Android.Packed.21761

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Mixi.16.origin
Android.Mixi.13.origin

Network activity:

Connecting to:

t####.####.com
u####.####.com
g####.####.com
h####.####.com
p####.####.com
wap####.####.com
l####.####.com
t####.####.cn

HTTP GET requests:

wap####.####.com/static/appsapi/conf/config.txt?cdnversion=####&tpl=####...
g####.####.com/cr/sdk/goplaysdk_statistics_method.dat
u####.####.com/v1/root/ml?appkey=####&timestamp=####&sign=####
t####.####.cn/ggjc/update/20150803/1c2b85df63733ecb19c6babf674b4671-2015...

HTTP POST requests:

g####.####.com/cr/sv/getEPList
p####.####.com/antispam/1.0/scan_sms?auth_ver=####&appkey=####&nonce=###...
u####.####.com/v1/root/slg?appkey=####&timestamp=####&sign=####
p####.####.com/api/tokens?tk=####&sv=####
p####.####.com/api/data?token=####&tk=####&sv=####
h####.####.com/app.gif
l####.####.com/sdk.php
t####.####.com/2.0/cu?auth_ver=####&appkey=####&nonce=####&model=####&is...
u####.####.com/v1/report?appkey=####&timestamp=####&sign=####&msg_id=####
l####.####.com/offline_loc

Modified file system:

Creates the following files:

<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-546439907.zip
/data/anr/traces.txt
<Package Folder>/databases/z-journal
<Package Folder>/shared_prefs/sapi_system.xml
<Package Folder>/shared_prefs/DianxinDXB.xml.bak
<Package Folder>/databases/traffic_analyer.db-journal
<Package Folder>/shared_prefs/settings.xml
<Package Folder>/PreExcuModsInfo.txt
<Package Folder>/shared_prefs/sapi_system.xml.bak
<Package Folder>/shared_prefs/traffic_analyer.xml.bak
<Package Folder>/databases/app_control.db-journal
<Package Folder>/shared_prefs/antispam_settings.xml
<Package Folder>/ReadyHost.txt
<Package Folder>/shared_prefs/authority.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/databases/al_events.db-journal
<Package Folder>/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe
<Package Folder>/files/pub_lstime
<Package Folder>/shared_prefs/rt.xml
<Package Folder>/XmSmLockFile.txt
<Package Folder>/shared_prefs/qbsdk_prefs.xml
<Package Folder>/databases/appinfo.db-journal
<Package Folder>/app_file_odex/MasterControl.dex
<Package Folder>/databases/traffic_analyer.db
<Package Folder>/shared_prefs/FirstInSP.xml
<Package Folder>/shared_prefs/ye_db_configs.xml
<Package Folder>/shared_prefs/zeuscfg.xml.bak
<Package Folder>/shared_prefs/home_activity_prefs.xml.bak
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/nettimes.xml.bak
<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes1808860731.zip
<Package Folder>/files/1495006111925_cgr.so
<Package Folder>/databases/message_box_list.db
<Package Folder>/shared_prefs/card.xml
<Package Folder>/shared_prefs/floatwindow.xml
<Package Folder>/shared_prefs/diagnostic.xml.bak
<Package Folder>/databases/root_unfinish_transaction.db
<Package Folder>/databases/z
<Package Folder>/shared_prefs/netflow_config.xml
<Package Folder>/shared_prefs/FirstInSP.xml.bak
<Package Folder>/files/CeEqXfp3u.jar
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/databases/al_events.db
<Package Folder>/databases/antispam.db
<Package Folder>/files/autocorrect.dat
<Package Folder>/files/bp-4.0-arm.src
<Package Folder>/shared_prefs/utils.xml
<Package Folder>/databases/apkdownloader.db-journal
<Package Folder>/databases/message_box_list.db-journal
<Package Folder>/shared_prefs/nettimes.xml
<Package Folder>/shared_prefs/safe_upgrade_prefs.xml
<Package Folder>/files/traffic_analyer
<Package Folder>/shared_prefs/relational_recom_prefs.xml
<Package Folder>/shared_prefs/apkdownloaderlib.xml
<Package Folder>/shared_prefs/DianxinDXB.xml
<Package Folder>/shared_prefs/zeuscfg.xml
<Package Folder>/app_file_dex/MasterControl.jar
<Package Folder>/shared_prefs/home_activity_prefs.xml
<Package Folder>/databases/app_control.db
<Package Folder>/shared_prefs/imconfg.xml
<Package Folder>/files/daemon
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/process_white_list.txt
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/diagnostic.xml
<Package Folder>/databases/antispam.db-journal
<Package Folder>/databases/root_unfinish_transaction.db-journal
<Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes2.dex
<Package Folder>/shared_prefs/paysecurity_prefs.xml
<Package Folder>/shared_prefs/paysecurity_prefs.xml.bak
<Package Folder>/shared_prefs/daemon.xml
<Package Folder>/shared_prefs/ye_alarm_configs.xml
<Package Folder>/shared_prefs/appmgr.xml
<Package Folder>/shared_prefs/msg_pref.xml
<Package Folder>/shared_prefs/appmgr_updates.xml
<Package Folder>/files/1495006115627.jar
<Package Folder>/shared_prefs/notification_mgr_config.xml
<Package Folder>/shared_prefs/antispam_settings.xml.bak
<Package Folder>/shared_prefs/traffic_analyer.xml
<Package Folder>/files/bp10
<Package Folder>/databases/apkdownloader.db

Miscellaneous:

Executes next shell scripts:

getenforce
/system/bin/bp10 --check-version
/data/data/####/files/us.T9956SiG7fmmmf8Tr93uW2ZFu9Tsf -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
sh <Package Folder>/files/us.PN1fU8GSNHq2u5c5bxT46crLenRwv -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
chmod 0771 <Package Folder>/.syslib-
sh <Package Folder>/files/bp10 --check-version
sh -c /system/usr/toolbox rm -f <Package Folder>/files/CeEqXfp3u.dex > /dev/null 2>&1
chmod 755 <Package Folder>/files/bp10
su -v
/system/bin/cat /sys/block/mmcblk3/device/cid
/system/bin/cat /proc/meminfo
/data/data/####/files/us.G1Icct2e3P9Z18J86Mpu25SKbzuum -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
sh <Package Folder>/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
sh <Package Folder>/files/us.2k067773g8d3vgFeimWJ3tWG5Y4FW -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
chmod 0771 /data/data/####/.syslib-
/data/data/####/files/us.2k067773g8d3vgFeimWJ3tWG5Y4FW -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
/data/data/####/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
/data/data/####/files/us.PN1fU8GSNHq2u5c5bxT46crLenRwv -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
/system/bin/cat /sys/block/mmcblk2/device/cid
sh <Package Folder>/files/us.L9tpKgam9zy6Sxyt3Lz2I87NOpvuf -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
/system/bin/cat /sys/block/mmcblk0/device/cid
sh -c /system/usr/toolbox rm -f <Package Folder>/files/CeEqXfp3u.jar > /dev/null 2>&1
/system/bin/cat /sys/block/mmcblk1/device/cid
chmod 755 /data/data/####/files/bp10
daemon
<error:2>
/data/data/####/files/bp10 --check-version
sh <Package Folder>/files/us.G1Icct2e3P9Z18J86Mpu25SKbzuum -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.KHw2onOKPX1PXeNA6yjecl8IrzQwe > /dev/null 2>&1
/data/data/####/files/us.L9tpKgam9zy6Sxyt3Lz2I87NOpvuf -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
<dexopt>
sh <Package Folder>/files/us.T9956SiG7fmmmf8Tr93uW2ZFu9Tsf -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-

Uses elevated priveleges.

Contains functionality to send SMS messages automatically.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial