Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.155.origin
- Android.SmsSend.1848.origin
Network activity:
Connecting to:
- 1####.####.34:19000
- i####.####.com
- p####.####.com
- 6####.####.140
- 1####.####.18
- apm-col####.####.com
- p####.####.cn
- m####.####.com
HTTP GET requests:
- p####.####.com/cityjson?ie=####
- m####.####.com/ando-res/m/hQFsvuTOjQG2grLU8T2VCshw4jkuJadBny-GDQ
- m####.####.com/ando-res/m/pdEeeeSMxFc4Pj1c-bdIkZ0qk6HBiFe76oxdY-RIRAlRlRCSrhtjbA
- i####.####.com/a/35313985d3b9ccc38ab579d35065afe66
HTTP POST requests:
- p####.####.com/api/q/a/35313985d3b9ccc38ab579d35065afe66
- p####.####.cn/index.php/API
- apm-col####.####.com/cpi/crash
- 6####.####.140/ando/x/lis?app_id=####&r=####
- 1####.####.34:19000/v2/chis
- 1####.####.18/amb/rhi.php
- 6####.####.140/ando/x/liv?app_id=0db0b2c4-0b1d-41d2-b551-dc9b44cde6ab&r=595435672?r=####
Miscellaneous:
Executes next shell scripts:
- dumpsys meminfo
- procrank
- cat /data/anr/traces.txt
- /data/data/####/code-108037/2dp_p1is0l7sTHeO #### com.ekrrwq.wehsd.ugivaa.a.a.c.b /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M /storage/emulated/0/Download/ladung
- logcat -t 100 -v time
Contains functionality to send SMS messages automatically.
