Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.572.origin
Downloads the following detected threats from the Web:
- Android.DownLoader.572.origin
Network activity:
Connecting to:
- a####.####.in
- d3656q1####.####.net
- e####.####.in
- trac####.####.com
HTTP GET requests:
- a####.####.in/interface/vsupdate_hk.php?vers=####&cid=####&qid=####&uid=...
- d3656q1####.####.net/sail732.so
- e####.####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&chu...
- trac####.####.com/warning.html?err=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/temp331728624.so
- <Package Folder>/databases/####/file__0.localstorage-journal (deleted)
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/btsailer.apk
- <Package Folder>/files/sail732.so
- <Package Folder>/shared_prefs/Argolisten.xml
- <Package Folder>/shared_prefs/jihuos.xml
- <Package Folder>/shared_prefs/shazi.xml
- <Package Folder>/shared_prefs/userconfig.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
