Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Exploit.12
- Android.HiddenAds.182
- Android.Rooter.16.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.kv####.com:80
DNS requests:
- www.kv####.com
HTTP GET requests:
- www.kv####.com/krt.do?result=####&model=####&count=####&hdware=####&disp...
Modified file system:
Creates the following files:
- <Package Folder>/files/####/AndroidSystemPlug2.apk
- <Package Folder>/files/####/NgpMain_2.0.6_C002_201702281605.apk
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/chattr
- <Package Folder>/files/####/dg
- <Package Folder>/files/####/gfhadex.jar
- <Package Folder>/files/####/ir
- <Package Folder>/files/####/killall
- <Package Folder>/files/####/pet
- <Package Folder>/files/####/r.jar
- <Package Folder>/files/####/r.sh
- <Package Folder>/files/####/r0
- <Package Folder>/files/####/r1
- <Package Folder>/files/####/r2
- <Package Folder>/files/####/r3
- <Package Folder>/files/####/r4
- <Package Folder>/files/####/r5
- <Package Folder>/files/####/r6
- <Package Folder>/files/####/r8
- <Package Folder>/files/####/sprot
- <Package Folder>/files/####/su2
- <Package Folder>/files/####/supolicy
- <Package Folder>/files/####/zfile.zip
- <Package Folder>/files/a.zip
- <Package Folder>/files/schema
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/store.xml
Miscellaneous:
Executes next shell scripts:
- <Package Folder>/files/.z/r0 -c <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/r1 -C '<Package Folder>/files/.sh/r.sh'
- <Package Folder>/files/.z/r1 -auto
- <Package Folder>/files/.z/r1 <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/r2
- <Package Folder>/files/.z/r2 -c <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/r3
- <Package Folder>/files/.z/r3 -c <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/r4 -c <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/r4 PFMMehxvMFk2VSFN8Aw8XGXh91UNiESr/iPn2mHZOg== 3u5ydeZkuIN7B1MIi0sjkwufUjbm /system/bin/sh
- <Package Folder>/files/.z/r5 /system/bin/sh
- <Package Folder>/files/.z/r6 /system/bin/sh
- <Package Folder>/files/.z/r8
- <Package Folder>/files/.z/su2 HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/su2 al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh <Package Folder>/files/.sh/r.sh
- <Package Folder>/files/.z/su2 f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh <Package Folder>/files/.sh/r.sh
- chmod 755 <Package Folder>/files/.data/gfhadex.jar
- chmod 755 <Package Folder>/files/schema
- chmod 777 <Package Folder>/files/.data
- chmod 777 <Package Folder>/files/.data/unzfile
- chmod 777 <Package Folder>/files/.data/unzfile/AndroidSystemPlug2.apk
- chmod 777 <Package Folder>/files/.data/unzfile/NgpMain_2.0.6_C002_201702281605.apk
- chmod 777 <Package Folder>/files/.data/unzfile/busybox
- chmod 777 <Package Folder>/files/.data/unzfile/chattr
- chmod 777 <Package Folder>/files/.data/unzfile/dg
- chmod 777 <Package Folder>/files/.data/unzfile/ir
- chmod 777 <Package Folder>/files/.data/unzfile/pet
- chmod 777 <Package Folder>/files/.data/unzfile/sprot
- chmod 777 <Package Folder>/files/.data/unzfile/supolicy
- chmod 777 <Package Folder>/files/.sh
- chmod 777 <Package Folder>/files/.sh/r.sh
- sh <Package Folder>/files/.z/r0 -c <Package Folder>/files/.sh/r.sh
- sh <Package Folder>/files/.z/r1 -C '<Package Folder>/files/.sh/r.sh'
- sh <Package Folder>/files/.z/r1 -auto
- sh <Package Folder>/files/.z/r2 -c <Package Folder>/files/.sh/r.sh
- sh <Package Folder>/files/.z/r3
- sh <Package Folder>/files/.z/r3 -c <Package Folder>/files/.sh/r.sh
Gains access to telephone information (number, imei, etc.).