Android.DownLoader.1859

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Backdoor.433.origin

Downloads the following detected threats from the Web:

Android.Backdoor.433.origin

Network activity:

Connecting to:

i####.####.cn
w####.####.com:9003
c####.####.com
y####.com
n####.####.com
n####.####.com:8066

HTTP GET requests:

i####.####.cn/iplookup/iplookup.php?format=####
c####.####.com/s?z####
c####.####.com/m/AC568CDF52764B53AEF1498003A3C53C70
c####.####.com/m/AC046D1A6FB640A4B62BB6CF9E6F6F7B6C
n####.####.com/c/1485419085826

HTTP POST requests:

n####.####.com/p/1485419086135
n####.####.com/m/
y####.com/cu.ashx
w####.####.com:9003/api/getCfg.jsp
n####.####.com:8066/s/

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/localtime.xml.bak
/data/data/####/shared_prefs/gitConfig.xml
/data/data/####/app_AB197D08407ABE58681467B313839AB1/wsroot.sh
/data/data/####/app_AB197D08407ABE58681467B313839AB1/Matrix
/data/data/####/files/80.tmp
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/sdcard/tencent/bring/.res/2823AE826CA3BC2D57CE4E41A6601F54.tmp
/data/data/####/databases/webviewCookiesChromium.db-journal
/sdcard/tencent/bring/deviceId
/data/data/####/app_AB197D08407ABE58681467B313839AB1/toolbox
/data/data/####/app_AB197D08407ABE58681467B313839AB1/install-recovery.sh
/data/data/####/app_AB197D08407ABE58681467B313839AB1/supolicy
/sdcard/tencent/bring/sys_install
/data/data/####/app_AB197D08407ABE58681467B313839AB1/debuggerd
/data/data/####/app_AB197D08407ABE58681467B313839AB1/ddexe
/data/data/####/app_AB197D08407ABE58681467B313839AB1/fileWork
/data/data/####/shared_prefs/localtime.xml
/sdcard/tencent/bring/config
/data/data/####/app_AB197D08407ABE58681467B313839AB1/550B92E0CC47FEA399E72E29040C4752
/data/data/####/shared_prefs/device.xml
/data/data/####/databases/webview.db-journal
/data/data/####/app_AB197D08407ABE58681467B313839AB1/pidof
/sdcard/tencent/bring/.res/550B92E0CC47FEA399E72E29040C4752.tmp
/data/data/####/databases/favorite.db-journal
/data/data/####/files/eiulig
/sdcard/tencent/bring/.res/rt_pkg
/sdcard/device
/sdcard/tencent/bring/master.lock
/data/data/####/app_vatwvl/6BF4197C4C2660C6880031210C126F0D.jar.tmp
/sdcard/tencent/bring/adv
/data/data/####/app_AB197D08407ABE58681467B313839AB1/su
/sdcard/tencent/bring/master
/data/data/####/app_AB197D08407ABE58681467B313839AB1/2823AE826CA3BC2D57CE4E41A6601F54
/data/data/####/cache/webviewCacheChromium/index