3E6BDA86CEF1FA12.jar.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/GDTSDK.db
- <Package Folder>/databases/GDTSDK.db-journal
- <Package Folder>/databases/poem.db
- <Package Folder>/databases/poem.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.8820e77e-ed39-4010-9909-22878a9435b1.a.zip
- <Package Folder>/files/####/.c2.e4.zip
- <Package Folder>/files/####/8820e77e-ed39-4010-9909-22878a9435b1.a
- <Package Folder>/files/####/8820e77e-ed39-4010-9909-22878a9435b1.a.de
- <Package Folder>/files/.imprint
- <Package Folder>/files/R4vx1Qlp6xQ=
- <Package Folder>/files/__pasys_remote_banner.jar.beforesign
- <Package Folder>/files/__pasys_remote_banner.tmp.jar
- <Package Folder>/files/qdcycz
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/loader_wn.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
- <SD-Card>/.system/####/phone_dataer.prop
- <SD-Card>/.ups/####/extra
- <SD-Card>/.ups/####/st-journal
- <SD-Card>/Android/####/ApplicationCache.db-journal
- <SD-Card>/Android/####/ApplicationCache.db-journal (deleted)
- <SD-Card>/tencent/####/adv
- <SD-Card>/tencent/####/config
- <SD-Card>/tencent/####/deviceId
- <SD-Card>/tencent/####/master
- <SD-Card>/tencent/####/master.lock
- <SD-Card>/tencent/####/sys_install
Miscellaneous:
Executes next shell scripts:
- /data/data/com.android.gsc/.wn/files/ext4-snail-5
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- getprop ro.product.cpu.abi
- sh <Package Folder>/.wn/files/ext4-snail-5
Uses special library to hide executable bytecode.
