Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.155.origin
- Android.Triada.151.origin
Network activity:
Connecting to:
- s####.####.com
- i####.####.com
- w####.####.cn
- ut####.cn
- 1####.####.220:5537
- s####.####.com:36800
- i####.####.cn
- ut####.cn:8080
- 1####.####.136:8090
- a####.####.com
HTTP GET requests:
- a####.####.com/scheme/rpluIn/rpluIn_24.png
- a####.####.com/scheme/rpluIn/ajsbv_32.png
- a####.####.com/scheme/rpluIn/eql_27.png
- i####.####.com/ando-res/m/i0r*lg6v0h8-VWU1P*FQdeOi4Rt063q4kkFbwd7Db1IzyTD5msrpwg
HTTP POST requests:
- 1####.####.220:5537/main.aspx
- ut####.cn:8080/excalibur/avalon/sdk/pay.aspx
- 1####.####.136:8090/main.aspx
- a####.####.com/ando/x/liv?app_id=9d918ef9-f3ff-4380-ae9c-6606528ba596&r=134367114?r=####
- s####.####.com/feedbacksc.action
- a####.####.com/ando/x/liv?app_id=9d918ef9-f3ff-4380-ae9c-6606528ba596&r=155373417?r=####
- a####.####.com/ando/x/liv?app_id=9d918ef9-f3ff-4380-ae9c-6606528ba596&r=656247526?r=####
- i####.####.cn/iplookup/iplookup.php?format=####
- ut####.cn/excalibur/avalon/sdk/init.aspx
- w####.####.cn/ip.jsp
- s####.####.com:36800/configsc.action
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/files/.mylib/ajsbv.zip
- /data/data/####/files/.mylib/rf
- /sdcard/Android/system/etc/.daepkgs
- /data/data/####/app_dex/utopay.jar
- /sdcard/Android/system/etc/.RID
- /sdcard/Android/system/etc/.daeitfc
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_res_out/Jres.apk
- /data/data/####/files/_6TP4Z6QoCh16nidhEbkSeknJHQXkatw7ORXymYEXhQ=/NSCI8e4q2r-GZMNC0AZ5FQ==
- /sdcard/mmt/widegets/data/test.dat435f842e-883f-421b-a6ee-f3b085e1e13c.tmp
- /sdcard/sdtmp/id1cb7c0616-1557-4ce7-8db6-ebffba70899c.tmp
- /sdcard/Android/system/etc/.CHID
- /data/data/####/files/.e.download
- /data/data/####/files/_6TP4Z6QoCh16nidhEbkSeknJHQXkatw7ORXymYEXhQ=/1X-WTVoa8Q66MiKnlDRwKw==
- /sdcard/mmt/widegets/data/test.dat
- /sdcard/widgets/system/configs/tmn22.sys47370f29-dbdd-400e-950d-67e0f1926735.tmp
- /data/data/####/files/.mylib/qweus
- /sdcard/sdtmp/id1e52e8c23-13d6-47fa-bc23-6e54f6dfcafa.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/_6TP4Z6QoCh16nidhEbkSeknJHQXkatw7ORXymYEXhQ=/SVwm6E5XghnrCj7fE9ShRQ==/data.dat.tmp
- /sdcard/.env/.uunique.new
- /sdcard/sdtmp/id278004d83-6f5f-4f02-b5fb-728eed183aaa.tmp
- /data/data/####/shared_prefs/pluginLib.xml
- /sdcard/tmpsd11012/test.dat75e1c8c3-4936-414f-9aa0-431aa465ba05.tmp
- /data/data/####/app_bload_lib/libhelper.so
- /data/data/####/files/skmnaa_d/skmnaa_f.zip
- /sdcard/tmpsd11012/test.dat2e65c64f-fd11-432c-a9eb-47c8ac5734a5.tmp
- /data/data/####/files/.mylib/ajsbv.apk
- /sdcard/widgets/system/configs/tmn22.sysbca17a05-8df1-4dfc-b529-74a13382f530.tmp
- /sdcard/.hand/lastacca4e86164-c5ef-4ea5-8e73-1af1baffb822.tmp
- /data/data/####/app_aload_odex/dload.inf
- /data/data/####/files/.imprint
- /data/data/####/files/umeng_it.cache
- /sdcard/mmt/widegets/data/test.data3f011d2-48a0-45c0-9de5-206b7544f605.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/sdtmp/id238564fb1-3955-4b15-9f2d-ce9283c7d18e.tmp
- /sdcard/sdtmp/id157ea102a-517b-46ed-aeca-173808922c47.tmp
- /sdcard/mmt/widegets/data/droidinfo-journal
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/pluginLib.xml.bak
- /data/data/####/shared_prefs/.r.jar
- /sdcard/widgets/system/configs/tmn22.syse5e24271-e51a-44f1-982a-945cccb87f4f.tmp
- /sdcard/widgets/system/configs/tmn22.syse4f787c2-f987-4e7f-9ed4-7cb01b63da73.tmp
- /sdcard/Android/system/etc/.imei
- /data/data/####/files/.ajsbv.download
- /data/data/####/files/.rpluin.download
- /sdcard/.uct/uuid323a8bb3d-be30-41d1-9921-6a09015984f8.tmp
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/files/_6TP4Z6QoCh16nidhEbkSeknJHQXkatw7ORXymYEXhQ=/bd4s185fBVjfX4En6CkkUg==/WHDwHHs5Ngnm8z6g.zip
- /sdcard/mmt/widegets/data/test.data963e44f-c3d9-411e-9ee1-44cb45cc1a6c.tmp
- /data/data/####/app_aload_odex/coad.apk
- /data/data/####/files/.mylib/ts
- /data/data/####/files/.mylib/rpluin.zip
- /data/data/####/files/_6TP4Z6QoCh16nidhEbkSeknJHQXkatw7ORXymYEXhQ=/MUQv3ffvQ2hc5RNN6I2tgg==/qJDHrZxeAp5-gBBJ
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/sdtmp/id20d155cf3-562a-446f-8f27-7dc3bd986cca.tmp
- /sdcard/sm_in.apk
- /sdcard/widgets/system/configs/tmn22.sysaffd8c4e-cf26-46f5-b069-13f1de1074a8.tmp
- /sdcard/Android/system/etc/.imsi
- /sdcard/.hand/developkey56e2deba-e7dd-45fb-bbbd-5633b6557be7.tmp
- /sdcard/mmt/widegets/data/droidinfo
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.mylib/ajsbv.apk
- /data/data/####/files/.mylib/ts
- /data/data/####/files/.mylib/qweus
Miscellaneous:
Executes next shell scripts:
- /system/bin/.nbwayxwzt
- su
- conbb od2gf04pd9
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.