Android.Exploit.90

Android.Exploit.90

Added to the Dr.Web virus database: 2018-06-08

Virus description added: 2018-06-08

Malicious functions:

Executes code of the following detected threats:

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) p####.b####.com:80
TCP(HTTP/1.1) www.tThousa####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) box.zhan####.b####.com:80
TCP(HTTP/1.1) p####.j####.com:80

DNS requests:

HTTP GET requests:

HTTP POST requests:

Modified file system:

Creates the following files:

Miscellaneous:

Executes next shell scripts:

/system/bin/sh
app_process <Package Folder>/files com.core.seed.App FilesDir=<Package Folder>/files DataDir=<Package Folder> PackageName=<Package> Tag=ShWZXXTPNN01_T_CTA PackageCodePath=/data/app/<Package>-1.apk CacheDir=<Package Folder>/cache
app_process <Package Folder>/files com.tj.goldbean.App <Package Folder>/files <Package Folder>/files/res/logo.jpg --setup 5 ShWZXXTPNN01_T_CTA
chmod 777 <Package Folder>/files/sys.log
getprop
ls -l /dev/

Loads the following dynamic libraries:

Uses the following algorithms to encrypt data:

Uses the following algorithms to decrypt data:

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.