Android.Packed.32221

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.173.origin
Android.DownLoader.478.origin
Android.Xiny.197
Android.Xiny.220.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) api.info####.me:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) fb.vi####.com:80
TCP(HTTP/1.1) dpl.b####.com:80
TCP(HTTP/1.1) ac.mobilea####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) go.redirec####.com:80
TCP(HTTP/1.1) f####.cdn.1####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) api.mob####.b####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) c.px####.com:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) u####.b####.com:80
TCP(HTTP/1.1) sl####.1####.com:8111
TCP(HTTP/1.1) t####.o####.com:80
TCP(HTTP/1.1) pl####.mob####.b####.com:80
TCP(HTTP/1.1) artul####.com:80
TCP(HTTP/1.1) pic.a####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) digital####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

ac.mobilea####.com
adser####.go####.com
adser####.go####.nl
api.info####.me
api.mob####.b####.com
artul####.com
c####.b####.com
c.px####.com
digital####.com
dpl.b####.com
f####.cdn.1####.com
f####.google####.com
f####.gst####.com
fb.vi####.com
go.redirec####.com
googl####.g.doublec####.net
l.a####.com
mo.freeind####.com
na####.sno####.1####.com
pag####.googles####.com
pic.a####.com
pl####.mob####.b####.com
s####.mob####.b####.com
serv####.m####.com
t####.o####.com
tpc.googles####.com
u####.b####.com
www.admobim####.com
www.mmmmmm####.com
www.technol####.co.uk

HTTP GET requests:

api.info####.me/api/s2s/goto?id=####&channel=####&provider=####&appkey=#...
api.mob####.b####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=...
api.mob####.b####.com/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=#...
artul####.com/26C47/Jvug/KP-w/cLPh4Ar4oFI97EMtlfgaf-WS6pePjzqGBGKBXsn3mb...
dpl.b####.com/M00/01/AD/CvJKDlnfHAeAUmwGABJ8ZVWAJBA0.4.zip
f####.google####.com/css?family=####&ver=####
f####.gst####.com/s/robotoslab/v7/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
fb.vi####.com/?utm_medium=####&utm_campaign=####&cid=####
fb.vi####.com/?utm_term=####&clickverify=####&utm_content=####
fb.vi####.com/proc.php?34ef19c####
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171011/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171011/r20170110/show_ads_impl.js
pic.a####.com/img/t4964v731.png
serv####.m####.com/119987?t=0.6148340932559222&ref=&lu=http://www.techno...
u####.b####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&pro...

HTTP POST requests:

ac.mobilea####.com/detail/getOfferListNew?enc=####
ac.mobilea####.com/detail/getPrStrategy?product=####&adid=####&appVer=##...
api.info####.me/api/ads/connect
api.info####.me/api/ads/fetch?_s=####
api.info####.me/api/ads/vas?_s=####&
l.a####.com/l.php
l.a####.com/sal.php
pl####.mob####.b####.com/ad_dex.php
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
sl####.1####.com:8111/native/api/v1/init
sl####.1####.com:8111/native/api/v1/update
sl####.1####.com:8111/native/sdk/api/ad/client_action
sl####.1####.com:8111/native/sdk/api/regclient
www.mmmmmm####.com/osp/oaen_reg.action

Modified file system:

Creates the following files:

/data/anr/traces.txt
<Package Folder>/.mbj/####/classes.dex
<Package Folder>/.mbj/####/classes.zip
<Package Folder>/app_bin/daemon
<Package Folder>/app_dex20/49.x-5.0.4.dex
<Package Folder>/app_lib2/.atmp9.dex
<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_osdk/adflash_shell.dex
<Package Folder>/app_osdk/adflash_shell.jar
<Package Folder>/app_osdk/t.dex
<Package Folder>/app_osdk/t.zip
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/index
<Package Folder>/databases/adblib.db
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/app.manager
<Package Folder>/databases/app.manager-journal
<Package Folder>/databases/im.database.ad
<Package Folder>/databases/im.database.ad-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/hookfbcode-dex.jar
<Package Folder>/files/adflashcore.jar
<Package Folder>/files/bat_anr_1508036996486
<Package Folder>/files/google.db
<Package Folder>/files/t.jar
<Package Folder>/shared_prefs/<Package>_ls_global_configs_sp.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak (deleted)
<Package Folder>/shared_prefs/MO.xml
<Package Folder>/shared_prefs/adflash.xml
<Package Folder>/shared_prefs/adflash.xml.bak
<Package Folder>/shared_prefs/adflash_taboola.xml
<Package Folder>/shared_prefs/ak.native.sdk.xml
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/aps_muti.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/arrkiiad.xml
<Package Folder>/shared_prefs/batsdk_app_life.xml
<Package Folder>/shared_prefs/batsdk_crash_switch.xml
<Package Folder>/shared_prefs/batsdk_user_info.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/s_sdk_pro_pref.xml
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/settingsLog.xml.bak
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/v71.xml
<Package Folder>/shared_prefs/v71.xml.bak
<Package Folder>/shared_prefs/video_manager_config.xml
<SD-Card>/.androidsystem/####/49.x-5.0.4.apk
<SD-Card>/.androidsystem/####/PlugShareData
<SD-Card>/.androidsystem/####/plugxml.xml
<SD-Card>/.androidsystem/Plugin.zip
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/inapp_dev.txt
<SD-Card>/LogN/####/sp
<SD-Card>/ad_native/2017-10-15.txt
<SD-Card>/backups/####/.cuid
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/<Package>.monitor.Service2
chmod 700 <Package Folder>/app_bin/daemon
logcat -d -v time
logcat -t 200 -v time
logcat -v time
ls -l /system/bin/su
mars_d -p <Package> -s <Package>.monitor.Service2 -p1r 39 -p1w 40 -p2r 41 -p2w 42

Loads the following dynamic libraries:

daemon_api20

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial