Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.336.origin
- Android.SmsBot.612.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.technol####.co.uk:80
- TCP(HTTP/1.1) eed.ta####.com:80
- TCP(HTTP/1.1) ads.apio####.com:80
- TCP(HTTP/1.1) uxe.553####.com:80
- TCP(HTTP/1.1) a.yesa####.com:80
- TCP(HTTP/1.1) t####.lin####.com:80
- TCP(HTTP/1.1) tr4.t####.com:80
- TCP(HTTP/1.1) ip####.io:80
- TCP(HTTP/1.1) api.uyt####.com:80
- TCP(HTTP/1.1) xml.adse####.com:80
- TCP(HTTP/1.1) d####.smyk####.com:80
- TCP(HTTP/1.1) 0c1e####.cdn.uc####.####.cn:80
- TCP(HTTP/1.1) monet####.sm4####.com:80
- TCP(HTTP/1.1) api.gad####.com:80
- TCP(HTTP/1.1) g.i####.com:80
- TCP(HTTP/1.1) a####.adsbt####.com:80
- TCP(HTTP/1.1) p####.yr####.com:80
- TCP(HTTP/1.1) entio####.info:80
- TCP(HTTP/1.1) 9n####.top:80
- TCP(HTTP/1.1) t.e####.com:80
- TCP(HTTP/1.1) m.aedx####.com:80
- TCP(HTTP/1.1) pha####.info:80
- TCP(HTTP/1.1) xml.active####.com:80
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP(TLS/1.0) trac####.le####.com:443
DNS requests:
- 9n####.top
- a.yesa####.com
- ads.apio####.com
- api.gad####.com
- api.uyt####.com
- d####.smyk####.com
- eed.ta####.com
- entio####.info
- g.i####.com
- h####
- ip####.io
- li####.safessl####.com
- m.aedx####.com
- monet####.sm4####.com
- p####.yr####.com
- pha####.info
- t####.lin####.com
- t.e####.com
- tr4.t####.com
- trac####.le####.com
- uxe.553####.com
- www.ray####.com
- www.technol####.co.uk
- xml.active####.com
- xml.adse####.com
HTTP GET requests:
- a####.adsbt####.com/c/245d96912e3e4930
- ads.apio####.com/pull/top_offer?gaid=####&id=####
- monet####.sm4####.com/?utm_medium=####&utm_campaign=####&cid=####
- monet####.sm4####.com/?utm_term=####&clickverify=####&utm_content=####
- monet####.sm4####.com/proc.php?324d7b4####
- t####.lin####.com/click?cid=####&s1=####&s2=####
- t####.lin####.com/reclick?tid=####&type=####&res=####
- tr4.t####.com/newServing/tracking_id.php?gtruid=1&r=http://a.yesadsrv.co...
- xml.active####.com/click?i=####
- xml.adse####.com/redirect?feed=####&auth=####&subid=####
HTTP POST requests:
- api.gad####.com/oversea_adjust_and_download_write_redis/notify/download/...
- g.i####.com/pilot/api/300102
- m.aedx####.com/errorview/api/601
- m.aedx####.com/smartview/api/920
- t.e####.com/ggview/rsddateindex
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.catr.apk
- <Package Folder>/files/####/.center.tapk
- <Package Folder>/files/####/.client
- <Package Folder>/files/####/.dg
- <Package Folder>/files/####/.dico.apk
- <Package Folder>/files/####/.dlme.apk
- <Package Folder>/files/####/.dlsb.apk
- <Package Folder>/files/####/.dsmt.apk
- <Package Folder>/files/####/.ir
- <Package Folder>/files/####/.service
- <Package Folder>/files/####/.ukd
- <Package Folder>/files/####/.uks
- <Package Folder>/files/####/.uok
- <Package Folder>/files/####/5f79d63143102423ac148986c2ae37a0.da...leted)
- <Package Folder>/files/####/5f79d63143102423ac148986c2ae37a0.data.temp
- <Package Folder>/files/####/a.xml
- <Package Folder>/files/####/b.png
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/checkFile0
- <Package Folder>/files/####/checkFile13
- <Package Folder>/files/####/mkdevsh
- <Package Folder>/files/####/myshell
- <Package Folder>/files/####/postroot.sh
- <Package Folder>/files/####/r1
- <Package Folder>/files/####/r2
- <Package Folder>/files/####/r3
- <Package Folder>/files/####/r4
- <Package Folder>/files/####/rsh
- <Package Folder>/files/####/rt8
- <Package Folder>/files/####/supolicy
- <Package Folder>/files/5f79d63143102423ac148986c2ae37a0.data
- <Package Folder>/files/sdk.dex
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml (deleted)
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/share_data.xml
- <SD-Card>/.windy/508e8558f784e3a21d3368e4763e2693.tmp
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh ./mkdevsh
- <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
- app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm disable com.master.main.yaogirl.longe.wei
- app_process /system/bin com.android.commands.pm.Pm disable com.qiu.qing.bing.shuo.tu
- app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm disable com.slave.wuw.yiyi.ranran.fang
- app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm enable com.master.main.yaogirl.longe.wei
- app_process /system/bin com.android.commands.pm.Pm enable com.qiu.qing.bing.shuo.tu
- app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm enable com.slave.wuw.yiyi.ranran.fang
- chmod 777 <Package Folder>/files/.snow/.catr.apk
- chmod 777 <Package Folder>/files/.snow/.dg
- chmod 777 <Package Folder>/files/.snow/.service
- chmod 777 <Package Folder>/files/.snow/.ukd
- chmod 777 <Package Folder>/files/.snow/.uks
- chmod 777 <Package Folder>/files/.snow/.uok
- chmod 777 <Package Folder>/files/.snow/.zip/
- chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
- chmod 777 <Package Folder>/files/.snow/.zip/r1
- chmod 777 <Package Folder>/files/.snow/.zip/r2
- chmod 777 <Package Folder>/files/.snow/.zip/r3
- chmod 777 <Package Folder>/files/.snow/.zip/r4
- chmod 777 <Package Folder>/files/.snow/.zip/rsh
- chmod 777 <Package Folder>/files/.snow/.zip/rt8
- chmod 777 <Package Folder>/files/.snow/a.xml
- chmod 777 <Package Folder>/files/.snow/b.png
- chmod 777 <Package Folder>/files/.snow/busybox
- chmod 777 <Package Folder>/files/.snow/myshell
- chmod 777 <Package Folder>/files/.snow/supolicy
- chmod 777 <Package Folder>/files/.work/postroot.sh
- chown 0.0 /system/bin/.author
- chown 0.0 /system/xbin/.ci.pm
- chown 0:0 /system/app/Dingps.apk
- chown 0:0 /system/app/oneshs.apk
- chown 0:0 /system/bin/.author
- chown 0:0 /system/xbin/.ci.pm
- df /system
- mount -o remount ro /system
- mount -o remount rw /system
- mount -o remount,ro /system
- mount -ro remount ro /system
- mount -wo remount rw /system
- mount -wo remount,rw /system
- sh
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.