Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.513.origin
Network activity:
Connecting to:
- s####.####.com
- g####.####.com
- newspo####.hk
- and####.####.com
- a####.####.mobi
- e####.####.com
- 1####.####.55
- a####.####.com
HTTP GET requests:
- newspo####.hk/v2/countries?channel=####
- 1####.####.55/files/apk/201701/13/2303d107.apk
- newspo####.hk/s2/heartbeat?imei=####&imsi=####&androidid=####&mac=####&version=####&model=####&c=####&country=####&l=####&osp=####&osv=####&id=####&da...
- a####.####.com/api/getADConfig?app_key=####&duid=####&sdk_version=####&gaid=####&vs=####
- newspo####.hk/v2/categories?country=####&channel=####&languages=####
- a####.####.com/api/getADResource?req=####&start=####&limit=####&vs=####
- newspo####.hk/ns/articles?limit=####&channel=####&topics=####&country=####&languages=####
- newspo####.hk/ns/countries/us/popular-articles?limit=####&channel=####&languages=####
- g####.####.com/files/apk/201701/13/2303d107.apk
HTTP POST requests:
- s####.####.com/log/receive?type=####&duid=####
- a####.####.mobi/api.php?sk=####
- and####.####.com/rqd/async?aid=####
- e####.####.com/event.php
Modified file system:
Creates the following files:
- /data/data/####/databases/country.db
- /data/data/####/shared_prefs/META_INFO.xml
- /data/data/####/databases/news.db-journal
- /data/data/####/files/category.text
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/Sprite/ksuid
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/app_crashrecord/1004
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/shared_prefs/curtain_sp.xml.bak
- /data/data/####/shared_prefs/####push.xml.bak
- /data/data/####/cache/ads916862621.jar
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- /data/data/####/app_aoct/kt.zip
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/shared_prefs/curtain_sp.xml
- /data/data/####/shared_prefs/####push.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/country.db-journal
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/files/gaClientId
- /data/data/####/shared_prefs/META_INFO.xml.bak
- /data/data/####/files/security_info
- /data/data/####/databases/news.db
- /data/data/####/shared_prefs/A_K.xml
- /data/data/####/files/local_crash_lock
- /data/data/####/files/native_record_lock
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/shared_prefs/crashrecord.xml
- /data/data/####/files/ksuid
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop ro.genymotion.version
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.secure
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.debuggable
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop qemu.sf.fake_camera
- /system/bin/sh -c getprop gsm.sim.state
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop androVM.vbox_dpi
- /system/bin/sh -c getprop gsm.sim.state2
- /system/bin/sh -c getprop ro.build.version.emui
Contains functionality to send SMS messages automatically.
