Android.Packed.21704

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Spy.205.origin
Android.DownLoader.304.origin

Sends data on received text messages to remote host.

Network activity:

Connecting to:

iji####.com
s####.####.com
v####.####.com
newbyv####.com
7j####.####.com
and####.####.com
c-h####.####.com
newbyv####.com:10001
1####.####.238:8977
1####.####.238
pub-####.####.com
huangda####.com
i####.####.cn
a####.####.com
and####.####.com:8077

HTTP GET requests:

iji####.com/tcmn/home/mnfw/1?record_id=####&vncode=####&channel=####&uid...
iji####.com/tcmn/user/get_user_tag?vncode=####&channel=####
iji####.com/tcmn/pvuv/bind_push?dev_vn=####&channelCode=####&devuid=####...
v####.####.com/pic/tcmn/2016/01/22/5512145934780.jpg
iji####.com/tcmn/user/get_service_comments/1?vncode=####&home_uid=####&r...
v####.####.com/pic/tcmn/banner/banner_20160919.jpg
7j####.####.com/tdata_xnO526
v####.####.com/pic/tcmn/drawable/yf_vip_yes.png
v####.####.com/pic/tcmn/2016/01/22/5512221121721.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1314709703097.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1321690904451.jpg
huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
v####.####.com/pic/tcmn/drawable/yf_info_friend_cond.png
s####.####.com/config/hz-hzv3.conf
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1309677853710.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1310376798699.jpg
v####.####.com/pic/tcmn/2016/01/22/5512196567383_m.jpg
1####.####.238/dex/ldsource.bin
iji####.com/tcmn/home/mnfw/2?record_id=####&vncode=####&channel=####&uid...
v####.####.com/pic/tcmn/drawable/yf_info_number.png
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1312323117623.jpg
v####.####.com/pic/tcmn/drawable/yf_info_bust.png
v####.####.com/pic/tcmn/2016/01/22/5512182671027_m.jpg
iji####.com/tcmn/user/get_user_notice?vncode=####&channel=####&uid=####&...
v####.####.com/pic/tcmn/2016/01/22/5512238322118.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1312088089274.jpg
v####.####.com/pic/tcmn/2016/01/22/5512431932682.jpg
v####.####.com/pic/tcmn/drawable/yf_info_receive.png
v####.####.com/pic/tcmn/2016/01/22/5512475481969.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1321830617818.jpg
newbyv####.com/Application/Uploads/Scheme/58880e82e748f.zip
iji####.com/tcmn/user/get_home_user?vncode=####&home_uid=####&channel=##...
1####.####.238:8977/dex/version.txt
v####.####.com/pic/tcmn/2016/01/22/5512010219590.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/130843606782.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1320271167589.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1307884820310.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/131404889016.jpg
huangda####.com/apk!requestApkLog.action?provider=####&reqType=####&resu...
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1320174140443.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1309331136528.jpg
v####.####.com/pic/tcmn/2016/01/22/551205788758.jpg
v####.####.com/version/tcmn/app/mmplay
v####.####.com/pic/tcmn/2016/01/22/5512606039233.jpg
v####.####.com/pic/tcmn/drawable/yf_info_address.png
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1320025175767.jpg
iji####.com/tcmn/push/get_my_notice?vncode=####&channel=####&noticeTimes...
v####.####.com/pic/tcmn/2016/01/22/5511989972883.jpg
newbyv####.com/Application/Uploads/Scheme/58593aec62918.zip
v####.####.com/pic/tcmn/2016/01/22/5512212329727_m.jpg
v####.####.com/pic/tcmn/2016/01/22/5512212329727.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1299402270633.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1300980769467.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1311766089552.jpg
v####.####.com/pic/tcmn/2016/01/22/5512328610222.jpg
v####.####.com/pic/tcmn/drawable/yf_info_comment.png
v####.####.com/pic/tcmn/2016/01/22/5511924328681.jpg
v####.####.com/pic/tcmn/drawable/yfb_tong.png
v####.####.com/pic/tcmn/2016/01/22/5512118531640.jpg
v####.####.com/pic/tcmn/2016/01/22/5512457563566.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1299932261365.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1309180479051.jpg
v####.####.com/pic/tcmn/banner/rule_20160108.jpg
a####.####.com/location/ip?ak=####&mcode=####
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1321004122762.jpg
v####.####.com/pic/tcmn/2016/01/22/5512400211294.jpg
v####.####.com/pic/tcmn/2016/01/22/5511981228411.jpg
v####.####.com/pic/tcmn/drawable/yfb_yin.png
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1304236061934.jpg
i####.####.cn/iplookup/iplookup.php?format=####
v####.####.com/pic/tcmn/drawable/yf_info_pic.png
v####.####.com/pic/tcmn/2016/01/22/5512352564650.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1321673821543.jpg
v####.####.com/pic/tcmn/2016/01/22/5512518893534.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1323298441797.jpg
v####.####.com/pic/tcmn/drawable/yfb_cup.png
7j####.####.com/tdata_rqD586
v####.####.com/pic/tcmn/2016/01/22/5512630642883.jpg
v####.####.com/pic/tcmn/2016/01/22/5512550817399.jpg
v####.####.com/pic/tcmn/2016/01/22/5512595249518.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1317100723925.jpg
v####.####.com/pic/tcmn/drawable/yf_info_base.png
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1313987526041.jpg
v####.####.com/pic/tcmn/2016/01/22/5512381510178.jpg
newbyv####.com/Application/Uploads/Scheme/5859392d01032.zip
v####.####.com/pic/tcmn/2016/01/22/5512196567383.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1311615908226.jpg
huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
v####.####.com/pic/tcmn/2016/01/22/5512027646973.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1319295027822.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1314146939714.jpg
v####.####.com/pic/tcmn/drawable/yfb_gold.png
v####.####.com/pic/tcmn/2016/01/22/5511951766560.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1307365441758.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1316487452727.jpg
v####.####.com/pic/tcmn/2016/01/22/5512275352670.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1323164319426.jpg
iji####.com/tcmn/home/user_setting?vncode=####&channel=####&uid=####&prv...
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1313839823468.jpg
v####.####.com/pic/tcmn/2016/01/22/5512577928945.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1312078885718.jpg
v####.####.com/pic/tcmn/2016/01/22/5512081393111.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1307840323498.jpg
iji####.com/tcmn/iploc/get_ip
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1308148749665.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/130661799667.jpg
v####.####.com/pic/tcmn/drawable/yf_info_intro.png
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1299787564456.jpg
newbyv####.com/Application/Uploads/Global/58febcefe9f7b.zip
7j####.####.com/tdata_Diu264
iji####.com/tcmn/tyvideo/get_mmplayer?vncode=####&channel=####&uid=####&...
pub-####.####.com/tdata_EDT356
v####.####.com/pic/tcmn/2016/01/22/5512255472212.jpg
iji####.com/tcmn/home/notification/1?vncode=####&channel=####&pkg=####&i...
v####.####.com/pic/tcmn/2016/01/22/5512182671027.jpg
v####.####.com/pic/tcmn/mnfw/comment/2015/10/22/1312903668895.jpg
v####.####.com/pic/tcmn/2016/01/22/5512163556058.jpg
v####.####.com/pic/tcmn/2016/01/22/5512509029788.jpg

HTTP POST requests:

and####.####.com/record-plat/record/upload.do
newbyv####.com:10001/api/v1/phones
huangda####.com/resource!plugUpdate
iji####.com/tcmn/pvuv/check_device?tt=####&pkg=####
newbyv####.com/api/v1/phones
iji####.com/tcmn/pvuv/record?isRtn=####&pkg=####&apiName=####
and####.####.com/record-plat/seq/query.do
and####.####.com:8077/android/sms/netpay/prefetch.do
iji####.com/tcmn/user/add_user_vistor
s####.####.com/api.php?format=####&t=####
iji####.com/tcmn/tydma/get_my_tyd?vncode=####&channel=####&noticeTimes=#...
huangda####.com/shop/shop_upload_log
iji####.com/tcmn/user/register/2
and####.####.com/record-plat/msg/strategy/query.do
iji####.com/tcmn/pvuv/record?isRtn=####&pkg=####
c-h####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

<Package Folder>/files/tdata_rqD586.jar
<Package Folder>/cache/<Package>/1112325137-433340279
<Package Folder>/cache/<Package>/12828074421746016962
<Package Folder>/cache/<Package>/-927329724929417903
<Package Folder>/shared_prefs/googlesdk.xml.bak
<Package Folder>/cache/<Package>/-1338047288-926607935
<Package Folder>/cache/<Package>/-13380472881952837720
<Package Folder>/cache/<Package>/1112325137827543757
<Package Folder>/cache/<Package>/111232513713399480
<Package Folder>/app_workbench28402/apk.zip
<Package Folder>/files/permmgr/libsu.so
<Package Folder>/cache/<Package>/5955702101844219540
<Package Folder>/cache/<Package>/-13380472881162469059
<Package Folder>/files/init_c1.pid
<Package Folder>/files/ota/elf/58880e82e748f.zip
<Package Folder>/cache/<Package>/11123251371126687508
<Package Folder>/cache/<Package>/-1338047288-238498752
<Package Folder>/cache/<Package>/-1338047288-330770876
<Package Folder>/cache/<Package>/-1192603419-1427843525
<Package Folder>/cache/<Package>/261862261304817268
<Package Folder>/shared_prefs/dispatch_log.xml
<Package Folder>/cache/<Package>/1112325137750011877
<Package Folder>/cache/<Package>/122340988748279066
<Package Folder>/files/run.pid
<Package Folder>/cache/<Package>/1747591161-1922823445
<Package Folder>/cache/<Package>/-1338047288-1993972858
<Package Folder>/cache/<Package>/1853553663-815849171
<Package Folder>/cache/<Package>/-2094417459591537387
<Package Folder>/shared_prefs/googlesdk.xml
<Package Folder>/cache/<Package>/122340988-126140247
<Package Folder>/databases/tmpd8.db-journal
<Package Folder>/cache/<Package>/-1338047288929857910
<Package Folder>/shared_prefs/pref_recomm.xml.bak
<Package Folder>/cache/<Package>/1112325137837364003
<Package Folder>/cache/<Package>/1112325137-642567832
<Package Folder>/cache/<Package>/-1338047288-1716219626
<Package Folder>/databases/Data_sync.db-journal
<Package Folder>/cache/<Package>/-1561368980-287793402
<Package Folder>/cache/<Package>/1112325137-1878663413
<Package Folder>/shared_prefs/getui_sp.xml
<Package Folder>/shared_prefs/first_pref.xml
<Package Folder>/files/ota/elf/C26D325A8FA3FBC563780AC2B4B1400D
<Package Folder>/cache/<Package>/1770551279-1281769941
<Package Folder>/shared_prefs/QugouUserTag.xml
<Package Folder>/cache/<Package>/1112325137-1058051582
<Package Folder>/shared_prefs/tpservices.xml
<Package Folder>/cache/<Package>/122340988454178212
<Package Folder>/cache/<Package>/-406083722-1915535325
<Package Folder>/cache/<Package>/-1338047288-45438243
<Package Folder>/cache/<Package>/-33049841418634840
<Package Folder>/files/a87e0174d37c
<Package Folder>/files/ota/elf/58febcefe9f7b.zip
<Package Folder>/cache/<Package>/1112325137-1356543287
<Package Folder>/cache/<Package>/-1338047288-288459153
<Package Folder>/cache/<Package>/-13380472881530293754
<Package Folder>/files/mobclick_agent_cached_<Package>190
<Package Folder>/cache/<Package>/11123251371954223914
<Package Folder>/cache/<Package>/575776810-1116096007
<Package Folder>/cache/<Package>/-1338047288-1658307782
<Package Folder>/cache/<Package>/-1338047288-45248676
<Package Folder>/cache/<Package>/-1338047288-1610254692
<Package Folder>/files/ota/daemon
<Package Folder>/cache/<Package>/-1338047288-444477053
<Package Folder>/cache/<Package>/11123251371346260463
<Package Folder>/files/ota/libsu.so
<Package Folder>/cache/<Package>/1118866582-1268737820
<Package Folder>/cache/<Package>/1112325137613371338
<Package Folder>/cache/<Package>/-1062320584-1922823445
<Package Folder>/cache/<Package>/-13380472881360396959
<Package Folder>/cache/<Package>/1112325137-53663264
<Package Folder>/files/dump
<Package Folder>/cache/<Package>/1606861267336951880
<Package Folder>/cache/<Package>/-1338047288-392737781
<Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
<Package Folder>/cache/<Package>/-1338047288842910302
<Package Folder>/cache/<Package>/1112325137-384748191
<Package Folder>/app_dex/classes.jar
<Package Folder>/cache/<Package>/595570210458385214
<Package Folder>/databases/pushgdm.db-journal
<Package Folder>/cache/<Package>/-133804728833081316
<Package Folder>/databases/webview.db-journal
<Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
<Package Folder>/cache/<Package>/-1338047288504784238
<Package Folder>/databases/pushg.db-journal
<Package Folder>/cache/<Package>/1112325137-583378255
<Package Folder>/cache/<Package>/-1338047288-482914016
<Package Folder>/cache/<Package>/-13380472881095942438
<Package Folder>/files/ota/installer
<Package Folder>/files/init.pid
<Package Folder>/cache/<Package>/1277469157-995574372
<Package Folder>/cache/<Package>/1112325137-507389635
<Package Folder>/cache/<Package>/-13380472881261221427
<Package Folder>/cache/<Package>/-13380472882051354169
<Package Folder>/files/libabc
<Package Folder>/cache/<Package>/12828074421072609790
<Package Folder>/cache/<Package>/1282807442473419074
<Package Folder>/databases/my_pagecache.db-journal
<Package Folder>/cache/<Package>/-13380472881648380870
<Package Folder>/cache/<Package>/2963066051474777807
<Package Folder>/cache/<Package>/11123251372138019874
<Package Folder>/cache/<Package>/-1338047288787353756
<Package Folder>/files/noend.ini
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/files/tdata_Diu264
<Package Folder>/files/ota/elf/5859392d01032.zip
<Package Folder>/cache/<Package>/1112325137-333926380
<Package Folder>/shared_prefs/first_register.xml
<Package Folder>/cache/<Package>/-13380472881626207013
<Package Folder>/cache/<Package>/11123251372099057917
<Package Folder>/databases/cc/cc.db-journal
<Package Folder>/cache/<Package>/1112325137101390396
<Package Folder>/cache/<Package>/1112325137-1903904415
<Package Folder>/files/tdata_Diu264.jar
<Package Folder>/cache/<Package>/-1338047288-873254581
<Package Folder>/cache/<Package>/-1338047288-1343845001
<Package Folder>/files/ota/krdem
<Package Folder>/cache/<Package>/-40608372285953041
<Package Folder>/cache/<Package>/11123251372060391811
<Package Folder>/files/ota/busybox
<Package Folder>/cache/<Package>/-13380472881160146118
<Package Folder>/app_workbench22876/apk.zip
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/cache/<Package>/-13380472881438710509
<Package Folder>/cache/<Package>/-13380472881390036824
<Package Folder>/files/ota/elf/116216c83f16af468c35d2787220b93d
<Package Folder>/cache/<Package>/1112325137873926680
<Package Folder>/cache/<Package>/595570210992581184
<Package Folder>/cache/<Package>/1112325137-866613555
<Package Folder>/shared_prefs/plugin_record_app_info.xml
<Package Folder>/cache/<Package>/-406083722-1913861903
<Package Folder>/files/tdata_xnO526.jar
<Package Folder>/cache/<Package>/-406083722-673808585
<Package Folder>/files/ota/package
<Package Folder>/cache/<Package>/1112325137-1490369602
<Package Folder>/files/gdaemon_20161017
<Package Folder>/cache/<Package>/1112325137509461107
<Package Folder>/shared_prefs/QugouUser.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/cache/<Package>/-1177243917-1791807692
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/cache/<Package>/-1338047288-1367336223
<Package Folder>/databases/cc/cc.db
<Package Folder>/cache/<Package>/1112325137625850156
<Package Folder>/shared_prefs/version.dat.xml
<Package Folder>/cache/<Package>/-1338047288602348860
<Package Folder>/cache/<Package>/595570210408523933
<Package Folder>/files/tdata_rqD586
<Package Folder>/cache/<Package>/-1338047288-422563015
<Package Folder>/cache/<Package>/1112325137470204101
<Package Folder>/shared_prefs/VistorNo.xml
<Package Folder>/cache/<Package>/-502396558-1216320515
<Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
<Package Folder>/cache/<Package>/-13380472881422266534
<Package Folder>/files/ota/version
<Package Folder>/cache/<Package>/-13380472881101175957
<Package Folder>/cache/<Package>/1112325137291821530
<Package Folder>/cache/<Package>/63782342-720394171
<Package Folder>/cache/<Package>/1730078854384600923
<Package Folder>/files/cewfh.apk
<Package Folder>/cache/<Package>/1112325137-427747099
<Package Folder>/databases/pushext.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/cache/<Package>/-13380472881954667674
<Package Folder>/cache/<Package>/11123251371782824297
<Package Folder>/cache/<Package>/-1953164784-1281769941
<Package Folder>/shared_prefs/pref_recomm.xml
<Package Folder>/shared_prefs/gx_sp.xml
<Package Folder>/cache/<Package>/-60686588722245743
<Package Folder>/files/tdata_xnO526
<Package Folder>/cache/<Package>/1112325137561689282
<Package Folder>/cache/<Package>/1282807442185859017
<Package Folder>/files/push.pid

Miscellaneous:

Executes next shell scripts:

chmod 700 /data/data/####/files/gdaemon_20161017
cat /sys/block/mmcblk0/device/cid
chmod 700 <Package Folder>/files/gdaemon_20161017
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/nghfw.anbey.service.MhGtphService 24757 300 0
cat /sys/class/net/wlan0/address
/data/data/####/app_bin/daemon -p #### -s com.blw.ey.c.c -t 180
<dexopt>
/data/data/####/files/gdaemon_20161017 0 ####/nghfw.anbey.service.MhGtphService 24757 300 0

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial