Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.269.origin
Network activity:
Connecting to:
- s####.####.com
- 2####.####.214
- i####.####.cn
- n####.####.cn
- h####.####.com
- d####.####.com
- tao####.com
- union-c####.####.com
- 2####.####.197
- a####.####.cn
- m####.####.com
- ur####.####.com
- f####.####.cn
- a####.####.com
- mer####.####.com
HTTP GET requests:
- m####.####.com/images/index/icon-close-banner.png
- tao####.com/t.php?k=####&url=####
- f####.####.cn/focus/conf?device_type=####&height=####&dpi=####&android_i...
- h####.####.com/cart/cart.json?sid=####&t=####
- mer####.####.com/log.gif?t=####&m=####&cul=####&pin=####&uid=####&sid=##...
- 2####.####.214/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####...
- n####.####.cn/?s=####&t=####&g=####
- union-c####.####.com/jdc?e=####&p=####&t=####
- d####.####.com/ymian/index-3.html
- i####.####.cn/iplookup/iplookup.php?format=####
- 2####.####.197/action/connect/active?app_id=####&udid=####&imsi=####&net...
- s####.####.com/m/images/index/live-icon.png
HTTP POST requests:
- a####.####.cn/action/user_info
- a####.####.com/v1/ins/apps
- ur####.####.com/log/m?std=####
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/online.xml.bak
- <Package Folder>/databases/blue_cmn-journal
- <Package Folder>/shared_prefs/device.xml
- <Package Folder>/databases/baidu_cmn-journal
- <Package Folder>/shared_prefs/online.xml
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/pp.xml.bak
- <Package Folder>/files/CacheTime.dat
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/files/mobclick_agent_cached_<Package>2
- <Package Folder>/files/ijiami.dat
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/80.tmp
- <Package Folder>/shared_prefs/saidcommon_pref.xml
- <Package Folder>/files/webview/localstorage/http_m.jd.com_0.localstorage-journal
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/cache/picasso-cache/4596270c53352da77b94a4d481f32f30.1.tmp
- <Package Folder>/shared_prefs/AppSettings.xml
- <Package Folder>/shared_prefs/pp.xml
- <Package Folder>/shared_prefs/LauncherApp.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/localtime.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/<Package>_cgr
- <Package Folder>/cache/picasso-cache/f3c1ff31899ccca97d07c1664ec12074.0.tmp
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/gitConfig.xml.bak
- <Package Folder>/files/wca.jar
- <Package Folder>/shared_prefs/ShowAdFlag.xml
- <Package Folder>/shared_prefs/localtime.xml
- <Package Folder>/app_cache/ijiami.jar
- <Package Folder>/cache/picasso-cache/f3c1ff31899ccca97d07c1664ec12074.1.tmp
- <Package Folder>/files/lmoevssnujlybeprprfvzkppncuacgdjp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/picasso-cache/4596270c53352da77b94a4d481f32f30.0.tmp
- <Package Folder>/cache/picasso-cache/journal.tmp
- <Package Folder>/files/webview/localstorage/http_so.m.jd.com_0.localstorage-journal
- <Package Folder>/shared_prefs/gitConfig.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
