Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.443.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sl.zhang####.com:80
- TCP(HTTP/1.1) gp.sh####.com:80
DNS requests:
- gp.sh####.com
- gp.sj####.com
- sl.zhang####.com
HTTP GET requests:
- gp.sh####.com/cr/sv/getGoFile?name=####
- gp.sh####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=####...
- sl.zhang####.com/apk/des_v171204_32.zip
- sl.zhang####.com/apk/goplaysdk_v171201_sp2.dat
- sl.zhang####.com/rtf/408b845b63828fe074b39ecd1cba374c.slze
- sl.zhang####.com/rtf/42108637bf1aa8173608aa9259693c1b.slze
- sl.zhang####.com/rtf/43048420199e0767a10a7a1a25e65e32.slze
- sl.zhang####.com/rtf/611939f8c2ec5798458a1b43c5d12c08.slze
- sl.zhang####.com/rtf/6172e4a32338b1deed308f899acf3ce1.slze
- sl.zhang####.com/rtf/640adb88b11aaa31cef58f201f381b03.slze
- sl.zhang####.com/rtf/8063d9d8538ce6248951fd430b6c7632.slze
- sl.zhang####.com/rtf/95039bf01df7c9832986cba2bad47076.slze
HTTP POST requests:
- gp.sh####.com/cr/sv/getEPList
File system changes:
Creates the following files:
- /data/data/####/.md
- /data/data/####/14ACAE9CC41369423F427F89300D0C27
- /data/data/####/1542022069273_beta32.so
- /data/data/####/26E32C4FB076CB60D9C0E232C24281F9
- /data/data/####/408.jar
- /data/data/####/421.jar
- /data/data/####/430.jar
- /data/data/####/4D87B80CB04B4ABC9866E843644D009A
- /data/data/####/51407EA30808F690DF57AF6FE78152F9
- /data/data/####/5t2DB8520H46
- /data/data/####/611.jar
- /data/data/####/617.jar
- /data/data/####/640.jar
- /data/data/####/806.jar
- /data/data/####/8C3599336B7F41BDD0F451655F877665
- /data/data/####/950.jar
- /data/data/####/BCB9E2822690BCA44BF08A39AE11C514
- /data/data/####/D0F903FD5EEAC0B4BBC3147DFABFE54E
- /data/data/####/F675548F1178C481F3BE8E9DC670492A
- /data/data/####/com.ma.t12golden2
- /data/data/####/com.ma.t_preferences.xml
- /data/data/####/device_gpid.xml.xml
- /data/data/####/gpdu
- /data/data/####/hftJcw46N.jar
- /data/data/####/ntmp22722285
- /data/data/####/samsung112.jar
- /data/data/####/test
- /data/data/####/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
Miscellaneous:
Executes the following shell scripts:
- <Package Folder>/files/.play/test <Package Folder>/files/.play/ 52266b568ac646fa89e236017109609e
- <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 52266b568ac646fa89e236017109609e <Package Folder>/.syslib-
- chmod 0771 <Package Folder>/.syslib-
- chmod 770 <Package Folder>/files/.play/test
- getenforce
- rm -f <Package Folder>/files/hftJcw46N.dex
- rm -f <Package Folder>/files/hftJcw46N.jar
- rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- rm <Package Folder>/files/hftJcw46N.dex
- rm <Package Folder>/files/hftJcw46N.jar
- rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
- sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 52266b568ac646fa89e236017109609e
- sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 52266b568ac646fa89e236017109609e <Package Folder>/.syslib-
Loads the following dynamic libraries:
- 1542022069273_beta32
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
