Android.Packed.21238

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.166.origin
Android.Xiny.72.origin
Android.Hmad.2
Android.Xiny.165.origin
Android.Rootkit.5.origin
Android.Xiny.164.origin
Android.Triada.74.origin
Android.Xiny.71.origin
Android.Xiny.73.origin
Android.Hmad.7.origin
Android.Backdoor.333.origin

Removes its shortcut from the home screen.

Network activity:

Connecting to:

p####.####.com:8080
4####.####.161
4####.####.163
4####.####.48
g####.####.com
wee####.com:8081
4####.####.251
4####.####.160
4####.####.240
p####.####.com
4####.####.188
q####.####.com:8092
woo####.com:7077
r####.####.com
c####.####.com
f####.####.com:7012
cca####.com
inter####.####.com
k####.####.com
4####.####.176
wee####.com

HTTP GET requests:

4####.####.251/admin201506/uploadApkFile/rt/20170113/ge51.data
4####.####.240/admin201506/uploadApkFile/rt/20170113/ge61.data
4####.####.160/admin201506/uploadApkFile/rt/20170408/rs40.data
4####.####.176/admin201506/uploadApkFile/rt/20170113/ge45.data
g####.####.com/atmp/ad.png
wee####.com/sm/sr/rt/requestStatus
4####.####.188/admin201506/uploadApkFile/rt/20170412/env201704121250.data
4####.####.251/admin201506/uploadApkFile/rt/20170113/ge58.data
4####.####.48/admin201506/uploadApkFile/20170320/760151922.png
4####.####.163/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
cca####.com/down.php
4####.####.240/admin201506/uploadApkFile/rt/20161230/ym43.data
c####.####.com/upload/apk/superbcleaner2.jpg
4####.####.161/admin201506/uploadApkFile/rt/20161110/ym2.zip
c####.####.com/upload/apk/superbcleaner1.png
4####.####.163/admin201506/uploadApkFile/rt/20160406/ToolboxAndSupolicy....
k####.####.com/download/opacore/xcore2_1.0.3.md
4####.####.176/admin201506/uploadApkFile/rt/20170113/ge23.data
4####.####.188/admin201506/uploadApkFile/rt/20170113/ge44.data
4####.####.176/admin201506/uploadApkFile/rt/20170405/dz_p866.data
f####.####.com:7012/getSSPDownUrl.do?cid=####

HTTP POST requests:

inter####.####.com/newservice/newgetApks.action
inter####.####.com/newservice/newbackDatas.action
p####.####.com:8080/OpaService/OpaStrategy
q####.####.com:8092/active.do?ie=####&ch=####&svs=####&system=####&ua=##...
inter####.####.com/newservice/newjsApk.action
wee####.com/sm/sr/rt/ry
woo####.com:7077/sdk/ss.action?b=####
wee####.com:8081/sm/sr/sy/ly
inter####.####.com/newservice/newopenOrSale.action
p####.####.com/OpaService/OpaMagicCode
wee####.com/sm/sr/run/hy
p####.####.com:8080/OpaService/OpaLogUpload
r####.####.com/rqd/sync

Modified file system:

Creates the following files:

/data/data/####/files/obs.apk
/data/data/####/shared_prefs/xapcinfo.xml
/data/data/####/files/100/1001/170502125847181.apk
/data/data/####/files/Data/pp2/chattr
/data/data/####/shared_prefs/20160121.xml.bak
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/supolicy
/data/data/####/files/txwogn.md
/data/data/####/databases/fp.db-journal
/data/data/####/app_DEX_OPT/87200036.dex
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/forever.sh
/data/data/####/files/100/1003/33245049.apk
/data/data/####/files/Data/pp2/install
/data/data/####/files/armeabi/libmonitor.so
/data/data/####/shared_prefs/Oveead.xml
/data/data/####/app_DEX_OPT/41635547.dex
/data/data/####/shared_prefs/data_statistical.xml
/data/data/####/app_xxx/chattr
/data/data/####/databases/smalldb2-journal
/data/data/####/app_xxx/install-co
/data/data/####/files/suc
/data/data/####/app_xxx/libxapp.so
/data/data/####/files/200/1001/110011Copy.data
/data/data/####/files/.rtt/nis
/data/data/####/databases/webview.db-journal
/data/data/####/databases/rtr.db
/data/data/####/files/100/1003/52872513.apk
/data/data/####/files/su2
/data/data/####/files/.rtt/r1
/data/data/####/files/.rtt/r2
/data/data/####/files/100/1003/ge44.data
/data/data/####/files/.rtt/r4
/data/data/####/databases/bdownloaders.db-journal
/data/data/####/shared_prefs/fpksp.xml.bak
/data/data/####/app_DEX_OPT/0417820.dex
/data/data/####/files/Data/pp2/configopb
/data/data/####/B3384716E5D06AC5FF4ACB1BF2B17B3Ap.sr40/files/forever.sh
/data/data/####/shared_prefs/bugly_data.xml
/data/data/####/files/Data/pp2/install-recovery.sh
/data/data/####/files/abc.apk
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/toolbox1493729936508.zip
/data/data/####/files/xyn.jar
/data/data/####/shared_prefs/flowapp_shared.xml.xml
/sdcard/small/data/image/superbcleaner1.png
/data/data/####/files/100/1003/ge23.data
/data/data/####/files/100/1003/ge58.data
/data/data/####/shared_prefs/20160218.xml.bak
/data/data/####/B3384716E5D06AC5FF4ACB1BF2B17B3Ap.sr40/files/cnVuc2hlbGwy
/data/data/####/app_snex/dkt.jar
/data/data/####/files/Data/pp2/sr
/data/data/####/files/100/1003/ge51.data
/data/data/####/files/.rtt/r3
/data/data/####/files/mda.ico
/data/data/####/app_jni/libskin
/sdcard/APPMarket/AdvSDK/ICON/admin201506/uploadApkFile/20170320/760151922.png.tmp
/data/data/####/files/su
/data/data/####/shared_prefs/fxkit.xml.bak
/data/data/####/app_sgdex/dos.jar
/sdcard/FP.txt
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/install-recovery.sh
/data/data/####/app_DEX_OPT/66211707.dex
/data/data/####/shared_prefs/20160121.xml
/data/data/####/files/100/1003/ym43.data
/data/data/####/app_DEX_OPT/33245049.dex
/data/data/####/files/100/1001/10011.data
/data/data/####/files/armeabi/temp_monitor.so
/data/data/####/shared_prefs/fpksp.xml
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/debuggerd_hulu
/sdcard/Android/data/shard/.UUID
/data/data/####/B3384716E5D06AC5FF4ACB1BF2B17B3Ap.sr40/files/cnVuc2hlbGwy1493729937015.zip
/data/data/####/app_DEX_OPT/99676957.dex
/data/data/####/app_jc/tfx.jar
/data/data/####/AE60F8310E65A451FE9B163FC5E35693p.ym43/files/Wlhod1gzbDFiVjh5
/data/data/####/files/100/1003/66211707.apk
/data/data/####/files/ylsb.db
/data/data/####/shared_prefs/data_statistical.xml.bak
/data/data/####/shared_prefs/20160218.xml
/data/data/####/files/100/1003/tmp.data
/data/data/####/files/100/1003/99676957.apk
/data/data/####/app_xxx/sr
/data/data/####/files/busybox
/data/data/####/fb/cb.zip
/data/data/####/databases/rtr.db-journal
/data/data/####/app_dex/.do
/data/data/####/tx_shell/libshella-2.2.9.so
/data/data/####/files/100/1003/41635547.apk
/data/data/####/app_DEX_OPT/52872513.dex
/data/data/####/app_jc/dfx.jar
/data/data/####/right_core.jar
/data/data/####/files/100/1003/ge61.data
/data/data/####/files/txwogn.jar
/sdcard/small/data/image/superbcleaner2.png
/data/data/####/AE60F8310E65A451FE9B163FC5E35693p.ym43/files/Wlhod1gzbDFiVjh51493729939405.zip
/data/data/####/files/classes.dex
/data/data/####/files/100/1003/dz_p866.data
/data/data/####/databases/fxlock.db-journal
/data/data/####/files/wddex.jar
/data/data/####/shared_prefs/fxkit.xml
/data/data/####/mix.dex
/data/data/####/shared_prefs/fpssp.xml
/data/data/####/app_xxx/install
/data/data/####/files/100/1003/0417820.apk
/data/data/####/files/png.ico
/data/data/####/app_xxx/install-recovery.sh
/data/data/####/app_DEX_OPT/41206477.dex
/data/data/####/AE60F8310E65A451FE9B163FC5E35693p.ym43/files/forever.sh
/data/data/####/app_DEX_OPT/94004605.dex
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/uart_yble_stop
/data/data/####/app_xxx/configopb
/data/data/####/files/psneuter.js
/data/data/####/files/100/1003/41206477.apk
/data/data/####/files/install-recovery.sh
/data/data/####/app_xxx/install-recovery-co.sh
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/toolbox
/data/data/####/files/100/1003/env201704121250.data
/data/data/####/files/200/1001/170502125844983.apk
/data/data/####/app_jc/tfp.jar
/data/data/####/files/100/1003/ge45.data
/data/data/####/files/txwogn.dat
/data/data/####/files/.rtt/chattr
/data/data/####/files/100/1003/87200036.apk
/data/data/####/files/100/1003/rs40.data
/data/data/####/shared_prefs/q.xml
/data/data/####/files/100/1003/48553251.apk
/data/data/####/shared_prefs/fxssp.xml
/data/data/####/files/100/1003/94004605.apk
/data/data/####/app_jc/dfp.jar
/data/data/####/app_DEX_OPT/48553251.dex
/data/data/####/files/100/1001/10011Copy.data
/data/data/####/databases/fx_kit_unlock-journal
/data/data/####/databases/fpdown.db-journal
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/schedtop_bely_usbcharger
/sdcard/.xxx/map.ico
/data/data/####/files/libyhhu.so
/data/data/####/databases/bugly_db_lejiagu-journal
/data/data/####/loader

Sets the 'executable' attribute to the following files:

/data/data/####/tx_shell/libshella-2.2.9.so
/data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/forever.sh
/data/data/####/AE60F8310E65A451FE9B163FC5E35693p.ym43/files/Wlhod1gzbDFiVjh5
/data/data/####/files/.rtt/r1
/data/data/####/files/.rtt/r2
/data/data/####/files/.rtt/r3
/data/data/####/fb/cb.zip
/data/data/####/files/suc

Miscellaneous:

Executes next shell scripts:

/data/data/####/files/suc HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/sh -c getprop ro.meizu.product.model
logcat -d -v time
chmod 0777 /data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/forever.sh
getprop ro.gn.gnromvernumber
chmod 0777 /data/data/####/files/.rtt/chattr
/system/bin/dexopt --dex 27 55 40 234592 /data/data/####/app_jc/fx.jar 1210806895 645475087 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /syst
/system/bin/sh -c getprop ro.miui.ui.version.name
chmod 0777 /data/data/####/files/su
sh /data/data/####/files/suc al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh /data/data/####/files/psneuter.js
/data/data/####/files/.rtt/r1 /data/data/####/files/psneuter.js
/system/bin/sh -c getprop ro.board.platform
getprop ro.build.nubia.rom.name
sh /data/data/####/files/.rtt/r4 -c /data/data/####/files/psneuter.js
/data/data/####/files/.rtt/r2 -c /data/data/####/files/psneuter.js
chmod 700 /data/data/####/tx_shell/libshella-2.2.9.so
uart_yble_stop -c id
/system/bin/dexopt --dex 27 140 40 43652 /data/data/####/files/100/1003/66211707.apk 1235116106 1783187913 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
getprop ro.build.version.opporom
chmod 0777 /data/data/####/files/.rtt/nis
/system/bin/dexopt --dex 27 71 40 367224 /data/data/####/files/200/1001/170502125844983.apk 1215334984 43943279 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework
/system/bin/dexopt --dex 27 149 40 53832 /data/data/####/files/100/1003/87200036.apk 1244437156 -342741343 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
/data/data/####/files/.rtt/r4 -c /data/data/####/files/psneuter.js
getprop ro.lewa.version
/system/bin/dexopt --dex 27 52 40 95752 /data/data/####/fb/cb.zip 1210485263 2020764672 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /system/f
sh /data/data/####/files/suc f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh /data/data/####/files/psneuter.js
chmod 0777 /data/data/####/AE60F8310E65A451FE9B163FC5E35693p.ym43/files/Wlhod1gzbDFiVjh5
/system/bin/sh -c getprop ro.aa.romver
logcat -d -v threadtime
chmod 777 /data/data/####/app_outdex
/system/bin/dexopt --dex 27 100 40 52468 /data/data/####/files/txwogn.jar 1213693520 -1407847611 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar
/system/bin/sh -c getprop ro.lewa.version
chmod 0777 /data/data/####/B3384716E5D06AC5FF4ACB1BF2B17B3Ap.sr40/files/forever.sh
conbb od2gf04pd9
/system/bin/dexopt --dex 27 147 40 53832 /data/data/####/files/100/1003/94004605.apk 1244504384 -622013588 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
/system/bin/dexopt --dex 27 137 40 53832 /data/data/####/files/100/1003/33245049.apk 1244437070 1258458655 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
/system/bin/dexopt --dex 27 57 40 47924 /data/data/####/files/wsh.jar 1244093369 1005593515 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /syst
chmod 777 /data/data/####/files/wsh.jar
/system/bin/sh
chmod 0777 /data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env/files/toolbox
getprop ro.miui.ui.version.name
sh /data/data/####/files/suc HygZRm2IHTKWpp7Hll/sS0uY66xdcw== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/dexopt --dex 27 98 40 191656 /data/data/####/files/100/1001/170502125847181.apk 1214488593 -818594931 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
chmod 0755 /data/data/####/9E01EB6BCDF748C1BBC7D399471672E3com.init.env
/system/bin/sh -c getprop ro.build.fingerprint
chmod 0777 /data/data/####/files/busybox
sh /data/data/####/files/.rtt/r3 -c /data/data/####/files/psneuter.js
getprop ro.build.rom.id
/system/bin/dexopt --dex 27 151 40 45244 /data/data/####/files/100/1003/99676957.apk 1250259339 1992578951 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
uart_yble_stop
getprop ro.yunos.version
getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.vivo.os.build.display.id
.hulu
getprop ro.board.platform
/system/bin/dexopt --dex 27 142 40 53832 /data/data/####/files/100/1003/41635547.apk 1244436676 -773874815 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
chmod 0777 /data/data/####/files/suc
/data/data/####/files/suc f0h5zguZ9aJXbCZExMaN2kDhh6V0Uw== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/sh -c getprop ro.lenovo.series
chmod 0777 /data/data/####/files/psneuter.js
/system/bin/dexopt --dex 27 133 40 53832 /data/data/####/files/100/1003/52872513.apk 1244436945 -602149712 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
getprop ro.build.version.emui
getprop
chmod 0777 /data/data/####/AE60F8310E65A451FE9B163FC5E35693p.ym43/files/forever.sh
/system/bin/sh -c getprop ro.build.version.opporom
chmod 0777 /data/data/####/B3384716E5D06AC5FF4ACB1BF2B17B3Ap.sr40/files/cnVuc2hlbGwy
/system/bin/sh -c getprop ro.build.rom.id
chmod 0777 /data/data/####/files/.rtt/r4
sh /data/data/####/files/.rtt/r1 /data/data/####/files/psneuter.js
getprop ro.aa.romver
chmod 0777 /data/data/####/files/.rtt/r1
chmod 0777 /data/data/####/files/.rtt/r3
chmod 0777 /data/data/####/files/.rtt/r2
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/dexopt --dex 27 56 40 157652 /data/data/####/app_jc/fp.jar 1212386916 1211382907 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /sys
ls -l /system/bin/su
/system/bin/dexopt --dex 27 133 40 58112 /data/data/####/files/100/1003/48553251.apk 1250428534 1556627594 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
sh /data/data/####/files/.rtt/r2 -c /data/data/####/files/psneuter.js
getprop ro.lenovo.series
getprop ro.build.tyd.kbstyle_version
cufsdosck ac554db364f
/system/bin/dexopt --dex 27 126 40 87188 /data/data/####/files/100/1003/0417820.apk 1250714855 -1543012935 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
getprop ro.meizu.product.model
/system/bin/dexopt --dex 27 56 40 292 /data/data/####/mix.dex 1493729923 -49011495 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /system/framew
/system/bin/sh -c getprop ro.build.version.emui
cufsmgr eb47495f7bb
/system/bin/dexopt --dex 27 54 40 13876 /data/data/####/app_sgdex/dos.jar 1200312071 1108093956 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /
getprop ro.vivo.os.build.display.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
sh
/data/data/####/files/.rtt/r3 -c /data/data/####/files/psneuter.js
/data/data/####/files/suc al1s7jBFNtn9faBmC0Jb9A9Ns1GZSg== /system/bin/sh /data/data/####/files/psneuter.js
/system/bin/dexopt --dex 27 144 40 53832 /data/data/####/files/100/1003/41206477.apk 1244437116 -308477755 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial