Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) cg####.com:80
DNS requests:
- cg####.com
HTTP POST requests:
- cg####.com/admin/hr/pu//pu.php?do=####
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/files/10_d20171116122811.json
- <Package Folder>/files/10_d20171116122811.jsonx
- <Package Folder>/files/10_d20171116122816.json
- <Package Folder>/files/10_d20171116122816.jsonx
- <Package Folder>/files/10_d20171116122818.json
- <Package Folder>/files/10_d20171116122818.jsonx
- <Package Folder>/files/20_d20171116122811.json
- <Package Folder>/files/20_d20171116122811.jsonx
- <Package Folder>/files/20_d20171116122816.json
- <Package Folder>/files/20_d20171116122816.jsonx
- <Package Folder>/files/20_d20171116122818.json
- <Package Folder>/files/20_d20171116122818.jsonx
- <Package Folder>/files/80_d20171116122810.txt
- <Package Folder>/files/80_d20171116122810.txtx
- <Package Folder>/files/80_d20171116122811.txt
- <Package Folder>/files/80_d20171116122816.txt
- <Package Folder>/files/80_d20171116122818.txt
- <Package Folder>/files/90_d20171116122811.json
- <Package Folder>/files/90_d20171116122811.jsonx
- <Package Folder>/files/90_d20171116122816.json
- <Package Folder>/files/90_d20171116122816.jsonx
- <Package Folder>/files/90_d20171116122818.json
- <Package Folder>/files/90_d20171116122818.jsonx
- <Package Folder>/files/a0_d20171116122811.json
- <Package Folder>/files/a0_d20171116122811.jsonx
- <Package Folder>/files/a0_d20171116122816.json
- <Package Folder>/files/a0_d20171116122816.jsonx
- <Package Folder>/files/a0_d20171116122818.json
- <Package Folder>/files/a0_d20171116122818.jsonx
- <Package Folder>/files/f3_d20171116122811.zip
- <Package Folder>/files/f3_d20171116122816.zip
- <Package Folder>/files/f3_d20171116122818.zip
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/su -c cd /
- /system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122810.txt
- /system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122811.txt
- /system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122816.txt
- /system/bin/su -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122818.txt
- cat /proc/self/status | grep Cap
- cd /
- id
- ls acct cache config d data default.prop dev etc file_contexts init init.rc init.superuser.rc init.trace.rc init.usb.rc init.x86.rc lib mnt proc property_contexts sbin sdcard seapp_contexts selinux sepolicy storage sys system ueventd.android_x86.rc ueventd.rc vendor x86.prop -R -a -l
- sh -c cd /
- sh -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122811.txt
- sh -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122816.txt
- sh -c ls * -R -a -l >> <Package Folder>/files/80_d20171116122818.txt
Uses the following algorithms to encrypt data:
- AES
Uses elevated priveleges.
Gains access to information about accounts (Google, Facebook, etc.) registered on the device.
Adds tasks to the system scheduler.
Gains access to information about incoming/outgoing calls.
Gains access to information about sent/received SMS messages.
