Android.Packed.25555

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSpy.677.origin

Downloads the following detected threats from the Web:

Android.SmsSpy.677.origin

Network activity:

Connecting to:

1####.####.65
1####.####.65:4701
a####.####.com
hangzho####.####.com
q####.####.com:14302
z####.####.com
z####.####.com:9500
zxc####.####.com
zxc####.####.com:8200

HTTP GET requests:

hangzho####.####.com/qiyi/client/sdk/so/libzxvps.so

HTTP POST requests:

1####.####.65/forwardapi/init
1####.####.65:4701/forwardupdate/update
a####.####.com/app_logs
q####.####.com:14302/sdk_login?t=####
z####.####.com/
z####.####.com:9500/
zxc####.####.com/qy/getOnlineLoginHttpReq
zxc####.####.com:8200/qy/acceptSdkFileReq

Modified file system:

Creates the following files:

<Package Folder>/2163.dex
<Package Folder>/app_td-cache/tdandroidgame
<Package Folder>/cache/2163.dex (deleted)
<Package Folder>/databases/qy_db_pay
<Package Folder>/databases/qy_db_pay-journal
<Package Folder>/files/####/.gitkeep
<Package Folder>/files/####/00fmScene.json
<Package Folder>/files/####/01gameScene.json
<Package Folder>/files/####/01intro.mp3
<Package Folder>/files/####/02pop3.mp3
<Package Folder>/files/####/02tongjiScene.json
<Package Folder>/files/####/04pop.mp3
<Package Folder>/files/####/04tihuanScene.json
<Package Folder>/files/####/06pop3.mp3
<Package Folder>/files/####/07lazer.mp3
<Package Folder>/files/####/08coin.mp3
<Package Folder>/files/####/11kick.mp3
<Package Folder>/files/####/12system.mp3
<Package Folder>/files/####/13wow.mp3
<Package Folder>/files/####/2222.png
<Package Folder>/files/####/Marker Felt.ttf
<Package Folder>/files/####/a003.png
<Package Folder>/files/####/a010.png
<Package Folder>/files/####/a04.png
<Package Folder>/files/####/a05.png
<Package Folder>/files/####/a06.png
<Package Folder>/files/####/a07.png
<Package Folder>/files/####/a08.png
<Package Folder>/files/####/a09.png
<Package Folder>/files/####/about.png
<Package Folder>/files/####/arrow.png
<Package Folder>/files/####/arrow1.png
<Package Folder>/files/####/back0.png
<Package Folder>/files/####/back0a.png
<Package Folder>/files/####/back0b.png
<Package Folder>/files/####/back0c.png
<Package Folder>/files/####/back0d.png
<Package Folder>/files/####/back0e.png
<Package Folder>/files/####/back0f.png
<Package Folder>/files/####/back0h.png
<Package Folder>/files/####/back0i.png
<Package Folder>/files/####/baidu
<Package Folder>/files/####/ball000.png
<Package Folder>/files/####/ball001.png
<Package Folder>/files/####/ball002.png
<Package Folder>/files/####/ball003.png
<Package Folder>/files/####/ball004.png
<Package Folder>/files/####/ball004a.png
<Package Folder>/files/####/ball004b.png
<Package Folder>/files/####/ball005.png
<Package Folder>/files/####/ball006.png
<Package Folder>/files/####/ball007.png
<Package Folder>/files/####/ball008.png
<Package Folder>/files/####/ball009.png
<Package Folder>/files/####/ball010.png
<Package Folder>/files/####/ball011.png
<Package Folder>/files/####/ball012.png
<Package Folder>/files/####/ball013.png
<Package Folder>/files/####/ball014.png
<Package Folder>/files/####/ball015.png
<Package Folder>/files/####/ball016.png
<Package Folder>/files/####/ball017.png
<Package Folder>/files/####/ball018.png
<Package Folder>/files/####/ball019.png
<Package Folder>/files/####/ball020.png
<Package Folder>/files/####/ballAnimation.ExportJson
<Package Folder>/files/####/ballAnimation0.plist
<Package Folder>/files/####/ballAnimation0.png
<Package Folder>/files/####/bbballParticle_1.plist
<Package Folder>/files/####/bbballParticle_2.plist
<Package Folder>/files/####/bbballParticle_3.plist
<Package Folder>/files/####/bbballParticle_4.plist
<Package Folder>/files/####/bbballParticle_5.plist
<Package Folder>/files/####/bbballParticle_7.plist
<Package Folder>/files/####/bbballParticle_8.plist
<Package Folder>/files/####/bbballUi_1.json
<Package Folder>/files/####/bbballUi_2.json
<Package Folder>/files/####/bbballUi_3.json
<Package Folder>/files/####/bbballUi_4.json
<Package Folder>/files/####/bbballUi_5.json
<Package Folder>/files/####/beiban.png
<Package Folder>/files/####/best.png
<Package Folder>/files/####/bg.png
<Package Folder>/files/####/bg1.png
<Package Folder>/files/####/bg2.png
<Package Folder>/files/####/bgStore.png
<Package Folder>/files/####/choudanzhu.png
<Package Folder>/files/####/d001.png
<Package Folder>/files/####/d002.png
<Package Folder>/files/####/d003.png
<Package Folder>/files/####/d004.png
<Package Folder>/files/####/d006.png
<Package Folder>/files/####/di1.png
<Package Folder>/files/####/di1a.png
<Package Folder>/files/####/di2.png
<Package Folder>/files/####/f001.png
<Package Folder>/files/####/f002.png
<Package Folder>/files/####/f003.png
<Package Folder>/files/####/f004.png
<Package Folder>/files/####/f007.png
<Package Folder>/files/####/f008.png
<Package Folder>/files/####/f009.png
<Package Folder>/files/####/finger.png
<Package Folder>/files/####/fm01.png
<Package Folder>/files/####/fm02.png
<Package Folder>/files/####/fm02a.png
<Package Folder>/files/####/fm11a.png
<Package Folder>/files/####/fm12.png
<Package Folder>/files/####/fmtest.png
<Package Folder>/files/####/g001.png
<Package Folder>/files/####/g002.png
<Package Folder>/files/####/g003.png
<Package Folder>/files/####/g004.png
<Package Folder>/files/####/g005.png
<Package Folder>/files/####/g006.png
<Package Folder>/files/####/g007.png
<Package Folder>/files/####/g008.png
<Package Folder>/files/####/g009.png
<Package Folder>/files/####/g010.png
<Package Folder>/files/####/g011.png
<Package Folder>/files/####/g012.png
<Package Folder>/files/####/g013.png
<Package Folder>/files/####/g014.png
<Package Folder>/files/####/health.png
<Package Folder>/files/####/help0.png
<Package Folder>/files/####/help0a.png
<Package Folder>/files/####/hero.ExportJson
<Package Folder>/files/####/hero0.plist
<Package Folder>/files/####/hero0.png
<Package Folder>/files/####/i001.png
<Package Folder>/files/####/i001a.png
<Package Folder>/files/####/i002.png
<Package Folder>/files/####/i003.png
<Package Folder>/files/####/i005.png
<Package Folder>/files/####/i008.png
<Package Folder>/files/####/i010.png
<Package Folder>/files/####/item_KaiGuan3_on.png
<Package Folder>/files/####/jiage.png
<Package Folder>/files/####/jinbi0.png
<Package Folder>/files/####/jinbi1.png
<Package Folder>/files/####/kefu.png
<Package Folder>/files/####/kefu1.png
<Package Folder>/files/####/kz.png
<Package Folder>/files/####/l002.png
<Package Folder>/files/####/landscape.png
<Package Folder>/files/####/libmiguED.so
<Package Folder>/files/####/lizi0.png
<Package Folder>/files/####/lizi1.png
<Package Folder>/files/####/lizi3.png
<Package Folder>/files/####/lizi4.png
<Package Folder>/files/####/lizi5.png
<Package Folder>/files/####/logo.png
<Package Folder>/files/####/logo2.png
<Package Folder>/files/####/lottery.png
<Package Folder>/files/####/marbles.png
<Package Folder>/files/####/name000.png
<Package Folder>/files/####/name001.png
<Package Folder>/files/####/name002.png
<Package Folder>/files/####/name003.png
<Package Folder>/files/####/name004.png
<Package Folder>/files/####/name005.png
<Package Folder>/files/####/name006.png
<Package Folder>/files/####/name007.png
<Package Folder>/files/####/name008.png
<Package Folder>/files/####/name009.png
<Package Folder>/files/####/name010.png
<Package Folder>/files/####/name011.png
<Package Folder>/files/####/name012.png
<Package Folder>/files/####/name013.png
<Package Folder>/files/####/name014.png
<Package Folder>/files/####/name015.png
<Package Folder>/files/####/name016.png
<Package Folder>/files/####/name017.png
<Package Folder>/files/####/name018.png
<Package Folder>/files/####/name019.png
<Package Folder>/files/####/name020.png
<Package Folder>/files/####/novice.png
<Package Folder>/files/####/num0.png
<Package Folder>/files/####/num01.png
<Package Folder>/files/####/num0111.png
<Package Folder>/files/####/num1.png
<Package Folder>/files/####/num2.png
<Package Folder>/files/####/num3.png
<Package Folder>/files/####/num_100.png
<Package Folder>/files/####/number0.png
<Package Folder>/files/####/portrait.png
<Package Folder>/files/####/receive0.png
<Package Folder>/files/####/receive1.png
<Package Folder>/files/####/receive2.png
<Package Folder>/files/####/shop01.png
<Package Folder>/files/####/shop02.png
<Package Folder>/files/####/shop03.png
<Package Folder>/files/####/shop04.png
<Package Folder>/files/####/shop05.png
<Package Folder>/files/####/shop06.png
<Package Folder>/files/####/shop06a.png
<Package Folder>/files/####/shop06b.png
<Package Folder>/files/####/shop06c.png
<Package Folder>/files/####/shop06d.png
<Package Folder>/files/####/shop06e.png
<Package Folder>/files/####/shop08.png
<Package Folder>/files/####/shop10.png
<Package Folder>/files/####/shopScene.json
<Package Folder>/files/####/smooth.png
<Package Folder>/files/####/stop0.png
<Package Folder>/files/####/stop0a.png
<Package Folder>/files/####/timeper1.png
<Package Folder>/files/####/timeper2.png
<Package Folder>/files/####/tishi.png
<Package Folder>/files/####/tishiAnimation.ExportJson
<Package Folder>/files/####/tishiAnimation.csb
<Package Folder>/files/####/tishiAnimation0.plist
<Package Folder>/files/####/tishiAnimation0.png
<Package Folder>/files/####/tj05.png
<Package Folder>/files/####/tj06.png
<Package Folder>/files/####/tj06b.png
<Package Folder>/files/####/tj06c.png
<Package Folder>/files/####/tj06d.png
<Package Folder>/files/####/tj07.png
<Package Folder>/files/####/tj07a.png
<Package Folder>/files/####/tj08.png
<Package Folder>/files/####/tj09.png
<Package Folder>/files/####/tj10.png
<Package Folder>/files/####/tj11.png
<Package Folder>/files/####/tj12.png
<Package Folder>/files/####/tj13.png
<Package Folder>/files/####/tj14.png
<Package Folder>/files/####/tj16.png
<Package Folder>/files/####/tj17.png
<Package Folder>/files/####/tj19.png
<Package Folder>/files/####/tj20.png
<Package Folder>/files/####/uiAnimation.ExportJson
<Package Folder>/files/####/uiAnimation0.plist
<Package Folder>/files/####/uiAnimation0.png
<Package Folder>/files/####/uiAnimation1.plist
<Package Folder>/files/####/uiAnimation1.png
<Package Folder>/files/####/uiAnimation2.plist
<Package Folder>/files/####/uiAnimation2.png
<Package Folder>/files/####/uiAnimation3.plist
<Package Folder>/files/####/uiAnimation3.png
<Package Folder>/files/####/wb01.png
<Package Folder>/files/####/wb02.png
<Package Folder>/files/####/x.png
<Package Folder>/files/####/x34.png
<Package Folder>/files/####/xxx1.png
<Package Folder>/files/####/xxx2.png
<Package Folder>/files/####/xxx3.png
<Package Folder>/files/####/xxx4.png
<Package Folder>/files/####/xxxx.png
<Package Folder>/files/####/yuan.png
<Package Folder>/files/####/zhuankuaiAnimation.ExportJson
<Package Folder>/files/####/zhuankuaiAnimation0.plist
<Package Folder>/files/####/zhuankuaiAnimation0.png
<Package Folder>/files/####/zhuankuaiParticle_1.plist
<Package Folder>/files/.imprint
<Package Folder>/files/MiguPay.Sdk30.Lib_12003022_9b71bb40aaac4f7d8d553cfe7a8d79e0_BN202.cod
<Package Folder>/files/MiguPay.Sdk30.Lib_12003022_9b71bb40aaac4f7d8d553cfe7a8d79e0_BN202.dat
<Package Folder>/files/PaySDK-1.2.13.16-UR_yx.jar
<Package Folder>/files/PaySDK-1.2.13.16-UR_yx.zip
<Package Folder>/files/forward_pay_370.jar
<Package Folder>/files/getprop
<Package Folder>/files/libmgRun_04.22.08_01.so
<Package Folder>/files/mgAS.dat
<Package Folder>/files/mgSS.dat
<Package Folder>/files/mgid.dat
<Package Folder>/files/pid
<Package Folder>/files/umeng_it.cache
<Package Folder>/libzxvps/####/libzxvps.so
<Package Folder>/libzxvps/####/tmp_so
<Package Folder>/shared_prefs/<IMSI>|account_file.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/unknown.xml
<SD-Card>/.Systemp/.cfg
<SD-Card>/.Systemp/device

Miscellaneous:

Executes next shell scripts:

/system/bin/sh
<dexopt>
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.tencent.mm.f.s.a
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/lib/process
dd if=<Package Folder>/lib/libprocess.so of=<Package Folder>/lib/process
getprop
ls -l /sbin/su
ls -l /system/bin/su
ls -l /system/sbin/su
ls -l /system/xbin/su
ls -l /vendor/bin/su
ps | grep <Package>
ps | grep com.aiwan.tencent.bbgame
sh

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial