Android.DownLoader.3563

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Mobikok.1.origin
Android.RemoteCode.110.origin
Android.Xiny.197
Android.Xiny.244.origin

Downloads the following detected threats from the Web:

Android.Xiny.197

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) www.4g####.net:80
TCP(HTTP/1.1) linking####.com:80
TCP(HTTP/1.1) c####.clouds####.com:80
TCP(HTTP/1.1) dy.vs####.net:80
TCP(HTTP/1.1) p####.lead####.com:80
TCP(HTTP/1.1) ssp.bb####.com:80
TCP(HTTP/1.1) www.bigt####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) dw.vs####.net:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) v####.google####.com:80
TCP(SSL/3.0) digital####.com:443
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) digital####.com:443
TCP(TLS/1.0) sdk.adti####.com:443

DNS requests:

ali.f####.cdn.####.com
api.bi####.com
api.ki####.com
artul####.com
c####.clouds####.com
digital####.com
dw.vs####.net
dy.vs####.net
ea.sno####.1####.com
en.sno####.1####.com
ilv####.com
int.d####.s####.####.cn
linking####.com
p####.lead####.com
p####.lead####.com
sdk.adti####.com
ssp.bb####.com
v####.google####.com
www.4g####.net
www.bigt####.com

HTTP GET requests:

ali.f####.cdn.####.com/20180205095758-snowfox_v19n155c.jar
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####&type=####
api.ki####.com/express?tid=####
c####.clouds####.com/redirect?id=####&subpub=####&aff_sub1=####
dw.vs####.net/static/jar/2018-03-19/jar_fbc21e48-821d-4554-95c8-369ef7e2...
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
linking####.com/cur/smartlinkblock.html
linking####.com/linker/?mob=####&tid=XHk####
p####.lead####.com/?m=####&pubid=####
ssp.bb####.com/upload/20170929/20170929163115669320x480.jpg
tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
tretras####.com/portent/netbios/acl/1-2361-b5525567f226123874dfb95aaad24...
www.4g####.net/ad/adu?gffw=####&frrw=####&zfbd=####&dlkvv=####&wdazz=###...

HTTP POST requests:

api.bi####.com/un
dy.vs####.net/dynamic/init.do
dy.vs####.net/dynamic/jarDownBack.do
dy.vs####.net/dynamic/jarInit.do
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/regclient
en.sno####.1####.com:8088/ping
en.sno####.1####.com:8088/sdk/api/checklib
en.sno####.1####.com:8088/sdk/api/log/record
en.sno####.1####.com:8088/sdk/api/regclient
v####.google####.com/api/o
v####.google####.com/api/va
www.4g####.net/ad/adc?gffw=####&frrw=####&zfbd=####&dlkvv=####&wdazz=###...
www.bigt####.com/ad/adc?gffw=####&frrw=####&zfbd=####&dlkvv=####&wdazz=#...

Modified file system:

Creates the following files:

/data/data/####/-5317238
/data/data/####/-5317238.data
/data/data/####/0b5129f76da31956bcceb8a6ac9f346f.0.tmp
/data/data/####/0b5129f76da31956bcceb8a6ac9f346f.1.tmp
/data/data/####/32bc59b8e5673590cf70f28d9239dfe4.0.tmp
/data/data/####/32bc59b8e5673590cf70f28d9239dfe4.1.tmp
/data/data/####/9214969851bd2b3e13a2a159d7d3bdfd.0.tmp
/data/data/####/9214969851bd2b3e13a2a159d7d3bdfd.1.tmp
/data/data/####/DEAB89CE10FEAA11
/data/data/####/MobikokConfig_Type_1.xml
/data/data/####/MobikokConfig_Type_1.xml.bak
/data/data/####/SpZvPrefs.xml
/data/data/####/VsoYouSdkTool.xml
/data/data/####/appKey.xml
/data/data/####/appshell.xml
/data/data/####/bb.jar
/data/data/####/com.tanggu.game_preferences.xml
/data/data/####/d6c7db302023c8dbfa68dab33b7bf93e.0.tmp
/data/data/####/d6c7db302023c8dbfa68dab33b7bf93e.1.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db_snowfox.db
/data/data/####/db_snowfox.db-journal
/data/data/####/e757af6f0cb7f79f77e1afffc26d113a.0.tmp
/data/data/####/e757af6f0cb7f79f77e1afffc26d113a.1.tmp
/data/data/####/easv.data-journal
/data/data/####/index
/data/data/####/isupdate.xml
/data/data/####/journal.tmp
/data/data/####/lib_v19n.dat
/data/data/####/local_storage0.xml
/data/data/####/local_storage1.xml
/data/data/####/local_storage33.xml
/data/data/####/local_storage999.xml
/data/data/####/mesosphere_v19n.jar
/data/data/####/settings.xml
/data/data/####/snowfox_v19n.jar
/data/data/####/snowfoxad_msg.db
/data/data/####/snowfoxad_msg.db-journal
/data/data/####/snowfoxprf.xml
/data/data/####/sp.xml
/data/data/####/sp.xml.bak
/data/data/####/sp_cache.xml
/data/data/####/vok2v.o
/data/data/####/w2g6c1f3x0.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/dev_a0b1a0c9.txt
/data/media/####/imei.txt
/data/media/####/jar_fbc21e48-821d-4554-95c8-369ef7e23223.tmp
/data/media/####/ua.dat

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
cat /sys/class/net/wlan0/address

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
DESede

Uses the following algorithms to decrypt data:

AES
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DESede

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial