Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.343.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.343.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- 1####.####.184
- api####.####.com
- b####.com
- c####.####.cn
- h####.####.com
- j####.####.cn
- ope####.####.cn
- res####.####.com
- sh####.####.com
HTTP GET requests:
- b####.com/
- c####.####.cn/upload/201703/10/img/20170310154746318.png
- c####.####.cn/upload/201705/10/app/20170510142328422.apk
- ope####.####.cn/index/d/sid/3204933
- sh####.####.com/170512/e88785f54cc0751d82afb1389cafedfd/com.qcleaner_22....
HTTP POST requests:
- 1####.####.184/interface/negotiate
- api####.####.com/v3/log/init
- h####.####.com/utdid_pp_helper/get_aid/?auth[token]=####&type=####&id=##...
- j####.####.cn/data/count
- res####.####.com/v3/fastconnect?
Modified file system:
Creates the following files:
- /data/data/####/0a231bd8575dcf72.txt
- /data/data/####/930a31b34bd52c08.lock
- /data/data/####/Alvin2.xml
- /data/data/####/Alvin2.xml (deleted)
- /data/data/####/ContextData.xml
- /data/data/####/DIA1TNATSISSA0PP0MOC.bb
- /data/data/####/HasStarted
- /data/data/####/Q0VSVC5SU0EK.txt9e8
- /data/data/####/SGMANAGER_DATA2
- /data/data/####/TNATSISSA0PP0MOC.bb
- /data/data/####/app_setting_prefs.xml
- /data/data/####/clean_white_list.db
- /data/data/####/com.ali.money.shield.sdk.jar
- /data/data/####/com.pp.plugin.qiandun.jar
- /data/data/####/com.uc.webview.export.jar
- /data/data/####/config_1.xml
- /data/data/####/config_1.xml (deleted)
- /data/data/####/config_1.xml.bak
- /data/data/####/db_downloader-journal
- /data/data/####/libsgmainso-5.3.38.so.tmp
- /data/data/####/lock
- /data/data/####/lock.lock
- /data/data/####/mf1
- /data/data/####/pkgcache_basic.db
- /data/data/####/revision.list
- /data/data/####/revision.list.lock
- /data/data/####/share_data.xml
- /data/data/####/sp.lock
- /data/data/####/tm1
- /data/data/####/tm2
- /data/data/####/unique
- <Package Folder>/.lib/libexec.so
- <Package Folder>/.lib/libexecmain.so
- <Package Folder>/cache/####/19623238021232733928
- <Package Folder>/cache/####/702495827283569880
- <Package Folder>/cache/####/8945847571088183610
- <Package Folder>/cache/####/8945847571479238573
- <Package Folder>/databases/COMCRIKETAPPTRAINTILESGLESP-journal
- <Package Folder>/databases/downmodel.db
- <Package Folder>/databases/downmodel.db-journal
- <Package Folder>/databases/dxt_yx_sdk-journal
- <Package Folder>/databases/gmodel.db
- <Package Folder>/databases/gmodel.db-journal
- <Package Folder>/databases/grzqordg.ge-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/__pasys_remote_banner.tmp.jar
- <Package Folder>/shared_prefs/.xml
- <Package Folder>/shared_prefs/INITSP.xml
- <Package Folder>/shared_prefs/hengshu.xml
- <Package Folder>/shared_prefs/keySP.xml
- <Package Folder>/shared_prefs/zping.xml
- <Package Folder>/zbaidu.t
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml.bak (deleted)
- <SD-Card>/.com.taobao.dp/dd7893586a493dc3
- <SD-Card>/.system/gifnoc.ini
- <SD-Card>/Android/####/closeMatter
- <SD-Card>/Android/####/lmark
- <SD-Card>/Android/####/loadimg
- <SD-Card>/Android/####/notiicon
- <SD-Card>/Android/####/remote_
- <SD-Card>/Android/####/rmark
- <SD-Card>/Android/####/t<Package>
- <SD-Card>/Android/####/tb_jiance
- <SD-Card>/Android/####/tb_zy
- <SD-Card>/Android/####/transparent
- <SD-Card>/Android/####/zbaidu
- <SD-Card>/Android/####/zpkit
- <SD-Card>/Android/####/zpkit.jar
- <SD-Card>/CacheDir/####/cache_-1551210951
- <SD-Card>/CacheDir/####/cache_-1710512418
- <SD-Card>/CacheDir/####/cache_1761214784
- <SD-Card>/CacheDir/####/cache_2072684344
- <SD-Card>/Download/com.pp.assistant.apk
- <SD-Card>/Download/com.qihoo.appstore.apk
- <SD-Card>/Download/com.tencent.reading.apk
- <SD-Card>/Download/com.tuan800.tao800.apk
- <SD-Card>/Download/ooa001.jar
- <SD-Card>/system.ini
- <SD-Card>/uspxraskeeevihyccybhgyhyn.jar
Miscellaneous:
Executes next shell scripts:
- /data/data/com.criketapp.traintilesgles/zbaidu -p com.criketapp.traintilesgles -r am start --user 0 -n com.criketapp.traintilesgles/cqzd.csq.jei.degr -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2098
- /data/data/com.pp.assistant/amodel/a com.android.browser/com.android.browser.BrowserActivity 0 /data/data/com.pp.assistant/amodel /data/data/com.pp.assistant http://sjzs-api.25pp.com/api/uninstall?content=aW1laT0zNTY1MDcwNTkzNTE4OTVgbW9kZWw9R1QtSTgxOTBgdWlkPWQwODBkM2EzN2IwYmU3YmM3YzE1YzBhNWFjNzZiYzY0YHV1aWQ9ZGVmYXVsdGByb209MThgdmVyPTUuNS4wX2YzYGNoPVBNXzM4ODVgYWN0aW9uPXVuaW5zdGFsbGBwcm9kdWN0aWQ9MjAwMWByZXNvbHV0aW9uPTYwMCo3NTJgaW5zdGFsbHRpbWU9MjAxNy0wNS0zMSAwNjo0MTo1MQ== null
- /data/data/com.pp.assistant/files/DaemonServer -s /data/data/com.pp.assistant/lib/ -n runServer -p startservice -n com.pp.assistant/com.taobao.accs.ChannelService --user 0 -f /data/data/com.pp.assistant -t 600 -c agoo.pid -P /data/data/com.pp.assistant -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D %7B%22package%22%3A%22com.pp.assistant%22%2C%22appKey%22%3A%2221813641%22%2C%22utdid%22%3A%22WS5lxPlvFIMDAGdzx1F7%2BSFc%22%2C%22sdkVersion%22%3A%22212%22%7D -I agoodm.m.taobao.com -O 80 -T -Z
- /data/data/com.pp.assistant/files/dc374f27dd9f7231
- /data/user/0/com.pp.assistant/files/dc374f27dd9f7231
- <dexopt>
- cat /proc/version
- chmod 500 /data/data/com.pp.assistant/files/DaemonServer
- chmod 604 /storage/emulated/0/Android/data/<Package>
- chmod 604 /storage/emulated/0/Android/data/com.criketapp.traintilesgles
- chmod 705 /data/data/com.criketapp.traintilesgles/files
- chmod 705 <Package Folder>/files
- chmod 775 /data/data/com.pp.assistant/amodel/a
- chmod 777 /data/data/com.criketapp.traintilesgles/zbaidu
- chmod 777 /data/data/com.pp.assistant/files/dc374f27dd9f7231
- chmod 777 /data/user/0/com.pp.assistant/files/dc374f27dd9f7231
- chmod 777 <Package Folder>/zbaidu
- getprop ro.product.cpu.abi
- ps
- sh
- sh /data/data/com.pp.assistant/amodel/a com.android.browser/com.android.browser.BrowserActivity 0 /data/data/com.pp.assistant/amodel /data/data/com.pp.assistant http://sjzs-api.25pp.com/api/uninstall?content=aW1laT0zNTY1MDcwNTkzNTE4OTVgbW9kZWw9R1QtSTgxOTBgdWlkPWQwODBkM2EzN2IwYmU3YmM3YzE1YzBhNWFjNzZiYzY0YHV1aWQ9ZGVmYXVsdGByb209MThgdmVyPTUuNS4wX2YzYGNoPVBNXzM4ODVgYWN0aW9uPXVuaW5zdGFsbGBwcm9kdWN0aWQ9MjAwMWByZXNvbHV0aW9uPTYwMCo3NTJgaW5zdGFsbHRpbWU9MjAxNy0wNS0zMSAwNjo0MTo1MQ== null
- sh <Package Folder>/zbaidu -p <Package> -r am start --user 0 -n <Package>/cqzd.csq.jei.degr -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2098
Uses special library to hide executable bytecode.