Android.Packed.20262

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Loki.15.origin
Android.Loki.10.origin

Network activity:

Connecting to:

trac####.####.com
fk-gray####.####.com
set####.####.com
g####.cn
a####.####.net
analy####.####.com
p####.####.com
and####.####.com
lo####.####.net
cdn####.####.com
p####.####.com:3090
n####.####.com
a####.####.com

HTTP GET requests:

n####.####.com/impression?k=####&p=####&q=####&x=####
n####.####.com/onlyImpression?k=####&p=####
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&ad_num=####&only_impression=####&ping_mode=####&native_info=####&tnum=##...
a####.####.net/api/v2/template/get?slot_id=####&update_time=####
set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=##...
a####.####.net/api/v2/cache/get?dml=####&dt=####&nt=####&mcc=####&bast=####&aid=####&lang=####&adnum=####&adcat=####&screen_w=####&img_rule=####&icc=#...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/15/58c6551bcbe58.png
fk-gray####.####.com/click?k=####&p=####&q=####&notice=####
cdn####.####.com/cdn-adn/offersync/17/03/13/16/14/58c654d6792d5.png
a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=####&aid=####&lang=####&adnum=####&adcat=####&screen_w=####&img_rule=####&icc=...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/09/58c653d62af4a.png
cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6543ca78b3.png
cdn####.####.com/cdn-adn/dmp/17/03/31/01/16/58dd3d6141c2e.JPEG
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_type=####&sign=####&ad_num=####&ping_mode=####&only_impression=####&offset=###...
cdn####.####.com/cdn-adn/dmp/17/03/30/23/14/58dd20cd1a74c.JPEG
fk-gray####.####.com/impression?k=####&p=####&q=####&x=####
set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&ori...
cdn####.####.com/cdn-adn/offersync/17/03/28/18/30/58da3b5f853e1.jpg
cdn####.####.com/cdn-adn/html/common/2016/02/22/22/03/com.qihoo.security1456149668.2_1200X627.JPEG
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign=####&only_impression=####&ad_num=####&ping_mode=####&ttc_ids=####&tnum=####&o...
n####.####.com/image?app_id=####&unit_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&or...
fk-gray####.####.com/onlyImpression?k=####&p=####
trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&aff_sub=####&mb_subid=####&mb_devid=####&mb_gaid=####
a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=####&aid=####&lang=####&adnum=####&screen_w=####&img_rule=####&icc=####&token=...
set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=####&package_name=####&app_version_name=####&app_version_code=####&orientation...

HTTP POST requests:

g####.cn/
analy####.####.com/
and####.####.com/rqd/async
lo####.####.net/debug/v2/android
p####.####.com:3090/PlutoServer/app/appinit/
a####.####.com/app_logs
p####.####.com/PlutoServer/app/getplugin/

Modified file system:

Creates the following files:

/sdcard/.mobvista700/download/1880935128
/data/data/####/tx_shell/libufix.so
/sdcard/.mobvista700/download/-898324802.temp
/data/data/####/shared_prefs/timestamp.xml
/data/data/####/files/eopcmjt/libLXtzwvqtrxRlyavpdynamicloader.so
/sdcard/.mobvista700/download/2082986419
/data/data/####/databases/sp_db-journal
/data/data/####/files/eopcmjt/libqNiSBgujjBxAEiyqzxc.so
/data/data/####/files/device_type_info.db.mirror
/data/data/####/mix.dex
/data/data/####/shared_prefs/share_date.xml.bak
/data/data/####/shared_prefs/TOKEN.xml
/data/data/####/files/AyuSnsgpJNCmGCZwdaemon.so
/data/data/####/files/.imprint
/data/data/####/databases/BatteryBooster.db.mirror
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/eopcmjt/libnYlYSMWbGsbTavdZlala.so
/data/data/####/databases/webview.db.mirror
/data/data/####/databases/gostatistics_sdk.db.mirror
/sdcard/GOPowerMaster/.nomedia
/data/data/####/files/HkvFXwaLTSDvKsFFbt.dex
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/shared_prefs/share_date.xml
/data/data/####/files/libcqqVdNbNsWngeIrdbootstrap.so
/sdcard/.pluto_data/d64e88b7bee21685e683e0abe104d8c0/client.id
/sdcard/air/as/statistics/deviceId.txt
/data/data/####/files/qNiSBgujjBxAEiyqzxc.jar
/data/data/####/shared_prefs/sys_configuration.xml
/data/data/####/files/device_type_info.db-journal
/data/data/####/databases/mobvista.msdk.db.mirror
/data/data/####/files/local_crash_lock
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/shared_prefs/ct_default.xml
/data/data/####/shared_prefs/ctrl_sp_####.xml
/data/data/####/files/log/agent_log
/data/data/####/shared_prefs/go_static_id####.xml
/data/data/####/tx_shell/libshella-2.10.1.so
/data/data/####/shared_prefs/IMDPREF.xml
/data/data/####/data-app/Y29tLnB0YXBwLmJhdHRlcnkubWFzdGVyX3BheTE
/data/data/####/shared_prefs/update_check.xml
/data/data/####/databases/sp_db.mirror
/data/data/####/databases/mobvista.msdk.db-journal
/data/data/####/files/nYlYSMWbGsbTavdZlala.jar
/data/data/####/databases/webviewCookiesChromium.db.mirror
/sdcard/.mobvista700/download/-1670272049
/sdcard/.mobvista700/download/1726843613
/data/data/####/databases/gostatistics_sdk.db-journal
/data/data/####/shared_prefs/mobvista.xml
/data/data/####/databases/webview.db-journal
/data/data/####/tx_shell/libnfix.so
/sdcard/GoAdSdk/config/user
/data/data/####/files/device_type_info.db
/data/data/####/shared_prefs/randomdeviceid.xml
/sdcard/.mobvista700/download/-1331407292
/data/data/####/shared_prefs/purchase_request_detail.xml
/data/data/####/files/LXtzwvqtrxRlyavpdynamicloader.jar
/data/data/####/files/.pluto_lib/d64e88b7bee21685e683e0abe104d8c0/pluto.apk
/data/data/####/shared_prefs/is_first_use.xml
/data/data/####/app_bin/daemon
/data/data/####/files/umeng_it.cache
/data/data/####/shared_prefs/cpu_freqs_pref.xml
/data/data/####/files/eopcmjt/libHkvFXwaLTSDvKsFFbt.so
/data/data/####/files/security_info
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/.mobvista700/download/2015565676
/data/data/####/shared_prefs/####.setting.xml
/data/data/####/databases/bugly_db_legu.mirror
/data/data/####/app_indicators/indicator_p
/data/data/####/databases/ad_sdk.db-journal
/data/data/####/shared_prefs/postTime.xml
/data/data/####/databases/ad_sdk.db.mirror
/data/data/####/databases/BatteryBooster.db-journal
/data/data/####/databases/bugly_db_legu-journal
/sdcard/.goproduct/goid
/data/data/####/files/HkvFXwaLTSDvKsFFbt.jar
/data/data/####/files/.legudb
/data/data/####/files/log/crash_log
/data/data/####/files/native_record_lock
/data/data/####/shared_prefs/share_for_goluncher_preference.xml
/data/data/####/shared_prefs/commerce_ad_phead_share.xml
/sdcard/.mobvista700/download/330775585
/data/data/####/app_indicators/indicator_d

Sets the 'executable' attribute to the following files:

/data/data/####/app_bin/daemon
/data/data/####/tx_shell/libufix.so
/data/data/####/tx_shell/libshella-2.10.1.so
/data/data/####/tx_shell/libnfix.so

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial