Android.Packed.32905

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.463.origin
Android.DownLoader.603.origin
Android.Loki.10.origin
Android.Loki.15.origin
Android.Mixi.16.origin
Android.Mixi.21.origin
Android.Xiny.73.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
TCP(HTTP/1.1) d.billyaf####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) r####.adsb####.com:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) m####.trk####.com:80
TCP(HTTP/1.1) char####.com:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) a####.w####.in:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) atracki####.appf####.com:80
TCP(HTTP/1.1) newrota####.com:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) thiscli####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) mtrac####.com:80
TCP(HTTP/1.1) a####.bay####.com:80
TCP(HTTP/1.1) 45.79.1####.230:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) e####.w####.in:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) i####.ki####.com:80
TCP(HTTP/1.1) c####.lab####.com:80
TCP(HTTP/1.1) hy####.com:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) tango####.com:80
TCP(HTTP/1.1) koolmed####.com:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) c.secure####.com:80
TCP(HTTP/1.1) cpgnrot####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) s####.g.doublec####.net:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) billmsc####.com:443
TCP(TLS/1.0) p####.go####.com:443
TCP(TLS/1.0) pre####.com:443
TCP(TLS/1.0) sconten####.xx.f####.net:443

DNS requests:

a####.bay####.com
a####.w####.in
adser####.go####.com
adser####.go####.nl
ak.icec####.org
api.bi####.com
api.ki####.com
atracki####.appf####.com
billmsc####.com
c####.lab####.com
c.secure####.com
char####.com
cpgnrot####.com
d####.zhuo####.com
d.billyaf####.com
d3656q1####.cloudf####.net
down####.zhuo####.com
e####.w####.in
f####.google####.com
f####.gst####.com
googl####.g.doublec####.net
gp.lik####.com
gp.miaoxi####.com
h####.b####.com
hy####.com
i####.ki####.com
ilv####.com
j.bay####.com
koolmed####.com
l.a####.com
lh3.googleu####.com
m####.trk####.com
mtrac####.com
newrota####.com
p####.a####.com
p####.go####.com
pag####.googles####.com
pm.zhuo####.com
pre####.com
rt.hm####.com
s####.g.doublec####.net
sconten####.xx.f####.net
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
serv####.m####.com
sh.penc####.com
ssl.gst####.com
st####.xx.f####.net
tango####.com
thiscli####.com
tpc.googles####.com
www.face####.com
www.go####.com
www.google-####.com
www.gst####.com
www.koapk####.com
www.okyes####.com
www.technol####.co.uk
www.technol####.net
www.trac####.site

HTTP GET requests:

a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
char####.com/get/iad/1-4100-66772b841831f85bdc649f674c80e789?cl=####
d####.zhuo####.com/Api/getPlayBanner?titleId=####&packId=####&language=#...
d####.zhuo####.com/Api/getStartFigure?packId=####
d####.zhuo####.com/Api/playGift?titleId=####&packId=####
e####.w####.in/interface/mothdnew.php?subid=####&pjid=####&uid=####&Imsi...
e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
f####.google####.com/css?family=####&ver=####
f####.gst####.com/s/lato/v14/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4...
f####.gst####.com/s/robotoslab/v7/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
gpup####.b0.a####.com/cr/sdk/dynV17041701D/des_dyV17041701Dj1so32.zip
m####.trk####.com/?utm_medium=####&utm_campaign=####&1=####&cid=####
m####.trk####.com/?utm_term=####&clickverify=####&utm_content=####
m####.trk####.com/proc.php?76abcb4####
p####.a####.com/img/bdar40641.png
pag####.googles####.com/pagead/gen_204?id=####&c=####&wpc=####&warn=####...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171021/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171021/r20170110/show_ads_impl.js
r####.adsb####.com/c/140a6455137922f3?c1=####&c2=####&c3=####&_uu=####
serv####.m####.com/119987?t=0.9669518489390612&ref=&lu=http://www.techno...
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...

HTTP POST requests:

api.bi####.com/un
d####.zhuo####.com/Api/playDetail
e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
gp.lik####.com/cr/sv/getEPList
i####.ki####.com/express
i####.ki####.com/jar
i####.ki####.com/u
l.a####.com/pv.php
l.a####.com/sal.php
www.koapk####.com:8081/sm/sr/rt/ry
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...

Modified file system:

Creates the following files:

<Package Folder>/app_indicators/indicator_d
<Package Folder>/app_indicators/indicator_p
<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_0 (deleted)
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_1 (deleted)
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_2 (deleted)
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/data_3 (deleted)
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index (deleted)
<Package Folder>/cache/intel-1676682703.txt
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/mobikokdload.db
<Package Folder>/databases/mobikokdload.db-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/http_www.technologycraze.co.uk_0.lo...ournal
<Package Folder>/files/####/ntmp20722235
<Package Folder>/files/####/plug_2.jar
<Package Folder>/files/####/plug_3.jar
<Package Folder>/files/####/plug_3.jar (deleted)
<Package Folder>/files/####/test
<Package Folder>/files/1508932110892_dyV17041701Dj1so32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/IlvGNfLeLnXWQUZjdynamicloader.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1508932108480
<Package Folder>/files/bb.jar
<Package Folder>/files/bb.jar (deleted)
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/ehkdbiDtwbaGbOOydaemon.so
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libcuid.so
<Package Folder>/files/libiXCCVhYUvWYjNhMlbootstrap.so
<Package Folder>/files/mingsk
<Package Folder>/files/mobikokJarDecMd5File
<Package Folder>/files/mobikokJarEntityFile
<Package Folder>/files/pPSqBZtGDOsuTyItstub.jar
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/sail747.so
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/wokuai.apk
<Package Folder>/files/xnPqJGuLCADgDtbpsa.jar
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/Argolisten.xml
<Package Folder>/shared_prefs/MashupGroupSaleFile_Type_4.xml
<Package Folder>/shared_prefs/MobikokCache_Type_4.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml (deleted)
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml.bak
<Package Folder>/shared_prefs/MobikokConfig_Type_4.xml.bak (deleted)
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml.bak
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/jihuos.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/settingsLog.xml.bak
<Package Folder>/shared_prefs/userconfig.xml
<Package Folder>/shared_prefs/userconfig.xml.bak
<SD-Card>/.salvia/<Package>
<SD-Card>/APPMarket/####/122190031.png.tmp
<SD-Card>/APPMarket/####/5202496.apk
<SD-Card>/Android/####/715119f29f736652abd3f673bc8acf54.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/DownloadCache/mobikokCacheFileInfos
<SD-Card>/HorseBrowser/####/080A76A8AC157B637E27F549707A37CC.png
<SD-Card>/HorseBrowser/####/08DDFCD9AC157B63445C5E3411AC11EA.jpg
<SD-Card>/HorseBrowser/####/37D1AA67AC157B624B3C07D5765AC15A.png
<SD-Card>/HorseBrowser/####/64223430AC157B636AB78C4A8C5E0524.png
<SD-Card>/HorseBrowser/####/64281E4FAC157B635E90A00F61F29893.png
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE20B7F21F347FC3A40.jpeg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE2478DDE6AB87569BC.jpeg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE24BADFC0E453793AD.png
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE216F7E3BA539C33E5.jpeg
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE2330525D994617330.jpeg
<SD-Card>/HorseBrowser/####/CA292C75FFFFFFE26C87D41DE97A0573.jpeg
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/test1508932110666

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
app_process /system/bin com.android.commands.pm.Pm path com.dianxinos.dxbs
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0771 <Package Folder>/.syslib-
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Loads the following dynamic libraries:

1508932110892_dyV17041701Dj1so32
com_zhuoyian_youxizhongxing110
ehkdbiDtwbaGbOOydaemon
getuiext2
intel-1676682703
libiXCCVhYUvWYjNhMlbootstrap
libjni-comymrefpackagesjrrbaidu

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial