Android.Packed.18737

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSend.1848.origin

Network activity:

Connecting to:

a####.####.site:8090
p####.club
p####.####.com
a####.####.site

HTTP GET requests:

a####.####.site:8090/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
p####.club/web/videofm/fmpath1481108476600.gif
p####.club/web/videofm/fmpath1480679031645.PNG
p####.club/web/videofm/fmpath1480673489372.PNG
a####.####.site/getdata?cpid=####&packagename=####
p####.club/web/videofm/fmpath1480678926207.PNG
p####.club/web/videofm/fmpath1480679079004.PNG
a####.####.site/afee?cpid=####&appfee_id=####&fee=####&smsc=####&imsi=####&p=####&appname=####&sign=####
a####.####.site/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
p####.club/web/videofm/fmpath1480673347155.PNG
p####.club/web/videofm/fmpath1480673074320.PNG
p####.club/web/videofm/fmpath1480673274497.PNG
p####.club/web/videofm/fmpath1480679289957.PNG
p####.club/web/videofm/fmpath1480672662665.PNG

HTTP POST requests:

p####.####.com/api/q/a/35313985d3b9ccc38ab579d35065afe66
p####.club/memberInfo/memberRegister.do
p####.club/memberInfo/memberLogin.do
p####.club/memberInfo/queryVideoList.do
p####.####.com/api/statis/35313985d3b9ccc38ab579d35065afe66/app-642D1C4773244960AE61DB70F699E4D3
p####.club/memberInfo/queryVideoSort.do
p####.club/memberInfo/queryLeftMin.do

Modified file system:

Creates the following files:

/sdcard/Android/data/####/cache/xUtils_img/e3f69682c5f6c1b80fc7163f40b65798.tmp
/data/data/####/shared_prefs/edition.xml
/sdcard/Android/data/####/cache/xUtils_img/82faa7f51619624447d3b2dfa8ea2eac.tmp
/data/data/####/shared_prefs/b_share.xml
/data/data/####/app_process_lock/77520850336.504
/data/data/####/shared_prefs/ma_epay_share.xml
/sdcard/Android/data/####/cache/xUtils_img/69de938e936ad23802b73f7bf0dccfb9
/data/data/####/shared_prefs/xplayer.xml
/data/data/####/databases/bil_db-journal
/data/data/####/app_process_lock/690256006561.783
/data/data/####/databases/webview.db-journal
/data/data/####/app_process_lock/77520851183.7564
/data/data/####/databases/MA_epay_db-journal
/data/data/####/shared_prefs/ma_epay_share.xml.bak
/data/data/####/app_process_lock/77520850925.1543
/data/data/####/app_process_lock/77520850257.3887
/data/data/####/databases/bil_db
/data/data/####/shared_prefs/TDpref_shorttime.xml
/data/data/####/shared_prefs/ma_data.xml
/data/data/####/databases/xUtils_http_cache.db-journal
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/sdcard/Android/data/####/cache/xUtils_img/f9a1b83146e8fcb1995de59e1aed966d
/sdcard/Android/data/####/cache/xUtils_img/82faa7f51619624447d3b2dfa8ea2eac
/sdcard/Android/data/####/cache/xUtils_img/fc84163d6e00a45fa34654a046c900f5
/sdcard/Android/data/####/cache/xUtils_img/b65deecb078239f0bc6520df81a24dbc.tmp
/sdcard/Android/data/####/cache/xUtils_img/f9a1b83146e8fcb1995de59e1aed966d.tmp
/data/data/####/files/talkingdata_app_version_preferences_file
/data/data/####/databases/sms_db
/data/data/####/files/TDtcagent.db
/data/data/####/shared_prefs/b_setting.xml
/data/data/####/databases/xUtils_http_cookie.db
/data/data/####/app_process_lock/204860991149.25
/data/data/####/app_process_lock/690256000699.432
/data/data/####/shared_prefs/b_share.xml.bak
/sdcard/Android/data/####/cache/xUtils_img/69de938e936ad23802b73f7bf0dccfb9.tmp
/data/data/####/baea/tmb.jar
/data/data/####/app_process_lock/690256004803.064
/data/data/####/files/INSTALLATION
/data/data/####/databases/sms_db-journal
/data/data/####/app_process_lock/204860991744.884
/data/data/####/shared_prefs/new_vvsion.xml
/data/data/####/databases/xUtils_http_cookie.db-journal
/data/data/####/shared_prefs/nnt_data.xml
/data/data/####/app_process_lock/204860991671.22
/data/data/####/app_process_lock/204860990954.582
/data/data/####/app_process_lock/204860989722.259
/data/data/####/shared_prefs/TDCloudSettingsConfig642D1C4773244960AE61DB70F699E4D3.xml.bak
/sdcard/.tcookieid
/sdcard/Android/data/####/cache/xUtils_img/69141a76a0ad8da2ba975fde05a640c6.tmp
/data/data/####/databases/MA_epay_db
/sdcard/Android/data/####/cache/xUtils_img/15068e53e783bfd36ef2c4af0456161f
/data/data/####/files/talkingdata_app_process_preferences_file
/data/data/####/app_process_lock/204860991486.934
/data/data/####/shared_prefs/ma_call.xml
/data/data/####/app_process_lock/690256004147.151
/data/data/####/shared_prefs/nnt_data.xml.bak
/sdcard/Android/data/####/cache/xUtils_img/15068e53e783bfd36ef2c4af0456161f.tmp
/data/data/####/app_process_lock/77520850994.8894
/data/data/####/shared_prefs/ma_call.xml.bak
/data/data/####/app_process_lock/690256008243.479
/data/data/####/app_process_lock/77520850723.7084
/sdcard/Android/data/####/cache/xUtils_img/b65deecb078239f0bc6520df81a24dbc
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/mj.apk
/data/data/####/app_process_lock/690256001568.523
/data/data/####/databases/talkingdata_app.db-journal
/sdcard/Android/data/####/cache/xUtils_img/9ff4f45c0c5cf83dce139f3a06adc0b9
/data/data/####/shared_prefs/TDCloudSettingsConfig642D1C4773244960AE61DB70F699E4D3.xml
/data/data/####/shared_prefs/TDpref_longtime.xml
/sdcard/Android/data/####/cache/xUtils_img/69141a76a0ad8da2ba975fde05a640c6
/data/data/####/files/td.lock
/data/data/####/shared_prefs/b_setting.xml.bak
/data/data/####/files/tdlock.txt
/data/data/####/shared_prefs/TDpref_longtime.xml.bak
/data/data/####/app_process_lock/690255999994.979
/data/data/####/app_process_lock/204860990189.271
/data/data/####/app_process_lock/204860989931.334
/data/data/####/shared_prefs/ma_phone.xml
/data/data/####/app_process_lock/690256005940.852
/data/data/####/databases/xUtils_http_cache.db
/sdcard/Android/data/####/cache/xUtils_img/fc84163d6e00a45fa34654a046c900f5.tmp
/data/data/####/app_process_lock/204860992170.331
/data/data/####/app_process_lock/690256006809.985
/sdcard/Android/data/####/cache/xUtils_img/9ff4f45c0c5cf83dce139f3a06adc0b9.tmp
/data/data/####/app_process_lock/204860991912.181
/data/data/####/app_process_lock/690256007373.675
/data/data/####/app_process_lock/77520851022.7643
/data/data/####/app_process_lock/77520851086.0709
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/sdcard/Android/data/####/cache/xUtils_img/e3f69682c5f6c1b80fc7163f40b65798
/data/data/####/shared_prefs/ma_data.xml.bak
/sdcard/gooogle/userid.cfg
/data/data/####/shared_prefs/tdid.xml
/data/data/####/files/TDtcagent.db-journal
/data/data/####/app_process_lock/77520850797.3723
/sdcard/Android/data/####/cache/xUtils_img/130b9a9c2a71651a607815d91056ee9e.tmp

Sets the 'executable' attribute to the following files:

/sdcard/gooogle/userid.cfg

Miscellaneous:

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial