Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.285.origin
- Android.DownLoader.441.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Network activity:
Connecting to:
- d####.####.net:8080
- a####.####.org
- a####.####.org:8900
- d####.####.net
- up####.####.net:6020
- dow####.####.net
- m####.####.com
- up####.####.net
HTTP GET requests:
- d####.####.net/update/plugin_rt503.zip
- dow####.####.net/ads/auto/jar/1_0_0093/zhsysgdi.jar
- d####.####.net:8080/othersdk/0c82bc0f40714263bc5929189a12607e.jar
HTTP POST requests:
- a####.####.org/ad-mis-light/shellLogTest
- m####.####.com/hladserver/api/1
- up####.####.net:6020/
- a####.####.org:8900/ad-mis-light/getOtherSdkSwitchConfigNew
- a####.####.org/ad-mis-light/otherSdkLog
- up####.####.net/
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/hlcsdpf.xml
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /data/data/####/shared_prefs/hlcsdpf.xml.bak
- /data/data/####/shared_prefs/AdSdkMsg.xml
- /data/data/####/databases/DATA_DB-journal
- /sdcard/.android/102877739
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/.android/sign.info
- /data/data/####/shared_prefs/appStatus.xml
- /data/data/####/databases/vastpaydb
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/382ce07a-8755-45c9-9564-bd6e21a7bfa8.zip
- /data/data/####/databases/vastpaydb-journal
- /data/data/####/files/.android/zhsysgdi.jar
- /data/data/####/shared_prefs/config.xml
- /data/data/####/files/3210012930390123101097900157.jar
- /data/data/####/shared_prefs/isOpens.xml
- /data/data/####/shared_prefs/config.xml.bak
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 40 40 206196 /data/data/####/files/3210012930390123101097900157.jar 1251177957 -1919946824 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system
- /system/bin/dexopt --dex 27 40 40 206196 /data/data/####/files/321001293039012310193434581.jar 1251177957 -1919946824 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/
- ps
- /system/bin/dexopt --dex 27 52 40 426212 /data/data/####/files/.android/zhsysgdi.jar 1243975526 -1999926212 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/
- /system/bin/dexopt --dex 27 51 40 794872 /data/data/####/files/a136ce2ec98d2eec367c90d64b3dd0e5/9b49c29a-cede-45ea-9ce0-772b5ba539c1.zip 1251639725 1606275611 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycast
- /system/bin/dexopt --dex 27 46 40 643572 /data/data/####/cache/zhanghong_3.jar 1251241725 951174753 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framewor
Contains functionality to send SMS messages automatically.