Android.Packed.24767

Technical information

Malicious functions:

Executes code of the following detected threats:

Tool.SilentInstaller.3.origin

Downloads the following detected threats from the Web:

Tool.SilentInstaller.3.origin

Network activity:

Connecting to:

1####.####.51
1####.####.52
36####.com
a####.####.com
and####.####.com
c####.####.cn
c####.####.com
d####.####.com
h####.####.com
huo####.####.cn
m####.####.cn
m####.####.com
ope####.####.cn
p####.####.cn
p####.####.com
s####.####.cn
s####.####.com
sh####.####.com
t####.####.com

HTTP GET requests:

1####.####.51/down.360safe.com/360kan/sohu_3_armV6.apk
1####.####.52/down.360safe.com/360kan/bestv_6_armV6.apk
36####.com/tv/PblpbX7kTzPqMn.html
a####.####.com/t/tanxssp.js?_v=####
and####.####.com/cloud/?method=####&m=####&ss=####&token=####&ver=####&c...
c####.####.cn/HUID.SET?_=####
c####.####.com/all
d####.####.com/360kan/pptv_3_armV6.apk
h####.####.com/170515/85ae2a2e34781ae233479876fbd1a938/com.qihoo.appstor...
huo####.####.cn/html/tghfcqzpush0707.html?from=####
m####.####.com/download/h5
ope####.####.cn/channel/getUrl?src=####&app=####
p####.####.com/ad/360kan/FBQf8Q.html
p####.####.com/d/inn/254a7107/images/bg_02.png
p####.####.com/ex?i=####
p####.####.com/t01155a5513a442be47.png
p####.####.com/t0135fd5a00a7944575.png
p####.####.com/t0138a5be69a4b76db3.png
p####.####.com/t0146b0375b5518de65.png
p####.####.com/t015116a85e7755c0e7.jpg
p####.####.com/t016980408b5ff06155.jpg
p####.####.com/t0171d923983f4e7d56.png
p####.####.com/t01b4f6702948acfd86.png
p####.####.com/t01ba9abd3415338bc7.png
p####.####.com/t01d3ffa252d4ebe85f.png
p####.####.com/t01d682c494ec8f2710.png
p####.####.com/t01d7e06ac4fb1b5117.jpg
p####.####.com/t01d9e259716e149cd8.png
s####.####.cn/haostat/haopv.gif?t=####&p=####&s=####&u=####&b=####&c=###...
s####.####.cn/t010a6a5221da135a56.png
s####.####.com/!12a4c78d/mgamer.js
s####.####.com/!2c85d6fa/jquery-2.2.4.min.js
s####.####.com/!c5e5cf2d/zepto.js
s####.####.com/monitor/;monitor/445ca40a.js
s####.####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&w=AAAAA#...
s####.####.com/static/5b6319e361d2a2be,e2b94b88845f9e4a,2bae9bbd81d0152d...
s####.####.com/static/6b430db3ee92470f.js
s####.####.com/static/970a5b4a9786619b/mustache.js
s####.####.com/static/e14c81d4fe5e38cb,2447fb5b32d0b35a.js
s####.####.com/static/f5407c785655e6a1/monitor_analytic.js
sh####.####.com/s?type=####&r=####&tid=####&finfo=####&mv_ref=####&enup=...
t####.####.com/clk.gif?t=####&track=####&p=####&u=####&b=####&c=####&r=#...

HTTP POST requests:

m####.####.cn/list/get?product=####&version=####
p####.####.cn/update/update.php?p=####

Modified file system:

Creates the following files:

/data/anr/traces.txt
<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_RePlugin/p-n-freewifi.jar.lock
<Package Folder>/app_RePlugin/p-n-freewifi.jar_tmp_0.tmp
<Package Folder>/app_RePlugin/p-n-safegift.jar.lock
<Package Folder>/app_RePlugin/p-n-safegift.jar_tmp_0.tmp
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_plugin/bestv_6_armV6.apk_new_0.tmp
<Package Folder>/app_plugin/pptv_3_armV6.apk_new_0.tmp
<Package Folder>/app_plugin/qq_1_armV6.apk_new_0.tmp
<Package Folder>/app_plugin/sohu_3_armV6.apk_new_0.tmp
<Package Folder>/app_plugins_v3/plugin.tmp
<Package Folder>/app_plugins_v3_libs/####/libsecurity-1.0.so
<Package Folder>/app_plugins_v3_odex/freewifi-10-10-249.dex
<Package Folder>/app_plugins_v3_odex/safegift-11-11-104.dex
<Package Folder>/app_videolib_4.6.12_ZipFolderTemp/libmediaplayer-armeabi.so
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/f_00003a
<Package Folder>/cache/####/f_00003b
<Package Folder>/cache/####/f_00003c
<Package Folder>/cache/####/f_00003d
<Package Folder>/cache/####/f_00003e
<Package Folder>/cache/####/index
<Package Folder>/databases/mzmonitor
<Package Folder>/databases/mzmonitor-journal
<Package Folder>/databases/newsoftgiftgameunion.db
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/databases/video.db
<Package Folder>/databases/video.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/35925aa5d3c1f33f5506fe49b777f504
<Package Folder>/files/####/5098a445ce211d3bb4d8ef2724c48206
<Package Folder>/files/####/53a2c1213eac0048b54b2c6ffc6874ee
<Package Folder>/files/####/612773f8e8d71cb9fbb25460fb7e9158
<Package Folder>/files/####/Y29tLnFpaG9vLnZpZGVv.tick.lock
<Package Folder>/files/####/a==7.1.0&&4.2.1_1496213079661_envelope.log
<Package Folder>/files/####/ae656de538
<Package Folder>/files/####/bc0f4d44b7c38c1f6ac0a4c2712d7b11
<Package Folder>/files/####/config
<Package Folder>/files/####/dynamic1128.dex
<Package Folder>/files/####/dynamic1128.jar
<Package Folder>/files/####/e091a9d80acaf54d816295c68b470b50
<Package Folder>/files/####/e5c3321059e64bd55c707472266fd54b
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/f489f16ba824b8889b64c9d567d33691
<Package Folder>/files/####/finalcore.dex
<Package Folder>/files/####/finalcore.jar
<Package Folder>/files/####/finalcore.jar.tmp
<Package Folder>/files/####/global.dex
<Package Folder>/files/####/global.jar
<Package Folder>/files/####/wifiplug.dat
<Package Folder>/files/.imprint
<Package Folder>/files/armeabi.zip_0.tmp
<Package Folder>/files/cover_config
<Package Folder>/files/exid.dat
<Package Folder>/files/plugin_v3.lock
<Package Folder>/files/record_file
<Package Folder>/files/syscall
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/GlobalFlag.xml
<Package Folder>/shared_prefs/QH_DeviceSDK.xml
<Package Folder>/shared_prefs/QH_SDK_M2.xml
<Package Folder>/shared_prefs/QH_SDK_UserData.xml
<Package Folder>/shared_prefs/QH_SDK_UserData26657d5ff9020d2abefe558796b99584.xml
<Package Folder>/shared_prefs/QH_SDK_sessionID.xml
<Package Folder>/shared_prefs/ad_percent.xml
<Package Folder>/shared_prefs/freewifi.xml
<Package Folder>/shared_prefs/key_dnscache.xml
<Package Folder>/shared_prefs/mediav_settings.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/plugins.xml
<Package Folder>/shared_prefs/profile_torch_platform.xml
<Package Folder>/shared_prefs/sdk_config.xml
<Package Folder>/shared_prefs/settings.xml
<Package Folder>/shared_prefs/share_roomip.xml
<Package Folder>/shared_prefs/torch_sdk_config.xml
<Package Folder>/shared_prefs/umeng_common_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/universal.pref.xml
<Package Folder>/shared_prefs/ver_info.xml
<SD-Card>/.sfp/.sfp
<SD-Card>/.testf
<SD-Card>/360/####/26657d5ff9020d2abefe558796b99584
<SD-Card>/360/####/EWm
<SD-Card>/360/####/EWm (deleted)
<SD-Card>/360/####/Y29tLnFpaG9vLnZpZGVv
<SD-Card>/360/####/Y29tLnFpaG9vLnZpZGVv (deleted)
<SD-Card>/360/####/eDB
<SD-Card>/360/####/eDB (deleted)
<SD-Card>/360/.deviceId
<SD-Card>/360Video/####/.file_log
<SD-Card>/360Video/####/360Video.log
<SD-Card>/360Video/####/360Video.log.old
<SD-Card>/360Video/####/appstore_0.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/.sfp
<SD-Card>/Android/####/.testf
<SD-Card>/Android/####/.testf (deleted)
<SD-Card>/Android/####/mvad_updatesdk_error

Miscellaneous:

Executes next shell scripts:

/data/data/com.qihoo.video/files/syscall com.qihoo.video 1800 am startservice -a com.qihoo.video.PUSHSERVICE --user 0
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<dexopt>
chmod 755 /data/data/com.qihoo.video/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.jiagu/libjiagu.so
logcat -v time
sh <Package Folder>/files/syscall <Package> 1800 am startservice -a <Package>.PUSHSERVICE --user 0

Uses special library to hide executable bytecode.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial