Android.Packed.19769

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Mixi.13.origin
Android.Triada.226.origin
Android.Triada.151.origin

Network activity:

Connecting to:

v####.####.com
i####.####.com
w####.####.cn
o####.####.com
6####.####.140
d####.####.com
f####.####.com
g####.####.pw
l####.####.com
m####.####.com
i####.####.cn
g####.####.pw:6701
a####.####.com

HTTP GET requests:

l####.####.com/vd/n/channel/img/goto.effe49b4.png
a####.####.com/album/s%3D1600%3Bq%3D90/sign=9e8aa7e3044f78f0840b9ef549013124/4a36acaf2edda3cc19be819706e93901213f922a.jpg
l####.####.com/vd/n/channel/zepto.js
a####.####.com/album/s%3D1600%3Bq%3D90/sign=486ec5ba77cf3bc7ec00c9eae13081d0/730e0cf3d7ca7bcb2521fe98b9096b63f624a82a.jpg
f####.####.com/hunter/alog/alog.mobile.min.js?v=####
d####.####.com/download/jmrx20161118.jar
a####.####.com/album/s%3D900%3Bq%3D90/sign=1a0669bf0bd79123e4e098749d0f28bf/962bd40735fae6cdab0f92d608b30f2443a70fc9.jpg
i####.####.com/ando-res/m/i0r*lg6v0h8-VWU1P*FQdeOi4Rt063q4kkFbwd7Db1IzyTD5msrpwg
m####.####.com/static/searchbox/openjs/share.js?v=####
l####.####.com/vd/??n/chann####
l####.####.com/vd/n/channel/img/play.62151b63.png
l####.####.com/vd/n/channel/img/iconfont.7c63475a.ttf
l####.####.com/vd/n/channel/1.plugin.d403a6d7d174f48cea5d.js
a####.####.com/album/s%3D1600%3Bq%3D90/sign=48ad776b53e736d15c13880eab6074b3/cefc1e178a82b901ba33fa84748da9773812efef.jpg
v####.####.com/platapi/v2/video_list?from=####&rn=####&lid=####&cuid=####&tag=####&bid=55E####&cb_cursor=####&hot_cursor=####&offline_cursor=####&curs...
v####.####.com/?from=####

HTTP POST requests:

g####.####.pw/loadmain.aspx
g####.####.pw/UploadReport.aspx
6####.####.140/ando/x/liv?app_id=####&r=####
g####.####.pw:6701/loadmain.aspx
w####.####.cn/ip.jsp
o####.####.com/check_config_update
i####.####.cn/iplookup/iplookup.php?format=####
a####.####.com/app_logs

Modified file system:

Creates the following files:

/sdcard/sdtmp/id1c547004b-b630-40ef-bbbb-32fb01df58d0.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/mWfrWDqcPhPw8kHd3StxRw==/4qIebFRxtN41O8K1
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/WW5hldVywL7xzBL3MK6MEw==/data.dat.tmp
/sdcard/Android/data/####/cache/uil-images/1724992542.0.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/J-6IDe1fAhEonmxNaBG0rg==
/data/data/####/files/####_cgr
/sdcard/sdtmp/id289b6a1ae-89f8-4b19-9be7-dcfb2f7f0703.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/m9EggHdXLbT9qVaf
/data/data/####/files/hftJcw46N.jar
/data/data/####/app_temp/id
/data/data/####/files/rdata_comodpeqpxv
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/files/us.6n1h5wJmwCNTz1E5Es7gKWR08bdq6
/sdcard/mmt/widegets/data/test.dat3b280fa9-b409-42a5-baca-905c55daf4d6.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/CEYJa1rHuZtUYn9ONqPXWA==
/data/data/####/files/us.9TV6d94xbW054uO7Rk05VsEfT9vaq
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/sdcard/tmpsd11012/test.dat
/data/data/####/cache/webviewCacheChromium/f_000001
/sdcard/sdtmp/id2a86cc6f4-3060-4808-9989-3a07751e6bf5.tmp
/sdcard/sdtmp/id287bfa7fd-402d-4854-bb72-b9ccb872f97c.tmp
/data/data/####/databases/webviewCookiesChromium.db-journal
/sdcard/sdtmp/id2b82cfa71-58e5-415d-8396-1e259a6d5139.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/mWfrWDqcPhPw8kHd3StxRw==/4qIebFRxtN41O8K1.temp
/sdcard/tmpsd11012/test.dat86da8494-c53b-41b5-a660-0e05459839c0.tmp
/sdcard/Android/data/####/cache/uil-images/journal
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/mmt/widegets/data/test.dat53114dc0-4353-439f-a54e-2b951be970a3.tmp
/sdcard/.env/.uunique.new
/data/data/####/files/rdata_comodpeqpxv.new
/data/data/####/files/.imprint
/data/data/####/files/mobclick_agent_cached_####1
/sdcard/mmt/widegets/data/test.dat9b24d8ab-6f3c-48de-b9b8-a487f453c7af.tmp
/sdcard/mmt/widegets/data/test.dat923c81dd-dcbb-42f0-b6d0-bfee9879ed41.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/wOOURyGFNgWqPWyL2mNnIQ==/N4sO2AfzDI8HPVeF.zip
/sdcard/mmt/widegets/data/test.dat0a37e09f-1933-4ae4-9b2f-9ae04105414c.tmp
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/mWfrWDqcPhPw8kHd3StxRw==/T0ndw3lLBxvg1j7Of025Eg==
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/J-6IDe1fAhEonmxNaBG0rg==.new
/sdcard/mmt/widegets/data/test.datcb7caa27-f9bb-4a10-9908-892236b2efd7.tmp
/data/data/####/app_bload_lib/libhelper.so
/sdcard/sdtmp/id114360fa0-aa95-44ee-94d7-21893c15eeb8.tmp
/sdcard/sdtmp/id15c4e706f-cc9c-45a0-98be-fa5aa987675d.tmp
/data/data/####/app_aload_odex/dload.inf
/data/data/####/files/umeng_it.cache
/data/data/####/databases/webview.db-journal
/sdcard/Android/data/####/cache/uil-images/-284444105.0.tmp
/sdcard/mmt/widegets/data/droidinfo-journal
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
/sdcard/mmt/widegets/data/test.dat16377b51-8207-4a98-811a-addec5d5060c.tmp
/sdcard/.uct/uuid3bece4a7c-38d4-43da-894d-0c925615007d.tmp
/sdcard/tmpsd11012/test.dat27ac8bb9-4888-43be-bfa2-52355b865815.tmp
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/shared_prefs/database.xml
/data/data/####/files/us.1St68gT2dj5aYJgGT3T71q1JMKRw4
/data/data/####/files/us.8TKiCIwph10leQjSRopFGFdlUa3z7
/data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
/data/data/####/files/huffbg_d/huffbg_f.zip
/sdcard/tmpsd11012/test.date958d6e8-e75a-46fd-ad59-af8388e562c2.tmp
/sdcard/Android/data/####/cache/.nomedia
/data/data/####/files/HpKPJGAz2XdTxoD9ludn4qrZYX6Rc9Ol/CEYJa1rHuZtUYn9ONqPXWA==.new
/data/data/####/app_aload_odex/coad.apk
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/files/1485418556290_cgr.so
/sdcard/sdtmp/id12bfcc360-b6e3-46f8-afeb-a31f15962d11.tmp
/data/data/####/files/1485418570637_cgr.so
/sdcard/.hand/developkey4ef30235-8e87-448e-b8a1-471797fdfdea.tmp
/data/data/####/cache/webviewCacheChromium/index
/sdcard/Android/data/####/cache/uil-images/journal.tmp
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/sdcard/tmpsd11012/test.dat9fc64c53-ddb5-411c-8af8-dfee80eb2afb.tmp
/data/data/####/files/P3UVtNomVTBmd6rRvjlPqw==/ro-r-2SJjrxowaI9zirj5e_DvNs=
/data/data/####/app_res_out/Jres.apk
/sdcard/mmt/widegets/data/test.datfd89532c-a9ab-463b-9591-5349efae474c.tmp
/sdcard/Android/data/####/cache/uil-images/1307904639
/sdcard/Android/data/####/cache/uil-images/1244065034.0.tmp
/sdcard/mmt/widegets/data/droidinfo

Sets the 'executable' attribute to the following files:

/data/data/####/files/us.9TV6d94xbW054uO7Rk05VsEfT9vaq
/data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
/data/data/####/files/us.6n1h5wJmwCNTz1E5Es7gKWR08bdq6
/data/data/####/files/us.8TKiCIwph10leQjSRopFGFdlUa3z7
/data/data/####/files/us.1St68gT2dj5aYJgGT3T71q1JMKRw4

Miscellaneous:

Executes next shell scripts:

/data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
chmod 0771 /data/data/####/.syslib-
/data/data/####/files/us.8TKiCIwph10leQjSRopFGFdlUa3z7 -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
conbb od2gf04pd9
/data/data/####/files/us.9TV6d94xbW054uO7Rk05VsEfT9vaq -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
/system/bin/.nbwayxwzt
cat /sys/class/net/wlan0/address
/data/data/####/files/us.1St68gT2dj5aYJgGT3T71q1JMKRw4 -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-
ls -l /system/bin/su
/data/data/####/files/us.6n1h5wJmwCNTz1E5Es7gKWR08bdq6 -h 818279fcb22d4593aaeddad93f7d7b4b /data/data/####/.syslib-

Contains functionality to send SMS messages automatically.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial