Android.Packed.20889

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.124.origin

Network activity:

Connecting to:

trac####.####.com
s####.####.com
clinkad####.com
set####.####.com
a####.####.net
google-####.com
p####.####.com
sta####.####.com
d####.####.com
im####.####.com
n####.####.hk
gl####.####.com
cdn####.####.com
l####.####.com
m####.####.com
n####.####.com
fk-gray####.####.com
baiduli####.####.org
a####.####.com
pag####.####.com

HTTP GET requests:

baiduli####.####.org/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_su...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/21/x...
m####.####.com/2017/04/marvel-studios-992340.png
google-####.com/analytics.js
a####.####.net/call/v2/ad/click?ads_id=####&aff_id=####&ak_id=####&local...
s####.####.com/sites/www.ibtimes.com/files/styles/lg/public/2017/04/12/i...
a####.####.net/stat/v2/request?aff_id=####&ak_id=####&local=####&from_sd...
n####.####.hk//v1/articles/0242524e85334a258fd39133eb59a50cusen/d8a8dcb4...
d####.####.com/thinking/group/ido_0222.jar
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/23/w...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/21/g...
n####.####.hk/v1/articles/7e4f47efcae449ee9ff6080c3f33829ausen/content?i...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/15/58c6552562afd.png
l####.####.com/fcUSAeWUsLdctiztDcBLZOntkN90TWSurAjTtf8VI2JUsqFmqvIEpePwr...
a####.####.net/stat/v2/imp?aff_id=####&ak_id=####&local=####&from_sdk=##...
n####.####.hk/css/content.css
cdn####.####.com/cdn-adn/dmp/17/03/30/23/15/58dd20f5bbf34.JPEG
cdn####.####.com/cdn-adn/dmp/17/03/30/22/02/58dd0ffd787b7.JPEG
n####.####.hk/v1/categories?channel=####&country=####
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2015/10/03/e...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c6548a0fd68.png
n####.####.hk/v1/articles/0242524e85334a258fd39133eb59a50cusen/content?i...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/21/k...
cdn####.####.com/cdn-adn/dmp/17/04/18/23/11/58f62c99be5e1.JPEG
n####.####.hk/css/img/icons_sprite.png
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/01/17/s...
n####.####.hk/js/content.js
cdn####.####.com/cdn-adn/offersync/17/03/13/16/12/58c65482b410d.png
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/14/58c654d6792d5.png
gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####&a...
n####.####.hk/v1/articles?limit=####&offset=####&channel=####&topics=###...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/22/58c656ccad821.png
im####.####.com/2017/04/twitch-759.jpg
d####.####.com/onlyImpression?k=####&p=####
set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
n####.####.hk//v1/articles/7e4f47efcae449ee9ff6080c3f33829ausen/d8a8dcb4...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6542715860.png
cdn####.####.com/cdn-adn/offersync/17/03/13/16/13/58c654c071ee1.png
cdn####.####.com/cdn-adn/dmp/17/03/30/22/02/58dd0ff3a3308.JPEG
google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&ul=...
cdn####.####.com/cdn-adn/dmp/17/03/30/22/03/58dd104c2c080.JPEG
cdn####.####.com/cdn-adn/dmp/17/03/30/22/04/58dd1058430ab.JPEG
a####.####.net/applnk/826227844?src_section_id=####
pag####.####.com/pagead/js/adsbygoogle.js
fk-gray####.####.com/impression?k=####&p=####&q=####&x=####
cdn####.####.com/cdn-adn/offersync/17/03/28/18/30/58da3b5f853e1.jpg
d####.####.com/impression?k=####&p=####&q=####&x=####
d####.####.com/click?k=####&p=####&q=####&notice=####
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/19/c...
l####.####.com/Mw_kQrK3SOuAvLF2AS4DDU675lh4cz9ZqoFMT2RTuiuGeK1hoqYhwdQsv...
pag####.####.com/pagead/js/r20170417/r20170110/show_ads_impl.js
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/20/k...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/17/s...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/20/f...
l####.####.com/Ffvv2D-8ya6msao3fKLMM1LL_lvEnm6AaY1g6es_4FWPuZ8XlssvuaXoz...
trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&aff_sub=###...
n####.####.hk/v1/articles/0242524e85334a258fd39133eb59a50cusen/related?c...
cdn####.####.com/cdn-adn/html/common/2016/02/23/00/08/es.socialpoint.Mon...
set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
baiduli####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&only...
set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=##...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2011/08/18/1...
n####.####.hk/v1/articles/7e4f47efcae449ee9ff6080c3f33829ausen/related?c...
gl####.####.com/trace?offer_id=####&aff_id=####&aff_sub3=####&aff_sub7=#...
clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####&gai...
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/05/f...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/09/58c6539daac31.png
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
cdn####.####.com/cdn-adn/offersync/17/03/13/16/16/58c6555753bcd.png
fk-gray####.####.com/onlyImpression?k=####&p=####
s####.####.com/sites/www.ibtimes.com/files/styles/embed/public/2017/04/2...
google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&u...
sta####.####.com/image/58d51e23d349f914038b6abf-728
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/22/b...
cdn####.####.com/cdn-adn/offersync/17/04/19/18/23/58f73a8619ef5.jpg
s####.####.com/sites/www.ibtimes.com/files/styles/md/public/2017/04/21/a...

HTTP POST requests:

a####.####.com/app_logs
a####.####.net/native/v2/recommend
a####.####.com/ako/api/111
p####.####.com/myservercb/api/1800

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks_offers.xml
/data/data/####/cache/picasso-cache/7ac210de213e132d50d3e5cf70921238.0.tmp
/data/data/####/cache/picasso-cache/2c626cfb152d0b7b7aa578e6ab216981.1.tmp
/data/data/####/cache/picasso-cache/87d5f9fccb4cc10aa909444775214dae.0.tmp
/data/data/####/cache/picasso-cache/2113ede380809c08a5a000d44cf701ce.0.tmp
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/cache/picasso-cache/ba8dd66a6b49a852d8d2ef01e712a182.1.tmp
/data/data/####/cache/picasso-cache/1d2fe63827a59f84a4bbebbf782983f1.1.tmp
/data/data/####/cache/1468357373244.jar
/sdcard/.mobvista700/download/200440155.temp
/sdcard/.mobvista700/download/965947873.temp
/data/data/####/protect.jar
/data/data/####/cache/picasso-cache/14da701f0e6da33c2784cd4182f980a4.0.tmp
/data/data/####/databases/bat_statistics.db-journal
/data/data/####/cache/picasso-cache/0f86ce2e5ef127aeac9bc532b6ce6733.0.tmp
/data/data/####/cache/picasso-cache/22312ba3eb949289fd23d84ad67c6ac1.1.tmp
/data/data/####/cache/picasso-cache/87d5f9fccb4cc10aa909444775214dae.1.tmp
/data/data/####/cache/picasso-cache/87c8d03d0d86307e0fba85310abf90d0.1.tmp
/sdcard/.mobvista700/download/-43076249
/data/data/####/cache/picasso-cache/2113ede380809c08a5a000d44cf701ce.1.tmp
/data/data/####/shared_prefs/mobvista.xml
/data/data/####/cache/picasso-cache/ea606ac8c28c8b12ba1b103bef8ad237.0.tmp
/data/data/####/databases/webview.db-journal
/sdcard/.mobvista700/download/-1377858248
/data/data/####/files/.apd/ido.jar.ac
/data/data/####/cache/picasso-cache/693f831868a24e5e81ac273dbd4fa659.0.tmp
/sdcard/.apd/-388197164.a.tmp
/data/data/####/shared_prefs/sharedpreferences_batmobi_offers.xml
/data/data/####/cache/picasso-cache/journal.tmp
/data/data/####/cache/picasso-cache/008ce3af3d60e438f4e8114b45a5fe26.0.tmp
/sdcard/.mobvista700/download/1534305018
/data/data/####/cache/picasso-cache/1dd8e754592ac35642d6c1babe3575a3.1.tmp
/data/data/####/cache/picasso-cache/6b011d929aadc18d023e963904d4b8b5.1.tmp
/data/data/####/shared_prefs/share_data.xml
/data/data/####/shared_prefs/check.xml
/data/data/####/cache/picasso-cache/d5795d685ed6ee6aa851fe35c034e1d8.0.tmp
/data/data/####/shared_prefs/sharedpreferences_batmobi_ad_clicks.xml
/data/data/####/cache/picasso-cache/e001e0be5d5c852b8822c79ca309ef29.1.tmp
/data/data/####/cache/picasso-cache/853df9fa16eb986ad185eb27fe0ff563.1.tmp
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/cache/picasso-cache/1dd8e754592ac35642d6c1babe3575a3.0.tmp
/data/data/####/cache/picasso-cache/693f831868a24e5e81ac273dbd4fa659.1.tmp
/data/data/####/cache/webviewCacheChromium/f_00000a
/data/data/####/cache/webviewCacheChromium/f_00000c
/data/data/####/cache/picasso-cache/1d2fe63827a59f84a4bbebbf782983f1.0.tmp
/data/data/####/cache/webviewCacheChromium/f_00000e
/data/data/####/cache/webviewCacheChromium/f_00000d
/sdcard/.mobvista700/download/-98113556.temp
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/picasso-cache/507177b6e06fc78506ffe3164876225a.1.tmp
/data/data/####/shared_prefs/SDKIDFA.xml
/data/data/####/cache/picasso-cache/ee132c8ca96f28e6b08935134b811603.0.tmp
/data/data/####/cache/picasso-cache/ae3523def2b84ad6392e4500566ea257.0.tmp
/data/data/####/cache/picasso-cache/2c102b7d75d09a44721b2e72d53f0ec3.1.tmp
/data/data/####/files/.apd/ido.jar
/data/data/####/cache/picasso-cache/ba8dd66a6b49a852d8d2ef01e712a182.0.tmp
/data/data/####/cache/picasso-cache/5080eac6b334c30dab8bcd6fccf37198.1.tmp
/data/data/####/cache/picasso-cache/7ac210de213e132d50d3e5cf70921238.1.tmp
/sdcard/.mobvista700/download/1920493326.temp
/sdcard/.apd/-388197164.a.dat
/data/data/####/cache/picasso-cache/465d90f2915d585707b86850e4378f42.1.tmp
/data/data/####/cache/picasso-cache/ee132c8ca96f28e6b08935134b811603.1.tmp
/data/data/####/cache/picasso-cache/d5795d685ed6ee6aa851fe35c034e1d8.1.tmp
/data/data/####/cache/picasso-cache/87c8d03d0d86307e0fba85310abf90d0.0.tmp
/data/data/####/databases/mobvista.msdk.db-journal
/data/data/####/cache/picasso-cache/507177b6e06fc78506ffe3164876225a.0.tmp
/data/data/####/cache/webviewCacheChromium/f_000009
/data/data/####/cache/webviewCacheChromium/f_000008
/data/data/####/cache/picasso-cache/d1d0de477a969f7fd041824a7a551cfe.1.tmp
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/picasso-cache/ea708cc9dea82975c0b163f18b6c0377.0.tmp
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/picasso-cache/0f86ce2e5ef127aeac9bc532b6ce6733.1.tmp
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/picasso-cache/0d8c4f8c28c3ab61104d26c45d9fb79d.1.tmp
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/cache/1468357373244.dex
/data/data/####/cache/picasso-cache/799a935517245d8d0abbdfe9849d99fb.1.tmp
/data/data/####/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
/data/data/####/cache/picasso-cache/798ec11917e6e92db84ac3cb06fc8b62.0.tmp
/data/data/####/cache/picasso-cache/835e9644991b6562913f630a3dd20255.1.tmp
/data/data/####/shared_prefs/mobvista.xml.bak
/data/data/####/files/mobclick_agent_cached_####
/data/data/####/cache/picasso-cache/22312ba3eb949289fd23d84ad67c6ac1.0.tmp
/data/data/####/cache/picasso-cache/6b011d929aadc18d023e963904d4b8b5.0.tmp
/data/data/####/cache/picasso-cache/d0f6669cbeff8f08510c3533e8b6cfff.1.tmp
/data/data/####/cache/picasso-cache/798ec11917e6e92db84ac3cb06fc8b62.1.tmp
/data/data/####/cache/picasso-cache/174cd767aa1ced14e5c0e3fd4aa3612b.1.tmp
/data/data/####/cache/picasso-cache/ea606ac8c28c8b12ba1b103bef8ad237.1.tmp
/data/data/####/cache/picasso-cache/31faf3f6bf11d74d0b13832f70a60bee.1.tmp
/data/data/####/cache/picasso-cache/6f2d95d3ffc375bd694810f61417b517.1.tmp
/sdcard/.mobvista700/download/-1015052616
/data/data/####/cache/picasso-cache/543258734ad1eca76b36a877a1e95bb8.0.tmp
/data/data/####/cache/picasso-cache/465d90f2915d585707b86850e4378f42.0.tmp
/data/data/####/cache/picasso-cache/ae3523def2b84ad6392e4500566ea257.1.tmp
/sdcard/.mobvista700/download/-386055148
/data/data/####/cache/picasso-cache/ce970baebbc431100ec0e2760017eb2f.0.tmp
/data/data/####/cache/picasso-cache/27fc3e77c086cc090129bf959da5c4ce.0.tmp
/data/data/####/cache/picasso-cache/31faf3f6bf11d74d0b13832f70a60bee.0.tmp
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/picasso-cache/ce26f95aaf70560614a0b5cf15029144.0.tmp
/data/data/####/shared_prefs/mobclick_agent_state_####.xml
/data/data/####/cache/picasso-cache/ecd872f47120553f61fee0bfe2c45a6c.1.tmp
/data/data/####/shared_prefs/FBAdPrefs.xml
/data/data/####/cache/webviewCacheChromium/f_00000b
/data/data/####/protect.jar.tmp
/sdcard/.mobvista700/download/-1458188283
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/cache/picasso-cache/174cd767aa1ced14e5c0e3fd4aa3612b.0.tmp
/data/data/####/cache/picasso-cache/f029be24f173a81dde75b392ffcdfeb9.0.tmp
/data/data/####/cache/1468357373244.tmp
/data/data/####/cache/picasso-cache/266c07cfab89a5c1c9f4d5e13d1e3e0e.1.tmp
/data/data/####/cache/picasso-cache/853df9fa16eb986ad185eb27fe0ff563.0.tmp
/data/data/####/cache/picasso-cache/835e9644991b6562913f630a3dd20255.0.tmp
/data/data/####/cache/picasso-cache/ea708cc9dea82975c0b163f18b6c0377.1.tmp
/data/data/####/shared_prefs/sharedpreferences_batmobi_settings.xml
/data/data/####/cache/picasso-cache/ce970baebbc431100ec0e2760017eb2f.1.tmp
/data/data/####/cache/picasso-cache/ecd872f47120553f61fee0bfe2c45a6c.0.tmp
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/picasso-cache/2c626cfb152d0b7b7aa578e6ab216981.0.tmp
/data/data/####/files/libko.so.tmp
/data/data/####/files/libko.so
/data/data/####/cache/picasso-cache/6f2d95d3ffc375bd694810f61417b517.0.tmp
/data/data/####/cache/picasso-cache/4086ae8a35dc1e11324d057f75cf6390.0.tmp
/data/data/####/cache/picasso-cache/45810348e45badfdd0898146ff2cf0d9.0.tmp
/data/data/####/cache/picasso-cache/17a171318ca58ed8825c38ceb67a8598.1.tmp
/data/data/####/cache/picasso-cache/d0f6669cbeff8f08510c3533e8b6cfff.0.tmp
/data/data/####/shared_prefs/sharedpreferences_batmobi_ad_marketurl.xml
/data/data/####/cache/picasso-cache/d1d0de477a969f7fd041824a7a551cfe.0.tmp
/data/data/####/cache/picasso-cache/b59fd26aeb1079b80ef1ec2a8bbaa59a.1.tmp
/data/data/####/cache/picasso-cache/27fc3e77c086cc090129bf959da5c4ce.1.tmp
/data/data/####/cache/picasso-cache/6d0711a1241d4ea98314a2f78478dfbb.1.tmp
/sdcard/.mobvista700/download/2132926088
/data/data/####/databases/com.google.android.gms.ads.db/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
/data/data/####/cache/picasso-cache/266c07cfab89a5c1c9f4d5e13d1e3e0e.0.tmp
/data/data/####/cache/picasso-cache/008ce3af3d60e438f4e8114b45a5fe26.1.tmp
/data/data/####/cache/picasso-cache/45810348e45badfdd0898146ff2cf0d9.1.tmp
/sdcard/.mobvista700/download/-82653802
/data/data/####/cache/picasso-cache/799a935517245d8d0abbdfe9849d99fb.0.tmp
/data/data/####/cache/picasso-cache/5080eac6b334c30dab8bcd6fccf37198.0.tmp
/data/data/####/cache/picasso-cache/f029be24f173a81dde75b392ffcdfeb9.1.tmp
/data/data/####/cache/picasso-cache/b59fd26aeb1079b80ef1ec2a8bbaa59a.0.tmp
/data/data/####/cache/picasso-cache/4086ae8a35dc1e11324d057f75cf6390.1.tmp
/data/data/####/cache/picasso-cache/2c102b7d75d09a44721b2e72d53f0ec3.0.tmp
/data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
/sdcard/.mobvista700/download/-1174155579
/data/data/####/cache/picasso-cache/ce26f95aaf70560614a0b5cf15029144.1.tmp
/sdcard/.mobvista700/download/2103913252.temp
/data/data/####/cache/picasso-cache/e001e0be5d5c852b8822c79ca309ef29.0.tmp
/data/data/####/cache/picasso-cache/14da701f0e6da33c2784cd4182f980a4.1.tmp
/data/data/####/cache/picasso-cache/17a171318ca58ed8825c38ceb67a8598.0.tmp
/data/data/####/cache/picasso-cache/6d0711a1241d4ea98314a2f78478dfbb.0.tmp
/data/data/####/cache/picasso-cache/543258734ad1eca76b36a877a1e95bb8.1.tmp
/data/data/####/shared_prefs/mobclick_agent_header_####.xml
/sdcard/.mobvista700/download/-1444640728
/data/data/####/cache/ApplicationCache.db-journal
/sdcard/.mobvista700/download/72397737
/data/data/####/cache/picasso-cache/0d8c4f8c28c3ab61104d26c45d9fb79d.0.tmp

Miscellaneous:

Executes next shell scripts:

/data/data/####/app_bin/daemon -p #### -s com.news.main.service.CkService -t 120

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial