Android.DownLoader.3271

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.79.origin

Downloads the following detected threats from the Web:

Android.HiddenAds.79.origin

Network activity:

Connecting to:

a####.####.com
a####.####.net
c####.####.com
i####.####.com
n####.####.com
set####.####.com
u####.####.com

HTTP GET requests:

a####.####.com/api/ads/check?app=####&sn=####&os_v=####&md5=####&secret=...
a####.####.net/api/v2/template/get?slot_id=####&update_time=####
c####.####.com/files/92c2a1cb8f28bce81d5bf81fe971a686
i####.####.com/s
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
u####.####.com/ad/sspstat?placementid=####&tu=####&s=####&token=####&adn...

Modified file system:

Creates the following files:

<Package Folder>/app_bin/daemon
<Package Folder>/app_dex/reach-sdk.zip
<Package Folder>/app_dex/reach-sdk.zip.tmp
<Package Folder>/app_tmpdex/reach-sdk.zip
<Package Folder>/cache/####/-515249652-975763097
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/index
<Package Folder>/cache/1478228129219.jar
<Package Folder>/cache/1478228129219.tmp
<Package Folder>/cache/1501850185202_4xrTYlc1cqPAEX1jroaN-Jvr9RdZsDL2iMs_rZQk4LrDvPeaC3dx-XkZvrXqMASd4X1tUeihN5g=w423-h752-n-e7-rw-v2
<Package Folder>/cache/1501850187941_10IsZW7hGkb0y1BaENNoIrQGvRV_OoKS5CglrQ5diclGyHF2VPw9F4hE9Sjpmpe1aHMbwKPlenQ=w128-h128-rw-v2
<Package Folder>/cache/1501850188572_GBhc5vSq2fJRmGBaCqshz04dfOB9bXWCdWOj3PPuBuP7J3rzxJc6PgyxEMQ9zk_WZ-e8etEOTeEw6TLaDlvytX4uyUL6ZjIC6ArI-FnzTZg07khggK8_4FU=w600-h313-n-e7-rw-v2
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ApplicationCache.db-journal (deleted)
<Package Folder>/code_cache/####/<Package>-1.apk.classes-1220816097.zip
<Package Folder>/code_cache/####/<Package>-1.apk.classes-545972736.zip
<Package Folder>/databases/####/https_googleads.g.doubleclick.net_0.localstorage-journal
<Package Folder>/databases/####/https_googleads.g.doubleclick.net_0.localstorage-journal (deleted)
<Package Folder>/databases/app.manager-journal
<Package Folder>/databases/ararat-journal
<Package Folder>/databases/filter-journal
<Package Folder>/databases/google_app_measurement_local.db
<Package Folder>/databases/google_app_measurement_local.db-journal
<Package Folder>/databases/mobvista.msdk.db-journal
<Package Folder>/databases/reach.database.ad-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/1501850168689
<Package Folder>/files/####/1501850174979
<Package Folder>/files/####/1501850175120
<Package Folder>/files/####/1501850175277
<Package Folder>/files/####/1501850175291
<Package Folder>/files/####/1501850175305
<Package Folder>/files/####/1501850175980
<Package Folder>/files/####/1501850179978
<Package Folder>/files/####/1501850180077
<Package Folder>/files/####/1501850180578
<Package Folder>/files/####/1501850180582
<Package Folder>/files/####/1501850180589
<Package Folder>/files/####/1501850180608
<Package Folder>/files/####/1501850180620
<Package Folder>/files/####/1501850180703
<Package Folder>/files/####/1501850180872
<Package Folder>/files/####/1501850180901
<Package Folder>/files/####/1501850180910
<Package Folder>/files/####/1501850182145
<Package Folder>/files/####/1501850182146
<Package Folder>/files/####/1501850182148
<Package Folder>/files/####/1501850182152
<Package Folder>/files/####/1501850182156
<Package Folder>/files/####/1501850182160
<Package Folder>/files/####/1501850182300
<Package Folder>/files/####/1501850183176
<Package Folder>/files/####/1501850183180
<Package Folder>/files/####/1501850183213
<Package Folder>/files/####/1501850183679
<Package Folder>/files/####/1501850184060
<Package Folder>/files/####/1501850184076
<Package Folder>/files/####/1501850184104
<Package Folder>/files/####/1501850185056
<Package Folder>/files/####/1501850185058
<Package Folder>/files/####/1501850185088
<Package Folder>/files/####/1501850185093
<Package Folder>/files/####/1501850185114
<Package Folder>/files/####/1501850185130
<Package Folder>/files/####/1501850185146
<Package Folder>/files/####/1501850185158
<Package Folder>/files/####/1501850185164
<Package Folder>/files/####/1501850187956
<Package Folder>/files/####/1501850187958
<Package Folder>/files/####/1501850187984
<Package Folder>/files/####/1501850187990
<Package Folder>/files/####/1501850187999
<Package Folder>/files/####/1501850188564
<Package Folder>/files/####/1501850188569
<Package Folder>/files/####/1501850188572
<Package Folder>/files/####/1501850188574
<Package Folder>/files/####/1501850188576
<Package Folder>/files/####/1501850188991
<Package Folder>/files/####/1501850188993
<Package Folder>/files/####/1501850189056
<Package Folder>/files/####/1501850189083
<Package Folder>/files/####/1501850189089
<Package Folder>/files/####/1501850189121
<Package Folder>/files/####/1501850189132
<Package Folder>/files/####/1501850193442
<Package Folder>/files/####/1501850193485
<Package Folder>/files/####/1501850196293
<Package Folder>/files/####/1501850196311
<Package Folder>/files/####/1501850201978
<Package Folder>/files/####/1501850204086
<Package Folder>/files/####/1501850204623
<Package Folder>/files/####/1501850204731
<Package Folder>/files/####/1501850222324
<Package Folder>/files/####/1501850226385
<Package Folder>/files/####/1501850226654
<Package Folder>/files/####/1501850226710
<Package Folder>/files/persisted_config
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/Reach.xml
<Package Folder>/shared_prefs/Reach.xml.bak
<Package Folder>/shared_prefs/TOKEN.xml
<Package Folder>/shared_prefs/admob.xml
<Package Folder>/shared_prefs/admob.xml.bak
<Package Folder>/shared_prefs/appsflyer-data.xml
<Package Folder>/shared_prefs/appsflyer-data.xml.bak
<Package Folder>/shared_prefs/ararat.xml
<Package Folder>/shared_prefs/com.cootek.tark.active_statistic.xml
<Package Folder>/shared_prefs/com.cootek.tark.identifier.preferences.xml
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
<Package Folder>/shared_prefs/cross_settings.xml
<Package Folder>/shared_prefs/ct_default.xml
<Package Folder>/shared_prefs/history_new.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/present_global_params.xml
<Package Folder>/shared_prefs/present_global_params.xml.bak
<Package Folder>/shared_prefs/push_history_manager.xml
<Package Folder>/shared_prefs/settings.xml
<Package Folder>/shared_prefs/settings.xml.bak
<Package Folder>/shared_prefs/share_date.xml
<Package Folder>/shared_prefs/share_date.xml.bak
<Package Folder>/shared_prefs/token_recommendchannel.xml
<Package Folder>/shared_prefs/token_recommendchannel.xml.bak
<Package Folder>/shared_prefs/usage_setting.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/journal.tmp

Miscellaneous:

Executes next shell scripts:

chmod 700 <Package Folder>/app_bin/daemon
mars_d -p <Package> -s <Package>.bbase.BBaseDaemonService -p1r 40 -p1w 41 -p2r 42 -p2w 43

Loads the following dynamic libraries:

daemon_api20

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial