Android.Packed.23483

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.79.origin
Android.Xiny.1.origin

Downloads the following detected threats from the Web:

Android.HiddenAds.79.origin
Android.Xiny.1.origin

Network activity:

Connecting to:

1####.####.102
1####.####.102:8006
a####.####.com
a####.####.nl
a0f17a8####.####.net
apptr####.com
b####.####.com
be####.####.net
c####.####.com
c####.####.net
c####.####.org
c6ba1cd####.####.com
ce####.####.org
cloudfr####.####.com
con####.####.nl
d####.####.com
d####.####.net
e####.####.com
e####.####.com:8088
f####.####.com
google-####.com
gst####.com
h####.com
i####.####.com
im####.####.com
imgs####.####.nl
j####.####.net
m####.####.com
m####.####.nl
p####.####.com
p####.####.net
pag####.####.com
s####.####.com
s####.####.net
st####.####.com
t####.####.com
teleg####.####.nl
teleg####.nl
u####.####.com
w####.####.com

HTTP GET requests:

1####.####.102/m/umeng:5927f5685312dd3956000f78/600/AoznTb_7ZV8InlBKJemX...
1####.####.102:8006/m/umeng:5927f5685312dd3956000f78/600/AoznTb_7ZV8InlB...
a####.####.com/2017/05/25/141518643.zip
a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
a####.####.nl/dot.gif?item=####&ts=####&progress=####&il=####&event=####...
a0f17a8####.####.net/test.png
apptr####.com/dir/redirect?c=####&offerId=####&affid=####&cid=####&affsu...
b####.####.com/p?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=...
be####.####.net/pixel.gif?source=####&fired=####&confid=####&_kpid=####&...
c####.####.com/files/0f2ce5a615946c8eb2ffce96f6365687
c####.####.com/js/2759701342.js
c####.####.com/tracking/adClick?d=####&ru=####&clickId=####&prod=####&ad...
c####.####.net/controltag/qxniyymwl.js
c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
c####.####.org/v2/system/version-4-121.json
c6ba1cd####.####.com/58e7098a66f6003903b7e6ab_500x336.jpg
ce####.####.org/v2/content/recommend-c659b62501e1fa1bf0fd2da344c1323a-NL...
cloudfr####.####.com/x.png
con####.####.nl/embed/account=Kx1PKc/player=QoRMw6uC0x01/item=mZVoq8pJRl...
d####.####.com/deploy/js_visitor_settings.php?v=####&a=####&url=####&ran...
d####.####.net/serving/cookie/match/?CC=####&party=####
e####.####.com/req/jsapi.php?elid=####&json=####&_d=####
f####.####.com/iframeShowItem.php?itemid%5B0%5D=####&type=####&bv=####
google-####.com/analytics.js
gst####.com/cv/js/sender/v1/cast_sender.js
h####.com/css/fonts/roboto-v15-latin-500.ttf
i####.####.com/getuid?http://beacon.krxd.net/usermatch.gif?adnxs_uid=####
i####.####.com/s
im####.####.com/js/sdkloader/ima3.js
imgs####.####.nl/v1/UFZ94UyRc6PPpZua-ure0abQiRE=/80x80/smart/filters:for...
j####.####.net/gateway/gw.js?csid=####&auto=####
m####.####.com/dir/click?c=####&gaid=####&offerid=####&affid=####&affsub...
m####.####.nl/static/img/abonnementen.png
p####.####.com/sync/img?redir=####
p####.####.net/G07609/b3/Z/3/120814/79063433.js?D=####&C=####&asidi=####
pag####.####.com/pagead/gen_204?id=####&v=####&r=####&efm=####&if=####&s...
s####.####.com/audience_sync/9?redir=####
s####.####.com/genericusersync.ashx?dpid=####
s####.####.com/srv/click/?pid=####&p1=####&p2=####&p4=####
s####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
s####.####.net/instream/video/client.js
st####.####.com/c/hotjar-27367.js?sv=####
st####.####.com/image/resized/c/30595/0ai2TuaOgdI3s53_1_147464080457e53b...
t####.####.com/oz/feeds/telegraaf_nl/profile?segments=####
t####.####.com/tm42098.js
t####.####.com/utag/tiqapp/utag.v.js?a=####&cb=####
teleg####.####.nl/graphics/videopage/play25.474a26e5402cfd0d640965345065...
teleg####.nl/static/build/site_article_87251f30adaf.min.js
u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
w####.####.com/6ed84a8b77cf.js?lv=####

HTTP POST requests:

a####.####.com/app_logs
e####.####.com/ping
e####.####.com:8088/sdk/api/ad/hull_v2
m####.####.com/v2/register

Modified file system:

Creates the following files:

