AdLibrary:Generisk

3 engines detected this file
SHA-256	dde3d2a2162c728579475a2913e453619e3acb3aaf4c40e4bb80b76b6c875f64
File name	base.apk
File size	24.85 MB
Last analysis	2018-01-16 14:51:48 UTC
Detection
Details
Relations
Behavior
Community

DrWeb

Android.DownLoader.679.origin

Symantec Mobile Insight

AdLibrary:Generisk

Trustlook

Android.Malware.General

-----------------

Android.RemoteCode.127.origin

Added to Dr.Web virus database:	2018-01-17
Virus description was added:	2018-01-17
SHA1:

    80b86b0f07e1136e26d7fa2a32edc2cb350638ae
    798c2ac391ff8d566ba01be1dd784d474aef843e
    b21179ac556f67500c023375c8f7118d00abd33b
    1c87a5646a8416c63a3f46436aad70acdfd2e96b
    96e98103f7b9a417c73fab98cc10f86d61677f95
    7d98c8d2f069696de96baf5f229ad0cc4adcc864
    8ea63ac78e719de757a0368de8a3fcfce3128b53
    d6d3a6009e886630e892ded6fa5d984669aa347a
    fe874c15147f18bdbac51adefbe6f72aede5ca4c
    70d8dc3077f5a793e45522cf36ea0eb6bafe5132
    782e68113c59bbd5a9c29aeb89c55fc97a7fdca1
    d00104160c1b49eeba096d06c919497aabb2f348
    c1fd29723e7f3680abf617b1b303454a6dc4b174
    f1e840fc7cc9fe31412e6eec911eadc0724bc77e
    d32c71b5dd70e65e5063edc6a748e292e2f30be1
    415918324dc12f569d08f2b2bc3541a7f0e89786
    7812cc65e892318924ed5047c2343d5285776656
    17814586a220c3c8161bba88207cbb32eb904dd8
    fc2853bd0148aadb0319a8cc156ba4f44cfccba6
    47ff84252d2ab71e2ce3bf5f746a6637991f51fe
    f3eccae75e8359748e6cddeacf048b8561b8288e
    8d92758f8597a2cb2e4dadbe1fdea26d8def6437
    661cdb32d08eba55d4d5201735347b5bbf962ff1
    b7da8a34b13181804d7725f461f061536a0b74aa
    bdac7863f3de3af3e91ce0082b921043e6dc07ca
    f8e84cc7d493bba61b8acd5bb062166f22d05bb4
    5454b1a2272811f3efc5c9f6e4c1654459af06a4
    ae4b467d8aa9a4866ea70d91c9149b307ea3e4b4

A Trojan for Android included in SDK 呀呀云 (Ya Ya Yun). It is used in software development. This SDK provides users with an opportunity to exchange text, voice and video messages. The main purpose of Android.RemoteCode.127.origin is a covert download and launch of additional malicious modules.

Launch of Android.RemoteCode.127.origin depends on the method used by a developer to initialize SDK in their application. Usually it happens when the program is launched either in the Application class, or in any of its Activities. Once launched, the Trojan sends a request to the C&C server https://hs.***bao.com/get (in some modifications it is http://hs.***vv.info:9800/get) which looks the following way:

{
"operatorType":"",
"model":"Philips_S307",
"osVersion":"4.4.2",
"appId":"1001305",
"vendor":"Philips",
"imei":"********0006551",
"androidId":"********743b4627",
"connectionType":"WIFI",
"mac":"**:**:**:81:77:dc",
"requestType":"jar",
"osType":1,
"ip":"***.***.137.136",
"sdkVersion":"1.0.3",
"appVersion":"1.8",
"longitude":"",
"latitude":"",
"imsi":"",
"uuid":"************4807a86dac9556ff07de",
"idfa":""
}

In addition, if an application with the Trojan SDK has privileges to determine coordinates, the request gets an indication of the last known location of the infected device.

In return, the server can send to the malicious program a task which looks the following way:

{
"result":0,
"msg":null,
"tasks":[
 "tasks":[
{
"id":356,
"scriptType":null,
"type":0,
"binUrl":" " https://v.***aya.cn/core_xd_356 ,
"md5":"92801af38f6dfe38fbb8b63748006deb",
"className":"com.x.d.core.service",
"function":"main",
"functionParam":null,
"shell":"",
"pkage":"",
"exeDelay":0,
"scheduleTime":null,
"cancel":null,
"partnerId":null,
"countLimitType":2,
"binNumber":"leyou",
"taskType":1,
"activity":null,
"taskFlag":0,
"msgId":"********f6a7f20cbe2499cf"
}
]
}

It has a link to download one of the malicious modules, for example Android.RemoteCode.126.origin. After the download, the module is launched using the DexClassLoader class.