Android.DownLoader.3253

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.336.origin
Android.HiddenAds.76.origin
Android.RemoteCode.88.origin
Android.SmsBot.612.origin

Downloads the following detected threats from the Web:

Android.Backdoor.336.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

1####.####.133
5####.####.135
a####.####.com
a####.####.com:9090
a####.####.net
adplexm####.####.com
adr####.com
apirepo####.####.com
apps4####.com
bs5####.com
c####.####.com
c####.####.media
channel####.com
cpact####.com
d####.####.com
d####.com
d5ff-5e####.####.net
e####.####.com
f####.com
fe####.com
fu####.com
g####.####.com
go####.com
go####.nl
i####.####.com
ip####.io
l####.####.com
m####.####.com
onc####.com
p####.####.com
pha####.info
pi####.com
pu####.com
se####.####.com
syndica####.####.com
t####.####.com
time####.com
traktra####.com
u####.####.com
zfr####.com

HTTP GET requests:

1####.####.133/pixel.js?d=####
a####.####.com/cpxcenter/dpop.php?nid=####&pid=####&sid=####&zone=####&d...
a####.####.com/pull/top_offer?gaid=####&id=####
a####.####.com/wapbill/sale_static_newcp.jsp?uid=####&model=####&plugVer...
a####.####.com:9090/sdkcp/user_visit_appcp.jsp?uid=####&model=####&plugV...
a####.####.net/red?id=####&alias=####
adplexm####.####.com/imp?p=####&ct=####&ap=####&referrer=####&psid=####&...
adr####.com/?placement=####&redi####&cookie=####&domain=####
apirepo####.####.com/apiClick?cidRev=####&ts=####&ifa=####&dm=####&dos=#...
apps4####.com/?l=####&s=####&z=####&g=####&svar=####&ba=####&dm=####&ep=...
bs5####.com/?s=####&z=####&g=####&svar=####&ssk=####&h=####&b=####
c####.####.com/tag/implement-r.js?org=H781SiHNjvymQBd3c257&p=1&a=400728&...
c####.####.media/adplexmedia/tags/xdirect/xdirect.html?p=####&serverdoma...
channel####.com/?l=####&s=####&z=####&g=####&ba=####&dm=####&ep=####&vi=...
cpact####.com/api/v1.0/clk/track/proxy?ad_id=####&site_id=####&response_...
d####.####.com/thinking/group/rtt0620_663.apk
d####.com/watch?key=####&psid=####&c=####&c1=####
d5ff-5e####.####.net/red?id=####&alias=####
e####.####.com/thinking/group/onemain/mainp.apk
f####.com/pixel?d=####
fe####.com/?r=####&zoneid=####&pbk2=####&var=####&c=####&c1=####&uuid=##...
fu####.com/NL/1685460616?trackid=####&transaction_id=####&pubid=####&sii...
g####.####.com/apu.php?zoneid=####
g####.####.com/notice.php?p=####&interstitial=####
go####.com/
go####.nl/?gfe_rd=####&ei=####
i####.####.com/a/3521668acb8d3a1a04964513d0f7eb368
ip####.io/json
l####.####.com/t/clk?id=####&s2=####&s1=####
onc####.com/apu.php?zoneid=####
p####.####.com/r/986/p/Re.37082
p####.####.com/red/?code=####&a=####&pubid=####
pha####.info/redirect?tid=####&ref=####
pi####.com/?id=####&to=####&ta=####
pu####.com/www/delivery/directads.php?zoneid=####&sub_zoneid=####&sub_oc...
se####.####.com/sites/?cat=####&camp=####&categoryid=####&conv=####
syndica####.####.com/splash.php?idzone=####&type=####&sub=####
t####.####.com/aff_c?offer_id=####&aff_id=####&aff####
t####.####.com/click?cid=####
t####.####.com/newServing/tracking_id.php?gtruid=####&r=####
time####.com/afu.php?zoneid=####&var=####
traktra####.com/?a_aid=####&page=####&clickid=####&pubid=####
u####.####.com/zcvisitor/3338e593-7cae-11e7-a0e5-12ec77715048?campaignid...
u####.####.com/zcvisitor/3b47e293-7cae-11e7-bfdf-06934c6b4046?campaignid...

HTTP POST requests:

5####.####.135/xml/file/Cube_World/bigpic2.png
a####.####.com/oversea_adjust_and_download_write_redis/notify/download/app
a####.####.com/subscribe/api/1102
g####.####.com/pilot/api/300102
m####.####.com/errorview/api/601
p####.####.com/api/q/a/3521668acb8d3a1a04964513d0f7eb368
t####.####.com/ggview/rsddateindex
zfr####.com/up.do

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/index
<Package Folder>/cache/7279A851279312ADAA4F12DB359F3A35
<Package Folder>/databases/fruit.db
<Package Folder>/databases/fruit.db-journal
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.catr.apk
<Package Folder>/files/####/.center.tapk
<Package Folder>/files/####/.client
<Package Folder>/files/####/.dg
<Package Folder>/files/####/.dico.apk
<Package Folder>/files/####/.dlme.apk
<Package Folder>/files/####/.dlsb.apk
<Package Folder>/files/####/.dsmt.apk
<Package Folder>/files/####/.e0.data
<Package Folder>/files/####/.ir
<Package Folder>/files/####/.p.apk
<Package Folder>/files/####/.rshs
<Package Folder>/files/####/.service
<Package Folder>/files/####/.ukd
<Package Folder>/files/####/.uks
<Package Folder>/files/####/.uok
<Package Folder>/files/####/5f79d63143102423ac148986c2ae37a0.data.temp
<Package Folder>/files/####/5f79d63143102423ac148986c2ae37a0.data.temp (deleted)
<Package Folder>/files/####/a.xml
<Package Folder>/files/####/b.png
<Package Folder>/files/####/boy
<Package Folder>/files/####/busybox
<Package Folder>/files/####/checkFile0
<Package Folder>/files/####/checkFile13
<Package Folder>/files/####/checkFile3
<Package Folder>/files/####/checkFile5
<Package Folder>/files/####/checkFile7
<Package Folder>/files/####/checkFile9
<Package Folder>/files/####/ex0
<Package Folder>/files/####/mkdevsh
<Package Folder>/files/####/myshell
<Package Folder>/files/####/post.sh
<Package Folder>/files/####/postroot.sh
<Package Folder>/files/####/r1
<Package Folder>/files/####/r2
<Package Folder>/files/####/r3
<Package Folder>/files/####/r4
<Package Folder>/files/####/rsh
<Package Folder>/files/####/rt8
<Package Folder>/files/####/supolicy
<Package Folder>/files/5f79d63143102423ac148986c2ae37a0.data
<Package Folder>/files/SW01.jar
<Package Folder>/files/bb.jar
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/ob.zip
<Package Folder>/files/sdk.dex
<Package Folder>/shared_prefs/3521668acb8d3a1a04964513d0f7eb368|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml (deleted)
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/SSP.xml
<Package Folder>/shared_prefs/SSPPrefe.xml
<Package Folder>/shared_prefs/SSPPrefe.xml.bak
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/kbkbUpdateVerPreference.xml
<Package Folder>/shared_prefs/ops_data.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<SD-Card>/.tcookieid
<SD-Card>/.windy/49f19b1b089f018a1792a4c581f93d58.tmp
<SD-Card>/.windy/508e8558f784e3a21d3368e4763e2693.tmp
<SD-Card>/.windy/65288c96bb8cefd3d531a278a6ac5862.tmp
<SD-Card>/.windy/d2c2edbfd23c0e2279a83417a7e3c0db.tmp

Miscellaneous:

Executes next shell scripts:

/system/bin/sh ./mkdevsh
/system/bin/sh <Package Folder>/files/.snow/.zip/rsh
<Package Folder>/files/.snow/exp <Package Folder>/files/.snow <Package Folder>/files/.work
app_process /system/bin com.android.commands.pm.Pm disable com.android.tools.receiver
app_process /system/bin com.android.commands.pm.Pm disable com.android.upon.hash
app_process /system/bin com.android.commands.pm.Pm disable com.master.main.yaogirl.longe.wei
app_process /system/bin com.android.commands.pm.Pm disable com.qiu.qing.bing.shuo.tu
app_process /system/bin com.android.commands.pm.Pm disable com.setting.dysdtool
app_process /system/bin com.android.commands.pm.Pm disable com.slave.wuw.yiyi.ranran.fang
app_process /system/bin com.android.commands.pm.Pm enable com.android.tools.receiver
app_process /system/bin com.android.commands.pm.Pm enable com.android.upon.hash
app_process /system/bin com.android.commands.pm.Pm enable com.master.main.yaogirl.longe.wei
app_process /system/bin com.android.commands.pm.Pm enable com.qiu.qing.bing.shuo.tu
app_process /system/bin com.android.commands.pm.Pm enable com.setting.dysdtool
app_process /system/bin com.android.commands.pm.Pm enable com.slave.wuw.yiyi.ranran.fang
chcon u:object_r:system_file:s0 /system/bin/.author
chcon u:object_r:system_file:s0 /system/bin/debuggerd
chcon u:object_r:system_file:s0 /system/lib/libsoon.so
chcon u:object_r:system_file:s0 /system/xbin/.ci.pm
chcon u:object_r:system_file:s0 /system/xbin/.cp
chcon u:object_r:system_file:s0 /system/xbin/.rainin
chcon u:object_r:system_file:s0 /system/xbin/supolicy
chmod 777 <Package Folder>/files/.snow/.catr.apk
chmod 777 <Package Folder>/files/.snow/.client
chmod 777 <Package Folder>/files/.snow/.dg
chmod 777 <Package Folder>/files/.snow/.rshs
chmod 777 <Package Folder>/files/.snow/.service
chmod 777 <Package Folder>/files/.snow/.ukd
chmod 777 <Package Folder>/files/.snow/.uks
chmod 777 <Package Folder>/files/.snow/.uok
chmod 777 <Package Folder>/files/.snow/.zip/
chmod 777 <Package Folder>/files/.snow/.zip/boy
chmod 777 <Package Folder>/files/.snow/.zip/mkdevsh
chmod 777 <Package Folder>/files/.snow/.zip/post.sh
chmod 777 <Package Folder>/files/.snow/.zip/r1
chmod 777 <Package Folder>/files/.snow/.zip/r2
chmod 777 <Package Folder>/files/.snow/.zip/r3
chmod 777 <Package Folder>/files/.snow/.zip/r4
chmod 777 <Package Folder>/files/.snow/.zip/rsh
chmod 777 <Package Folder>/files/.snow/.zip/rt8
chmod 777 <Package Folder>/files/.snow/a.xml
chmod 777 <Package Folder>/files/.snow/b.png
chmod 777 <Package Folder>/files/.snow/busybox
chmod 777 <Package Folder>/files/.snow/ex0
chmod 777 <Package Folder>/files/.snow/myshell
chmod 777 <Package Folder>/files/.snow/supolicy
chmod 777 <Package Folder>/files/.work/postroot.sh
chown 0.0 /data/local/tmp/.catr.apk
chown 0.0 /data/local/tmp/busybox
chown 0.0 /system/app/Dingps.apk
chown 0.0 /system/app/Linkcai.apk
chown 0.0 /system/app/Lowerp.apk
chown 0.0 /system/app/MainMaster.apk
chown 0.0 /system/app/WelSlave.apk
chown 0.0 /system/app/oneshs.apk
chown 0.0 /system/bin/.author
chown 0.0 /system/bin/debuggerd
chown 0.0 /system/lib/libsoon.so
chown 0.0 /system/xbin/.ci.pm
chown 0.0 /system/xbin/.cp
chown 0.0 /system/xbin/.rainin
chown 0.0 /system/xbin/supolicy
chown 0:0 /data/local/tmp/.catr.apk
chown 0:0 /data/local/tmp/busybox
chown 0:0 /system/app/Dingps.apk
chown 0:0 /system/app/Linkcai.apk
chown 0:0 /system/app/Lowerp.apk
chown 0:0 /system/app/MainMaster.apk
chown 0:0 /system/app/WelSlave.apk
chown 0:0 /system/app/oneshs.apk
chown 0:0 /system/bin/.author
chown 0:0 /system/bin/debuggerd
chown 0:0 /system/lib/libsoon.so
chown 0:0 /system/xbin/.ci.pm
chown 0:0 /system/xbin/.cp
chown 0:0 /system/xbin/.rainin
chown 0:0 /system/xbin/supolicy
df /system
mount -o remount ro /system
mount -o remount rw /system
mount -o remount,ro /system
mount -o remount,rw /system
mount -ro remount ro /system
mount -ro remount,ro /system
mount -wo remount rw /system
mount -wo remount,rw /system
rm /system/bin/debuggerd
rm <Package Folder>/files/.snow/ex0
sh

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
DES
DES-CBC-PKCS5Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial