Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.333.origin
- Android.Triada.74.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- p####.####.com:8080
- g####.####.com
- hostwe####.com
- hostwe####.com:8080
- al####.####.com
- p####.####.com
- c####.####.com
- gam####.com
- w####.####.com
- inter####.####.com
- k####.####.com
- r####.####.com
- a####.####.com
HTTP GET requests:
- gam####.com/SDKManager/Game/gameinfo.php?gameId=####
- g####.####.com/atmp/ad.png
- k####.####.com/download/opacore/xcore7_1.0.2.md
- w####.####.com/getDisList?imei=####&cooId=####&xcooId=####&sdkversion=####
- k####.####.com/download/qhengine/1473066051852.dat
- c####.####.com/upload/apk/superbcleaner2.jpg
- c####.####.com/upload/apk/superbcleaner1.png
- al####.####.com/ym_jar
- k####.####.com/download/opacore/xcore5_1.0.6.md
- al####.####.com/Ag21
- k####.####.com/download/qhengine/1468309895225.dat
HTTP POST requests:
- inter####.####.com/newservice/newgetApks.action
- inter####.####.com/newservice/newbackDatas.action
- p####.####.com:8080/OpaService/OpaStrategy
- p####.####.com/OpaService/OpaLogUpload
- inter####.####.com/newservice/newjsApk.action
- p####.####.com:8080/OpaService/OpaMagicCode
- inter####.####.com/newservice/newopenOrSale.action
- hostwe####.com:8080/dispatcher.php
- r####.####.com/rqd/sync
- a####.####.com/app_logs
- hostwe####.com/dispatcher.php
- p####.####.com/OpaService/OpaReport
- p####.####.com/OpaService/OpaQHCode
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/umengUse.xml
- /data/data/####/files/blyzbj.jar
- /data/data/####/shared_prefs/Oveead.xml
- /data/data/####/files/ylsb.db
- /data/data/####/shared_prefs/data_statistical.xml
- /data/data/####/files/permmgr/libsu.so
- /data/data/####/shared_prefs/config.xml
- /data/data/####/files/mySdk.jar
- /data/data/####/files/blyzbj.dat
- /data/data/####/app_xxx/tkhoolib
- /data/data/####/databases/Pk.dataBase-journal
- /sdcard/small/data/image/superbcleaner1.png
- /data/data/####/shared_prefs/bugly_data.xml.bak
- /data/data/####/files/xactLib
- /data/data/####/files/permmgr/cb194f07e7c8ef6f33250b4a80bc6c28.dat.tmp
- /data/data/####/tx_shell/libshella-2.2.9.so
- /sdcard/Android/data/.nomedia
- /data/data/####/files/wddex.jar
- /data/data/####/files/permmgr/libcc.zip
- /sdcard/app/dd/appChannel
- /data/data/####/shared_prefs/data_statistical.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /sdcard/small/data/image/superbcleaner2.png
- /data/data/####/databases/smalldb2-journal
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_MWCHXSTPFZS42CR2GG36_216
- /data/data/####/files/tqltsvz.md
- /data/data/####/shared_prefs/bugly_data.xml
- /data/data/####/shared_prefs/Oveead.xml.bak
- /data/data/####/mix.dex
- /data/data/####/app_sgdex/dos.jar
- /data/data/####/files/permmgr/libsu.zip
- /data/data/####/files/blyzbj.md
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/system/bin/dd/des
- /data/data/####/files/sss.pdb
- /data/data/####/app_xxx/cc
- /data/data/####/files/.yflurrydatasenderblock.f27252d2-f4d1-48f0-823a-7a31320ced11
- /data/data/####/files/Agcr.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/bugly_db_lejiagu-journal
- /data/data/####/files/permmgr/libcc.so
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/.Ag/Agcr
- /data/data/####/files/permmgr/abba7fa6e38585333b137aed79036308.dat.tmp
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/files/permmgr/libTKHooklib.so
- /data/data/####/shared_prefs/xapcinfo.xml
- /data/data/####/files/permmgr/cb194f07e7c8ef6f33250b4a80bc6c28.dat
- /data/data/####/app_xxx/jdsdkcc
- /data/data/####/files/mda.ico
- /data/data/####/files/permmgr/libjdsdkcc.so
- /data/data/####/app_xxx/qhso
- /data/data/####/shared_prefs/config.xml.bak
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.Ag/Agcr
- /data/data/####/tx_shell/libshella-2.2.9.so
Miscellaneous:
Executes next shell scripts:
- getprop
- getenforce
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.build.version.opporom
- /data/data/####/files/permmgr/libsu.so checkemulator
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.aa.romver
- logcat -d -v threadtime
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.miui.ui.version.name
- chmod 777 /data/data/####/files/.Ag/Agcr
- cat /proc/cpuinfo
- cat /proc/version
- /system/bin/sh -c getprop ro.board.platform
- chmod 777 /data/data/####/files/.Ag
- conbb od2gf04pd9
- rm -r /data/data/####/app_xxx
- chmod 700 /data/data/####/tx_shell/libshella-2.2.9.so
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- cat /sys/class/android_usb/android0/idVendor
- cufsdosck ac554db364f
- getprop ro.board.platform
- cufsmgr eb47495f7bb
- rm -r /data/data/####/files//Data/pp2/
- /system/bin/sh -c getprop ro.lenovo.series
- cat /sys/class/android_usb/android0/idProduct
- rm -r /data/data/####/files//permmgr/
- sh
- /system/bin/sh -c getprop ro.build.version.emui
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
