Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.BackDoor.985
- Android.Xiny.73.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) trac####.ad####.com:80
- TCP(HTTP/1.1) c####.s####.press:80
- TCP(HTTP/1.1) c####.wev####.com:80
- TCP(HTTP/1.1) ads.dofun####.com:80
- TCP(HTTP/1.1) v1.s####.press:80
- TCP(HTTP/1.1) api.ap####.com:80
- TCP(HTTP/1.1) cl####.mob####.net:80
- TCP(HTTP/1.1) p####.admobc####.com:80
- TCP(HTTP/1.1) p####.go####.com:80
- TCP(HTTP/1.1) c.s####.co:80
- TCP(HTTP/1.1) gl####.ymtrac####.com:80
- TCP(HTTP/1.1) t####.app####.info:80
- TCP(HTTP/1.1) cp####.mobisma####.com:80
- TCP(HTTP/1.1) apptr####.com:80
- TCP(HTTP/1.1) duc####.b####.com:80
- TCP(HTTP/1.1) atracki####.appf####.com:80
- TCP(HTTP/1.1) tr####.ads####.in:80
- TCP(HTTP/1.1) trac####.le####.com:80
- TCP(HTTP/1.1) trk.supe####.cn:80
- TCP(HTTP/1.1) c####.mo####.net:80
- TCP(HTTP/1.1) t####.click####.com:80
- TCP(HTTP/1.1) www.okyes####.com:8081
- TCP(HTTP/1.1) click####.avatar####.com:80
- TCP(HTTP/1.1) clinkad####.com:80
- TCP(HTTP/1.1) t.api.y####.net:80
- TCP(HTTP/1.1) 45.79.1####.161:80
- TCP(HTTP/1.1) trk.gl####.com:80
- TCP(HTTP/1.1) c####.adi####.com:80
- TCP(HTTP/1.1) p.icec####.org:80
- TCP(HTTP/1.1) trac####.alphaki####.com:80
- TCP(HTTP/1.1) roadmap####.go2af####.com:80
- TCP(HTTP/1.1) www.koapk####.com:8081
- TCP(HTTP/1.1) 45.79.1####.241:80
- TCP(HTTP/1.1) c####.gnkst####.com:80
- TCP(HTTP/1.1) ap####.com:80
- TCP(HTTP/1.1) ggg.koapk####.com:80
- TCP(HTTP/1.1) clk.hope####.net:80
- TCP(HTTP/1.1) c####.u.appco####.com:80
- TCP(HTTP/1.1) w####.go2c####.org:80
- TCP(HTTP/1.1) ak.icec####.org:80
- TCP(HTTP/1.1) api.reac####.com:80
- TCP(SSL/3.0) a####.app####.com:443
- TCP(TLS/1.0) roadmap####.go2af####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) www.a####.com.####.net:443
- TCP(TLS/1.0) web-exp####.it####.a####.####.net:443
- TCP(TLS/1.0) it####.a####.com.####.net:443
- TCP(TLS/1.0) squarea####.go2af####.com:443
- TCP(TLS/1.0) waws-pr####.vip.azurewe####.####.net:443
- TCP(TLS/1.0) 1plu####.go2af####.com:443
- TCP(TLS/1.0) a####.app####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) c####.mobifu####.com:443
- TCP(TLS/1.0) carrier####.go2af####.com:443
- TCP(TLS/1.0) us.fdpl####.com:443
- TCP(TLS/1.0) trac####.artofc####.com:443
DNS requests:
- 1plu####.go2af####.com
- a####.app####.com
- ads.dofun####.com
- ak.icec####.org
- ap####.com
- api.ap####.com
- api.reac####.com
- apptr####.com
- atracki####.appf####.com
- c####.adi####.com
- c####.gnkst####.com
- c####.mo####.net
- c####.mobifu####.com
- c####.s####.press
- c####.s####.press
- c####.u.appco####.com
- c####.wev####.com
- c.s####.co
- carrier####.go2af####.com
- cl####.mob####.net
- click####.avatar####.com
- clinkad####.com
- clk.hope####.net
- cp####.mobisma####.com
- duc####.b####.com
- f####.gst####.com
- ggg.koapk####.com
- gl####.ymtrac####.com
- it####.a####.com
- lemm####.azurewe####.net
- p####.admobc####.com
- p####.go####.com
- p.icec####.org
- roadmap####.go2af####.com
- squarea####.go2af####.com
- t####.app####.info
- t####.click####.com
- t.api.y####.net
- t.mob####.net
- tr####.ads####.in
- trac####.ad####.com
- trac####.alphaki####.com
- trac####.artofc####.com
- trac####.le####.com
- trk.gl####.com
- trk.supe####.cn
- us.fdpl####.com
- v1.s####.press
- w####.go2c####.org
- web-exp####.it####.a####.com
- www.a####.com
- www.koapk####.com
- www.okyes####.com
HTTP GET requests:
- ads.dofun####.com/acs.php?adid=####&c_ot=####&gaid=####&pb=####&sid=####...