<Package Folder>/app_cache/ApplicationCache.db-journal
<Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
<Package Folder>/app_dex/reach-sdk.zip
<Package Folder>/app_dex/reach-sdk.zip.tmp
<Package Folder>/app_tmpdex/reach-sdk.zip
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_0 (deleted)
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_1 (deleted)
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_2 (deleted)
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/data_3 (deleted)
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index (deleted)
<Package Folder>/code_cache/####/<Package>-1.apk.classes-156131419.zip
<Package Folder>/code_cache/####/<Package>-1.apk.classes-470398759.zip
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/UmengLocalNotificationStore.db-journal
<Package Folder>/databases/Zuoyoo_db
<Package Folder>/databases/Zuoyoo_db-journal
<Package Folder>/databases/app.manager-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/reach.database.ad-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_BSSTV2S3BHXDP8X568KK_216
<Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
<Package Folder>/files/.imprint
<Package Folder>/files/.yflurryadlog.-37652fe7ceced2b4
<Package Folder>/files/.yflurrydatasenderblock.e69eaf61-3bce-46cb-839c-84dfe4380b74
<Package Folder>/files/.yflurryfreqcap.-37652fe7ceced2b4
<Package Folder>/files/.yflurryreport.-37652fe7ceced2b4
<Package Folder>/files/<Package>.zip
<Package Folder>/files/AppEventsLogger.persistedevents
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/dat.dat
<Package Folder>/files/lib.dat
<Package Folder>/files/libexec.so
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/snowfox_mid.so
<Package Folder>/files/snowfox_sdk_so-v22.jar
<Package Folder>/files/snowfox_v22.jar
<Package Folder>/files/snowfox_v22.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/AGOO_CONNECT.xml
<Package Folder>/shared_prefs/AGOO_HOST.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppStore.xml
<Package Folder>/shared_prefs/AppStore.xml.bak
<Package Folder>/shared_prefs/BSModelForPlaced.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/CountryRelevant.xml
<Package Folder>/shared_prefs/CurArticleInfo.xml
<Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
<Package Folder>/shared_prefs/GATHER.xml
<Package Folder>/shared_prefs/GATHER.xml.bak
<Package Folder>/shared_prefs/Game_recommend.xml
<Package Folder>/shared_prefs/Game_recommend.xml.bak
<Package Folder>/shared_prefs/MASTER_DATA.xml
<Package Folder>/shared_prefs/Module_Switch_DATA.xml
<Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
<Package Folder>/shared_prefs/PhoneUtil.xml
<Package Folder>/shared_prefs/Prophet.xml
<Package Folder>/shared_prefs/Reach.xml
<Package Folder>/shared_prefs/Reach.xml.bak
<Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
<Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
<Package Folder>/shared_prefs/coolook.minisite.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/sp_cache.xml.bak
<Package Folder>/shared_prefs/test.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/umeng_message_state.xml
<Package Folder>/shared_prefs/updateVer.xml
<Package Folder>/shared_prefs/v2_local_login.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/<Package>/####/016fc263e42a88b73f94eed84e97ff9a.jpg
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/222F4211B0923AE9042860C9E252EA73
<SD-Card>/Android/####/2yusinm2rkywdc11qxg0n4lup.0.tmp
<SD-Card>/Android/####/37way6sghmg4qdb8n1u9aeax2.0.tmp
<SD-Card>/Android/####/3B51F7B1BE17DC8E59610B3F62C7847C
<SD-Card>/Android/####/3w1nciday7eocv14qexy2zcqf.0.tmp
<SD-Card>/Android/####/5lxhyicy8khrucm0n4s3z5fn9.0.tmp
<SD-Card>/Android/####/6iesspr5711axr89uipkspnu1.0.tmp
<SD-Card>/Android/####/71kwxwrfi7100dwjfthap1597.0.tmp
<SD-Card>/Android/####/7bm49evedwkg5wrg69xpl4qsi.0.tmp
<SD-Card>/Android/####/7e2r4c4cilxkb58gnecubo2ml.0.tmp
<SD-Card>/Android/####/delay_20170531072600731_c659b62501e1fa1bf0fd2da344c1323a_s.dat
<SD-Card>/Android/####/delay_20170531072602323_c659b62501e1fa1bf0fd2da344c1323a_b.dat
<SD-Card>/Android/####/delay_20170531072614378_c659b62501e1fa1bf0fd2da344c1323a_s.dat
<SD-Card>/Android/####/delay_20170531072619058_c659b62501e1fa1bf0fd2da344c1323a_s.dat
<SD-Card>/Android/####/delay_20170531072619254_c659b62501e1fa1bf0fd2da344c1323a_s.dat
<SD-Card>/Android/####/dev_772e456c.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/journal.tmp

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A5927f5685312dd3956000f78%22%2C%22utdid%22%3A%22WS5wCVP9T7IDAGdzx1GmhLcg%22%2C%22sdkVersion%22%3A%2220151015%22%7D -I 100.69.168.33 -O 80 -T -Z
<dexopt>
chmod 500 <Package Folder>/files/DaemonServer
getprop ro.product.cpu.abi
sh

Uses special library to hide executable bytecode.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial