Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.433.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.433.origin
Network activity:
Connecting to:
- i####.####.cn
- w####.####.com:9003
- c####.####.com
- y####.com
- n####.####.com
- n####.####.com:8066
HTTP GET requests:
- i####.####.cn/iplookup/iplookup.php?format=####
- c####.####.com/s?z####
- c####.####.com/m/AC568CDF52764B53AEF1498003A3C53C70
- c####.####.com/m/AC046D1A6FB640A4B62BB6CF9E6F6F7B6C
- n####.####.com/c/1485419085826
HTTP POST requests:
- n####.####.com/p/1485419086135
- n####.####.com/m/
- y####.com/cu.ashx
- w####.####.com:9003/api/getCfg.jsp
- n####.####.com:8066/s/
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/localtime.xml.bak
- /data/data/####/shared_prefs/gitConfig.xml
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/wsroot.sh
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/Matrix
- /data/data/####/files/80.tmp
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/tencent/bring/.res/2823AE826CA3BC2D57CE4E41A6601F54.tmp
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/tencent/bring/deviceId
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/toolbox
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/install-recovery.sh
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/supolicy
- /sdcard/tencent/bring/sys_install
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/debuggerd
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/ddexe
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/fileWork
- /data/data/####/shared_prefs/localtime.xml
- /sdcard/tencent/bring/config
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/550B92E0CC47FEA399E72E29040C4752
- /data/data/####/shared_prefs/device.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/pidof
- /sdcard/tencent/bring/.res/550B92E0CC47FEA399E72E29040C4752.tmp
- /data/data/####/databases/favorite.db-journal
- /data/data/####/files/eiulig
- /sdcard/tencent/bring/.res/rt_pkg
- /sdcard/device
- /sdcard/tencent/bring/master.lock
- /data/data/####/app_vatwvl/6BF4197C4C2660C6880031210C126F0D.jar.tmp
- /sdcard/tencent/bring/adv
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/su
- /sdcard/tencent/bring/master
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/2823AE826CA3BC2D57CE4E41A6601F54
- /data/data/####/cache/webviewCacheChromium/index
Sets the 'executable' attribute to the following files:
- /data/data/####/app_AB197D08407ABE58681467B313839AB1/Matrix
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.