- ads.dofun####.com/acs.php?sid=####&adid=####&gaid=####&pb=####&sub_id=####
- ak.icec####.org/rule?platform=####&os_version=####&package_name=####&app...
- ap####.com/c/048649/0r161r83-qr5p-66r9-38q3-55704503n7s1/4rpn3570.html?c...
- api.ap####.com/link/buy/android/com.cmcm.live/e1?clinkID=####&pubID=####...
- api.ap####.com/link/buy/android/com.goeuro.rosie/e1?clinkID=####&pubID=#...
- api.ap####.com/link/buy/android/com.omni.cleaner/e1?clinkID=####&pubID=#...
- api.ap####.com/link/buy/android/com.ratetools.convertix/e1?clinkID=####&...
- api.reac####.com/api/s2s/goto?id=####&t=####&channel=####&appid=####&dev...
- apptr####.com/dir/click?placement_id=####&campaign_id=####&affid=####&ci...
- atracki####.appf####.com/transaction/post_click?offer_id=####&aff_id=###...
- c####.adi####.com/v1/click?offer_id=####&pid=####&cid=####&sub_pid=####&...
- c####.gnkst####.com/tracking?tid=####&gaid=####&idfa=####&andid=####&ime...
- c####.mo####.net/index.php?m=####&p=####&app_id=####&offer_id=####&click...
- c####.s####.press/aff_c?offer_id=####&gaid=####&aff_sub=####&sub_id=####
- c####.u.appco####.com/v1/click?oid=####&affid=####&package_name=####&sub...
- c####.u.appco####.com/v1/click?oid=####&affid=####&package_name=####&tid...
- c####.wev####.com/click?offer_id=####&channel_id=####&click_id=####&sub_...
- c.s####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_po=#...
- cl####.mob####.net/target/t.mobrand.net/tracking/aff/QBNGd-GgTZyreeqYkUu...
- cl####.mob####.net/tracking/aff/QBNGd-GgTZyreeqYkUuTgg/Gel1em3ZTmSNp11KG...
- click####.avatar####.com/index.php?m=####&p=####&app_id=####&offer_id=##...
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gai...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid1=####&si...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=####&sid...
- clk.hope####.net/click?id=####&aff=####&ost=####&click_id=####&aff_sub=#...
- cp####.mobisma####.com/index.php?m=####&p=####&app_id=####&offer_id=####...
- duc####.b####.com/click/affClick?aff_id=####&offer_id=####&google_aid=##...
- duc####.b####.com/click/affClick?aff_sub=####&aff_sub19=####&aff_sub2=##...
- gl####.ymtrac####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=...
- p####.admobc####.com/v1/ad/click?subsite_id=####&transaction_id=####&id=...
- p####.go####.com/store/apps/details?id=####&_lastparam=####
- p.icec####.org/module?platform=####&os_version=####&package_name=####&ap...
- roadmap####.go2af####.com/sl?id=####&pid=####&clickid=####&sub2=####&sub...
- t####.app####.info/tracking/index/5b11f9c306025?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b12a453b9e48?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b12ea5d35017?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b14dd1be7ec0?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b1755b091298?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b1758fde4fa9?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b17642acf7a6?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b17642ad1276?gaid=####&idfa=####&andi...
- t####.app####.info/tracking/index/5b1771295bf97?gaid=####&idfa=####&andi...
- t####.click####.com/v1/ad/click?h=####&pubid=####&campid=####&geo=####&a...
- t.api.y####.net/v1/click/f?ad=####&app_id=####&pid=####&api_type=####&s=...
- tr####.ads####.in/liter.php?aid=####&linkid=####&joinid=####&am=####&sub...
- trac####.ad####.com/click/10671/10176475/?tid=####&gaid=####&aid=####&pu...
- trac####.alphaki####.com/network/tracking/6b2nnj8zmkd987093?affid=####&c...
- trac####.alphaki####.com/network/tracking/6b2nnj912bo261555?affid=####&c...
- trac####.alphaki####.com/network/tracking/6b35p0q6vs0294463?affid=####&c...
- trac####.alphaki####.com/network/tracking/6b3xhm951z6660394?affid=####&c...
- trac####.alphaki####.com/network/tracking/6b3zrqe7qhd573746?affid=####&c...
- trac####.alphaki####.com/network/tracking/6b4ctdjh0ip204999?affid=####&c...
- trac####.alphaki####.com/network/tracking/6b4ctdjiho2774362?affid=####&c...
- trac####.le####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&click_id=...
- trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAIqJ2Hw8dEAs/CF?subid1=####&placeme...
- trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAoqJWlkZrJLo/CF?subid1=####&placeme...
- trk.gl####.com/c/AAAAAAAAAAAAAAAAAAAAAoqJWq9vrBJg/CF?subid1=####&placeme...
- trk.supe####.cn/index.php?camp=####&ch_id=####&click_id=####&ch_subid=##...
- v1.s####.press/assets/images/0531
- v1.s####.press/get/ads_check/US?version=####
- v1.s####.press/get/con?version=####
- v1.s####.press/get/feeds/US?version=####&api_token=####
- v1.s####.press/tracking/index/5b12eed910156?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b174730c744f?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b1751bc8beb0?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b176351565e8?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b17635156a3f?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b17635156df4?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b1770acb7958?gaid=####&idfa=####&aff_sub=...
- v1.s####.press/tracking/index/5b1770acb7d45?gaid=####&idfa=####&aff_sub=...
- w####.go2c####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_clic...
- w####.go2c####.org/aff_r?offer_id=7157323&aff_id=1616&url=http://track.c...
HTTP POST requests:
- ggg.koapk####.com/pgm/sr/gm/gy
- www.koapk####.com:8081/sm/sr/rt/ry
- www.okyes####.com:8081/sdk/nsd.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/.m2.so
- /data/data/####/1527775200.jar
- /data/data/####/20160121.xml
- /data/data/####/20160121.xml.bak
- /data/data/####/201805312050.apk
- /data/data/####/22148269.apk
- /data/data/####/22148269.dex
- /data/data/####/B201806041850.apk
- /data/data/####/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
- /data/data/####/ag.xml
- /data/data/####/ak.salvia.sdk.xml
- /data/data/####/arrkii.native.sdk.db-journal
- /data/data/####/bdownloaders.db-journal
- /data/data/####/c201805312050.apk
- /data/data/####/carrier_kqdw_radish
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/data_3 (deleted)
- /data/data/####/dc1
- /data/data/####/dc2
- /data/data/####/dcz
- /data/data/####/debuggerd_hulu
- /data/data/####/elfm
- /data/data/####/elfm1528276341017.zip
- /data/data/####/env201806041850.data
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/forever.sh
- /data/data/####/index
- /data/data/####/install-recovery.sh
- /data/data/####/kcol_ysy
- /data/data/####/loa.xml
- /data/data/####/ssp_sdk.xml
- /data/data/####/ssp_sdk.xml (deleted)
- /data/data/####/start_wkdq_hd
- /data/data/####/swith1014.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.m2.so
- /data/media/####/B201806041850.apk
- /data/media/####/test1528276341061
Miscellaneous:
Executes next shell scripts:
- c201805312050.apk -c <Package>:troubles
- chmod -R 777 <Package Folder>/com.init.env/app_abz /storage/emulated/0/abz
- chmod 0777 <Package Folder>/com.init.env/files/elfm
- chmod 0777 <Package Folder>/com.init.env/files/forever.sh
- chmod 6777 <Package Folder>/files/c201805312050.apk
- dcz <Package Folder>/com.init.env/app_abz/dc1 <Package Folder>/com.init.env/app_abz/dc2
- logcat -d -v time
- ls -l /system/bin/su
- ps
- sh
Loads the following dynamic libraries:
- libcom.cranife.troubles
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.