Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.455.origin
- Android.DownLoader.414.origin
Network activity:
Connecting to:
- 1####.####.131:8080
- f####.####.com
- a####.####.com
- 1####.####.214:8080
HTTP GET requests:
- f####.####.com/f/wf0215.dat
- 1####.####.131:8080/spotService/a.jsp?k=####
- f####.####.com/f/3xrp.jpg
- 1####.####.214:8080/jfservice/a.jsp?k=####
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/bim.xml
- /data/data/####/databases/cs.db
- /data/data/####/shared_prefs/b1356507059351895.xml.bak
- /data/data/####/shared_prefs/bak.xml
- /data/data/####/shared_prefs/a1356507059351895.xml
- /data/data/####/shared_prefs/sps.xml
- /data/data/####/files/1485415975219.jar
- /data/data/####/shared_prefs/^_`ab.xml
- /data/data/####/files/1485415975216.jar
- /data/data/####/shared_prefs/bam.xml
- /sdcard/w/i_356507059351895/3xrp.jpg.data
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/shared_prefs/sco.xml
- /data/data/####/shared_prefs/cix.xml
- /sdcard/w/i_356507059351895/_c.dat
- /data/data/####/shared_prefs/pid.xml
- /data/data/####/shared_prefs/c1356507059351895.xml
- /data/data/####/databases/a1.db-journal
- /data/data/####/shared_prefs/cft.xml
- /data/data/####/shared_prefs/eid.xml
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/files/01485415970621.jar
- /sdcard/Android/data/code/MID.DAT
- /data/data/####/shared_prefs/bid.xml
- /data/data/####/shared_prefs/cfb.xml
- /data/data/####/shared_prefs/MyPrefsFile.xml
- /data/data/####/shared_prefs/pim.xml
- /data/data/####/files/1485415975224.jar
- /data/data/####/shared_prefs/ltime.xml
- /data/data/####/shared_prefs/b1356507059351895.xml
- /data/data/####/shared_prefs/sid.xml
- /data/data/####/shared_prefs/cn.jpush.serverconfig.xml
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/shared_prefs/bah.xml
- /data/data/####/files/1485415975232.jar
- /data/data/####/shared_prefs/i.xml
- /data/data/####/databases/cs.db-journal
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/shared_prefs/a1356507059351895.xml.bak
- /data/data/####/shared_prefs/10.xml
- /data/data/####/shared_prefs/cfj.xml
- /data/data/####/shared_prefs/a1.xml
- /data/data/####/shared_prefs/sim.xml
- /data/data/####/shared_prefs/ftime.xml
- /data/data/####/files/1485415975239.jar
- /data/data/####/shared_prefs/c1356507059351895.xml.bak
- /data/data/####/shared_prefs/d1356507059351895.xml
- /data/data/####/shared_prefs/baj.xml
- /sdcard/Download/pdat/names.dat
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/files/01485415963360.jar
- /data/data/####/shared_prefs/f1356507059351895.xml
- /data/data/####/shared_prefs/b.xml
- /data/data/####/shared_prefs/baq.xml
- /sdcard/Download/pdat/share.dat
Miscellaneous:
Contains functionality to send SMS messages automatically.
