Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.4567
- Android.Triada.482.origin
Threat detection based on machine learning.
File system changes:
Creates the following files:
- /data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
- /data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
- /data/data/####/8EAD111D030291821E19A80E344C340A.xml
- /data/data/####/_p.xml
- /data/data/####/_sh.xml
- /data/data/####/bhfatbmn.jar
- /data/data/####/cnjgpabvuoxgxtevvwms.xml
- /data/data/####/dlnawh.png
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/kk_datas_info.xml
- /data/data/####/libfqinlx.so
- /data/data/####/libfqinlx.so-32
- /data/data/####/libfqinlx.so-64
- /data/data/####/yd_config_c.xml
- /data/media/####/.kkid
- /data/media/####/.usdis
- /data/media/####/3BF7E21765E3BA3F64FF4CCCA5FC2945.jar
- /data/media/####/3BF7E21765E3BA3F64FF4CCCA5FC2945.temp
- /data/media/####/63B7E09890E4F01CF21FF7DF8BBF1ED1
- /data/media/####/_pn
- /data/media/####/_shn
Miscellaneous:
Executes the following shell scripts:
- cat /proc/version
- cat /sys/class/net/wlan0/address
- getprop
- getprop ro.board.platform
- getprop ro.product.cpu.abi
- getprop ro.yunos.build.version
Loads the following dynamic libraries:
- libfqinlx
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- DES
- RSA-None-PKCS1Padding
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.