Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- mon####.####.com
HTTP POST requests:
- mon####.####.com/analytics/upload
Modified file system:
Creates the following files:
- <Package Folder>/files/cl.conf
- <Package Folder>/shared_prefs/DENGTA_META.xml
- <Package Folder>/applib/libhxy.so
- <Package Folder>/files/file
- <Package Folder>/databases/NewKPInfo.db
- <Package Folder>/files/tsset.dat
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/applib/ktools
- <Package Folder>/shared_prefs/switchStats.xml
- <Package Folder>/shared_prefs/switchStats.xml.bak
- <Package Folder>/shared_prefs/ImmediaDataStats.xml
- <Package Folder>/applib/kmPlugins.apk
- <Package Folder>/applib/su
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/applib/otasurvival.sh
- <Package Folder>/app_app_apk/kinguser.dat.jar
- <Package Folder>/files/kulibs.conf
- <Package Folder>/files/e_config
- <Package Folder>/files/40246.xdat
- <Package Folder>/databases/eup_db
- <Package Folder>/shared_prefs/actionStats.xml
- <Package Folder>/shared_prefs/RootManagerSetting.xml
- <Package Folder>/code_cache/secondary-dexes/tmp-<Package>-1.apk.classes-21542112.zip
- <Package Folder>/files/40251.dat
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/NewKPInfo.db-journal
- <Package Folder>/code_cache/secondary-dexes/MultiDex.lock
- <Package Folder>/databases/eup_db-journal
- <Package Folder>/shared_prefs/ImmediaDataStats.xml.bak
- <Package Folder>/applib/kd
- <Package Folder>/applib/libNativeRQD.so
- <Package Folder>/app_kpex/kp_plugin_kingroot.p
- <Package Folder>/databases/permissions.sqlite-journal
Miscellaneous:
Executes next shell scripts:
- chcon u:object_r:system_data_file:s0 /data/data-lib/<Package>
- chmod 0764 <Package Folder>/applib/libNativeRQD.so
- id
- chmod 0764 <Package Folder>/applib/kmPlugins.apk
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- mkdir /data/data-lib
- chmod 0755 /data/data-lib/<Package>/ktools
- chmod 0755 /data/data-lib
- service list
- sh <Package Folder>/applib/kd
- su -v
- chcon u:object_r:system_data_file:s0 /data/data-lib
- dumpsys iphonesubinfo
- chmod 0764 <Package Folder>/applib/su
- chown 0.0 /data/data-lib/<Package>/ktools
- chmod 0771 <Package Folder>/applib
- chmod 0755 /data/data-lib/<Package>
- chmod 0755 /data/system/tmp_init.rc
- chmod 0755 <Package Folder>/applib/kd
- /data/data/####/applib/kd
- <su-internal:request>
- <su-internal:result>
- rm /data/data-lib/<Package>/ktools
- rm /data/system/tmp_init.rc
- chmod 0764 <Package Folder>/applib/ktools
- chown 0.0 /data/data-lib/<Package>
- chcon u:object_r:system_file:s0 /data/data-lib/<Package>/ktools
- <error:2>
- ku.sud
- su
- chmod 0764 <Package Folder>/applib/otasurvival.sh
- chmod 0764 <Package Folder>/applib/libhxy.so
- sh
- chown 0.0 /data/data-lib
- <dexopt>
- mkdir /data/data-lib/<Package>
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.