Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.336.origin
- Android.Loki.15.origin
- Android.MulDrop.132.origin
- Android.Triada.144.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.336.origin
- Android.Loki.15.origin
- Android.MulDrop.132.origin
- Android.Triada.144.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 2####.####.com
- 5####.com
- a####.####.com
- a-####.eu
- adplexm####.####.com
- adr####.com
- ao####.com
- ap####.mobi
- bonga####.com
- c####.####.com
- c####.####.media
- clinkad####.com
- d####.####.com
- e####.####.com
- g####.####.com
- i####.####.com
- ilv####.com
- ip####.io
- land####.####.com
- m####.####.com
- nanoade####.com
- nltopof####.com
- o####.com
- p####.####.com
- pha####.info
- pixp####.com
- pop####.net
- pu####.com
- spxt####.com
- ss####.com
- t####.####.com
- t####.####.online
- t####.####.rocks
- tango####.com
- tra####.####.com
- trac####.####.org
- trackme####.com
- traffic####.com
- traktra####.com
- truecli####.net
- u####.####.com
- wonderl####.com
- x####.####.com
HTTP GET requests:
- 2####.####.com/click.php?c=####&key=####
- 5####.com/watch?shu=####&pst=####&rmtc=####&uuid=####&pii=####&in=####&p...
- a####.####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- a####.####.com/pool_link/1514/bmconv_20170610142029_ed7930ce_79fb_483e_b...
- a####.####.com/pull/top_offer?gaid=####&id=####
- a-####.eu/casino/nl/jquery.min.js
- adplexm####.####.com/imp?p=####&ct=####&ap=####&psid=####
- adr####.com/?placement=####&redi####
- ao####.com/afu.php?zoneid=####&var=####
- ap####.mobi/red/546a81d8-a0f2-11e6-8b9b-0cc47a44dbaa/?alg=####&source=##...
- bonga####.com/track?c=####&ps=####&csurl=####&subid=####
- c####.####.com/jquery-1.11.1.min.js
- c####.####.media/adplexmedia/tags/xdirect/xdirect.html?p=####&serverdoma...
- clinkad####.com/tracking?camp=####&pubid=####&subpubid=####&sid=####
- d####.####.com/afu.php?zoneid=####&var=####&1####
- d####.####.com/thinking/group/rtt_0525_666.apk
- e####.####.com/thinking/group/onemain/mainp.apk
- i####.####.com/popunders/map/style10.css
- ilv####.com/55K39/N-7P/Oerf/YaaPe2WRVctnNBljUY2ZjZvt5uc5cevNAQ--Z-gEfe8T...
- ip####.io/json
- land####.####.com/qfafu/
- nanoade####.com/a/display.php?r=####&sub1=####
- nltopof####.com/m/jpc/nl-6903s/alert.ogg
- o####.com/oc/74ef8584d9?affclick=####&pubid=####
- p####.####.com/?m=####
- pha####.info/redirect?tid=####&ref=####&subid=####&q=####
- pixp####.com/?id=####&to=####&ta=####
- pop####.net/world/sgo/61946/337708/b27b071b3688f4a5
- pu####.com/www/delivery/lg_two.php?bannerid=8089&campaignid=2341&zoneid=...
- spxt####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&sub3...
- ss####.com/?a=####&c=####&s2=####&s1=####
- t####.####.com/ck.php?line_item_id=####&subid_spx=####&kp=####
- t####.####.com/click?cid=####
- t####.####.com/hit.php?c=####&ps=####&csurl=####&subid=####
- t####.####.online/?utm_medium=####&utm_campaign=####&1=####&cid=####&_uu...
- t####.####.rocks/?utm_term=####&clickverify=####&utm_content=####
- tango####.com/favicon.ico
- tra####.####.com/?p=####&media_type=####&click_id=####
- trac####.####.org/zp-redirect?target=####&caid=####&zpid=####&cid=####&r...
- trackme####.com/r/40ff1114-4dd7-11e7-8429-114224b557f2/1/
- traffic####.com/mbe.php?id=####&zone=####
- traktra####.com/?a_aid=####&page=####&clickid=####&pubid=####
- truecli####.net/path/lp.php?trvid=####&trvx=####&externalid=####&var1=####
- u####.####.com/zcvisitor/1e95f165-4dd7-11e7-a0ed-0a7af8112772?campaignid...
- u####.####.com/zcvisitor/23f7f6d7-4dd7-11e7-94ac-067b6394d28c?campaignid...
- u####.####.com/zcvisitor/370dfb24-4dd7-11e7-8828-0a33a0bc48f2?campaignid...
- u####.####.com/zcvisitor/397473d1-4dd7-11e7-8d45-12c74d36231e?campaignid...
- wonderl####.com/?r=####&zoneid=####&pbk2=####&var=####&zone_old_id=####&...
- x####.####.com/click?adv=####&i=####
- x####.####.com/click?i=####
HTTP POST requests:
- a####.####.com/app_logs
- g####.####.com/pilot/api/300102
- m####.####.com/errorview/api/601
- p####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
- t####.####.com/ggview/rsddateindex
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/index
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.catr.apk
- <Package Folder>/files/####/.center.tapk
- <Package Folder>/files/####/.client
- <Package Folder>/files/####/.dg
- <Package Folder>/files/####/.dico.apk
- <Package Folder>/files/####/.dlme.apk
- <Package Folder>/files/####/.dlsb.apk
- <Package Folder>/files/####/.dsmt.apk
- <Package Folder>/files/####/.e0.data
- <Package Folder>/files/####/.ir
- <Package Folder>/files/####/.p.apk
- <Package Folder>/files/####/.rshs
- <Package Folder>/files/####/.service
- <Package Folder>/files/####/.ukd
- <Package Folder>/files/####/.uks
- <Package Folder>/files/####/.uok
- <Package Folder>/files/####/a.xml
- <Package Folder>/files/####/b.png
- <Package Folder>/files/####/boy
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/checkFile0
- <Package Folder>/files/####/checkFile13
- <Package Folder>/files/####/checkFile3
- <Package Folder>/files/####/checkFile5
- <Package Folder>/files/####/checkFile7
- <Package Folder>/files/####/checkFile9
- <Package Folder>/files/####/dbcbd7361f0fdf0d3db91bd4710f63ca.data.temp
- <Package Folder>/files/####/ex0
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/exp
- <Package Folder>/files/####/hello.dex
- <Package Folder>/files/####/libIQPFsmOUChmkwhbDdynamicloader.so
- <Package Folder>/files/####/libKueWuLGqMMnRgVVgbt.so
- <Package Folder>/files/####/libRppEcpLJpRVcTveVlala.so
- <Package Folder>/files/####/libhMEnYimzyYJbxvhuzxc.so
- <Package Folder>/files/####/mkdevsh
- <Package Folder>/files/####/myshell
- <Package Folder>/files/####/post.sh
- <Package Folder>/files/####/postroot.sh
- <Package Folder>/files/####/r1
- <Package Folder>/files/####/r2
- <Package Folder>/files/####/r3
- <Package Folder>/files/####/r4
- <Package Folder>/files/####/rsh
- <Package Folder>/files/####/rt8
- <Package Folder>/files/####/supolicy
- <Package Folder>/files/####/ym
- <Package Folder>/files/.imprint
- <Package Folder>/files/IQPFsmOUChmkwhbDdynamicloader.jar
- <Package Folder>/files/dbcbd7361f0fdf0d3db91bd4710f63ca.data
- <Package Folder>/files/exid.dat
- <Package Folder>/files/hello.apk
- <Package Folder>/files/libswbqgonYxEgdlSXzbootstrap.so
- <Package Folder>/files/source.apk
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.windy/49f19b1b089f018a1792a4c581f93d58.tmp
- <SD-Card>/.windy/508e8558f784e3a21d3368e4763e2693.dat
- <SD-Card>/.windy/508e8558f784e3a21d3368e4763e2693.tmp
- <SD-Card>/.windy/65288c96bb8cefd3d531a278a6ac5862.tmp
- <SD-Card>/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.dat
- <SD-Card>/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.tmp
Miscellaneous:
Executes next shell scripts:
- /data/data/zqa.nfa.lgl/files/.snow/exp /data/data/zqa.nfa.lgl/files/.snow /data/data/zqa.nfa.lgl/files/.work
- /system/bin/sh ./mkdevsh
- /system/bin/sh <Package Folder>/files/.snow/.zip/rsh
- <dexopt>
- <error:2>
- app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm disable com.kai.kia.dou.ye.cai
- app_process /system/bin com.android.commands.pm.Pm disable com.num.hum.kong.ui.op.er
- app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm disable com.wo.ai.girl.huy.wp
- app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
- app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
- app_process /system/bin com.android.commands.pm.Pm enable com.kai.kia.dou.ye.cai
- app_process /system/bin com.android.commands.pm.Pm enable com.num.hum.kong.ui.op.er
- app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
- app_process /system/bin com.android.commands.pm.Pm enable com.wo.ai.girl.huy.wp
- chcon u:object_r:system_file:s0 /system/bin/.author
- chcon u:object_r:system_file:s0 /system/lib/libsoon.so
- chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
- chcon u:object_r:system_file:s0 /system/xbin/.cp
- chcon u:object_r:system_file:s0 /system/xbin/.rainin
- chcon u:object_r:system_file:s0 /system/xbin/supolicy
- chmod 777 <Package Folder>/files/.snow/.catr.apk
- chmod 777 <Package Folder>/files/.snow/.client
- chmod 777 <Package Folder>/files/.snow/.dg
- chmod 777 <Package Folder>/files/.snow/.rshs
- chmod 777 <Package Folder>/files/.snow/.service
- chmod 777 <Package Folder>/files/.snow/.ukd
- chmod 777 <Package Folder>/files/.snow/.uks
- chmod 777 <Package Folder>/files/.snow/.uok
- chmod 777 <Package Folder>/files/.snow/.zip/
- chmod 777 <Package Folder>/files/.snow/.zip/boy
- chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
- chmod 777 <Package Folder>/files/.snow/.zip/post.sh
- chmod 777 <Package Folder>/files/.snow/.zip/r1
- chmod 777 <Package Folder>/files/.snow/.zip/r2
- chmod 777 <Package Folder>/files/.snow/.zip/r3
- chmod 777 <Package Folder>/files/.snow/.zip/r4
- chmod 777 <Package Folder>/files/.snow/.zip/rsh
- chmod 777 <Package Folder>/files/.snow/.zip/rt8
- chmod 777 <Package Folder>/files/.snow/a.xml
- chmod 777 <Package Folder>/files/.snow/b.png
- chmod 777 <Package Folder>/files/.snow/busybox
- chmod 777 <Package Folder>/files/.snow/ex0
- chmod 777 <Package Folder>/files/.snow/exp
- chmod 777 <Package Folder>/files/.snow/myshell
- chmod 777 <Package Folder>/files/.snow/supolicy
- chmod 777 <Package Folder>/files/.work/postroot.sh
- chown 0.0 /data/local/tmp/.catr.apk
- chown 0.0 /data/local/tmp/busybox
- chown 0.0 /system/app/Dingps.apk
- chown 0.0 /system/app/Linkcai.apk
- chown 0.0 /system/app/LocalFacebook.apk
- chown 0.0 /system/app/RomterFacebook.apk
- chown 0.0 /system/bin/.author
- chown 0.0 /system/xbin/.ci.pm
- chown 0.0 /system/xbin/.cp
- chown 0.0 /system/xbin/.rainin
- chown 0.0 /system/xbin/supolicy
- chown 0:0 /data/local/tmp/.catr.apk
- chown 0:0 /data/local/tmp/busybox
- chown 0:0 /system/app/Dingps.apk
- chown 0:0 /system/app/Linkcai.apk
- chown 0:0 /system/app/LocalFacebook.apk
- chown 0:0 /system/app/Lowerp.apk
- chown 0:0 /system/app/RomterFacebook.apk
- chown 0:0 /system/app/oneshs.apk
- chown 0:0 /system/bin/.author
- chown 0:0 /system/bin/debuggerd
- chown 0:0 /system/lib/libsoon.so
- chown 0:0 /system/xbin/.ci.pm
- chown 0:0 /system/xbin/.cp
- chown 0:0 /system/xbin/.rainin
- chown 0:0 /system/xbin/supolicy
- df /system
- mount -o remount ro /system
- mount -o remount rw /system
- mount -o remount,ro /system
- mount -o remount,rw /system
- mount -ro remount ro /system
- mount -ro remount,ro /system
- mount -wo remount rw /system
- mount -wo remount,rw /system
- rm /system/bin/debuggerd
- rm <Package Folder>/files/.snow/ex0
- sh
- sh <Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
