Android.Packed.26945

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.125.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

a####.####.com
a####.####.net
a####.####.org
admobim####.com
ald####.com
api####.####.com
apirepo####.####.com
b####.com
c####.####.com
cdn####.####.com
con####.####.com
cpgnrot####.com
d####.####.com
d####.####.xyz
f####.####.com
face####.com
fk-mt####.####.com
g####.####.com
g####.####.net
i####.####.com
m####.####.com
ma####.####.com
mmmmmm####.com
mobilem####.me
mobotoo####.####.com
n####.####.com
o####.####.com
p####.####.com
pag####.####.com
pass####.####.com
pl####.####.com
r####.####.com
real####.####.org
s####.####.com
sc####.####.com
se####.####.com
serv####.####.com
set####.####.com
synct####.com
t####.####.com
t####.global
technol####.####.uk
trac####.####.com
u####.####.com

HTTP GET requests:

a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####...
a####.####.com/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&sd...
a####.####.com/mpapi/ad?model=####&fomat=####&mcc=####&os_v=####&directi...
a####.####.net/api/v2/template/get?slot_id=####&update_time=####
a####.####.org/rule?platform=####&os_version=####&package_name=####&app_...
ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
apirepo####.####.com/apiClick?ts=####&clickId=####&ifa=####&cidRev=####&...
b####.com/rms/AutoSug/cj,nj/48de7247/3afd2d12.js?bu=####
c####.####.com/?utm_medium=####&utm_campaign=####&cid=####&1=####
c####.####.com/click?transaction_id=####&aff_sub=####&aff_sub2=####&aff_...
cdn####.####.com/cdn-adn/offersync/17/05/19/17/35/591ebc46dd6cf.png
cpgnrot####.com/campaign/2292%7C518?tag=####&website=####&placement=####
d####.####.com/M00/01/AB/CvJMDVlBJNyAE3AUAAVgxYzjtNE875.zip
d####.####.xyz/?s3=####&s1=####&kw=####
f####.####.com/css?family=####&ver=####
f####.####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4.ttf
face####.com/plugins/likebox.php?href=####&w####&height=####&colorscheme...
fk-mt####.####.com/ad/log/pv?k=####&mp=####&source_url=####
g####.####.com/?utm_medium=####&utm_campaign=####&1=####&cid=####
g####.####.net/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&affid...
i####.####.com/sound_on.png
ma####.####.com/frontend/cardList.htm?isrecmd=####&ran=####&ismsg=####&i...
mobilem####.me/r/c216bc5a-7f07-11e7-ac85-1144b377e414/1/
mobotoo####.####.com/mobotoolpush/addispsort.json?facebook=####&language...
n####.####.com/mu3/game/20161112/00/1478882027637/icon/icon_o.png
n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
o####.####.com/ipo/api/gray/status?appvc=####&os=####&appvn=####&avn=###...
p####.####.com/ads-service/ads/service/getAdlist.do?adnum=####&adid=####...
p####.####.com/notification/android/message.json?pname=####&version=####...
pag####.####.com/pagead/js/r20170807/r20170110/reactive_library.js
pass####.####.com/android/v2/getDoSignInfo.htm?uid=####&versionCode=####...
r####.####.com/2.0/ad?v1=####&model=####&etf=####&dx=####&dy=####&accept...
real####.####.org/realtime?platform=####&os_version=####&package_name=##...
sc####.####.com/v1/scheme/placement?model=####&mcc=####&os_v=####&direct...
serv####.####.com/119987?t=####&ref=####&lu=####
set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
synct####.com/d/26252559142536b2530?sub=####
t####.####.com/click?_type=####&sdk_redir=####&campid=####&sub_channel=#...
t####.global/view/apvir0egqVHNMIy4NMBOLVBIQPpNLO7sULpjV8hrtsULpvnwg?c=##...
technol####.####.uk/wp-content/themes/yeahthemes-sparkle/style.css
trac####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
u####.####.com/setting/grobal_strategy?p=####&hp=####&l=####&c=####&prod...

HTTP POST requests:

admobim####.com/surl/api2_reg.action
api####.####.com/v3/log/init
con####.####.com/log/log_apps
m####.####.com/detail/getOfferListNew?enc=####
mmmmmm####.com/osp/oaen_reg.action
p####.####.com/getUpMessage.htm
pl####.####.com/ad_dex.php
s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
se####.####.com/android/checkIn.htm
se####.####.com/initRequestDomain.htm
se####.####.com/moboapi/switch.htm

Modified file system:

Creates the following files:

<Package Folder>/.mbj/####/classes.zip
<Package Folder>/cache/####/0548391082cfd49909b29fe2d1b80226.0.tmp
<Package Folder>/cache/####/0548391082cfd49909b29fe2d1b80226.1.tmp
<Package Folder>/cache/####/09ac570d10a28c0c08ecee080ceb90a7.0.tmp
<Package Folder>/cache/####/09ac570d10a28c0c08ecee080ceb90a7.1.tmp
<Package Folder>/cache/####/10d0f4fe07dbedb0d0b344981a7a89a4.0.tmp
<Package Folder>/cache/####/10d0f4fe07dbedb0d0b344981a7a89a4.1.tmp
<Package Folder>/cache/####/11af0edbf3eeb4b4caca07dd33c58438.0.tmp
<Package Folder>/cache/####/11af0edbf3eeb4b4caca07dd33c58438.1.tmp
<Package Folder>/cache/####/1c569af055d95d85afea5e8b9a0509e8.0.tmp
<Package Folder>/cache/####/1c569af055d95d85afea5e8b9a0509e8.1.tmp
<Package Folder>/cache/####/2059e716def740632c3fc5a2fb76d9fc.0
<Package Folder>/cache/####/2059e716def740632c3fc5a2fb76d9fc.1
<Package Folder>/cache/####/277b2e6013d3e0d19fb2fe0c410a8b1f.0.tmp
<Package Folder>/cache/####/277b2e6013d3e0d19fb2fe0c410a8b1f.1.tmp
<Package Folder>/cache/####/27895a4bc1899bce42a934e85086ee28.0.tmp
<Package Folder>/cache/####/27895a4bc1899bce42a934e85086ee28.1
<Package Folder>/cache/####/3cf350287a763838884a8bb61fd07087.0.tmp
<Package Folder>/cache/####/3cf350287a763838884a8bb61fd07087.1
<Package Folder>/cache/####/42a55ceb87a05db410ff579c7e1a30ad.0.tmp
<Package Folder>/cache/####/42a55ceb87a05db410ff579c7e1a30ad.1.tmp
<Package Folder>/cache/####/48c6318a5a067fb9b7234f8e4074eb41.0.tmp
<Package Folder>/cache/####/48c6318a5a067fb9b7234f8e4074eb41.1.tmp
<Package Folder>/cache/####/5285044de8e4db72b86e7246f9aee7c2.0.tmp
<Package Folder>/cache/####/5285044de8e4db72b86e7246f9aee7c2.1.tmp
<Package Folder>/cache/####/637bcf779e8a476965fb4296552b99c7.0.tmp
<Package Folder>/cache/####/637bcf779e8a476965fb4296552b99c7.1.tmp
<Package Folder>/cache/####/644442ef6580bfada6d1901e8aa8c634.0.tmp
<Package Folder>/cache/####/644442ef6580bfada6d1901e8aa8c634.1
<Package Folder>/cache/####/6ac6c5727bb621cf17d8acf4851aaa7e.0.tmp
<Package Folder>/cache/####/6ac6c5727bb621cf17d8acf4851aaa7e.1.tmp
<Package Folder>/cache/####/70594694b795809267b00a383e3a0e3e.0.tmp
<Package Folder>/cache/####/70594694b795809267b00a383e3a0e3e.1.tmp
<Package Folder>/cache/####/71bd5e215c19e55403412e9d82bf69e0.0.tmp
<Package Folder>/cache/####/71bd5e215c19e55403412e9d82bf69e0.1.tmp
<Package Folder>/cache/####/8111375db8866aa753a70243c875a9d6.0.tmp
<Package Folder>/cache/####/8111375db8866aa753a70243c875a9d6.1.tmp
<Package Folder>/cache/####/838f49755978596f822d8b720455f8c4.0.tmp
<Package Folder>/cache/####/838f49755978596f822d8b720455f8c4.1.tmp
<Package Folder>/cache/####/8817f1e992adaecf7cca9cc729f74fe6.0.tmp
<Package Folder>/cache/####/8817f1e992adaecf7cca9cc729f74fe6.1
<Package Folder>/cache/####/8b36120f32df50b26f7118d145a05622.0
<Package Folder>/cache/####/8b36120f32df50b26f7118d145a05622.1
<Package Folder>/cache/####/9412abff4f1a5b74bd1f89efa6399653.0.tmp
<Package Folder>/cache/####/9412abff4f1a5b74bd1f89efa6399653.1.tmp
<Package Folder>/cache/####/a64e4940b33d43d5a587d9716add3915.0
<Package Folder>/cache/####/a64e4940b33d43d5a587d9716add3915.1
<Package Folder>/cache/####/a9412cf8e19ce1d974da7adbc0e8b6d1.0
<Package Folder>/cache/####/a9412cf8e19ce1d974da7adbc0e8b6d1.1
<Package Folder>/cache/####/b195cc01392a3906aa3f30cbd40aa30a.0.tmp
<Package Folder>/cache/####/b195cc01392a3906aa3f30cbd40aa30a.1.tmp
<Package Folder>/cache/####/b4353c78e773bcb0a0fbc4a48ad7f658.0.tmp
<Package Folder>/cache/####/b4353c78e773bcb0a0fbc4a48ad7f658.1.tmp
<Package Folder>/cache/####/b5d7c103da328273f242d39a4edee629.0.tmp
<Package Folder>/cache/####/b5d7c103da328273f242d39a4edee629.1
<Package Folder>/cache/####/b684a1df8e6e9cf3ecfd65d14240b55a.0
<Package Folder>/cache/####/b684a1df8e6e9cf3ecfd65d14240b55a.1
<Package Folder>/cache/####/b783222caa502b23d6c4bbe601883052.0
<Package Folder>/cache/####/b783222caa502b23d6c4bbe601883052.1
<Package Folder>/cache/####/bc33d0cfe23094f1c13d21db9d6a20cd.0.tmp
<Package Folder>/cache/####/bc33d0cfe23094f1c13d21db9d6a20cd.1
<Package Folder>/cache/####/bd022463c18c12a547cd53bb06a0d973.0.tmp
<Package Folder>/cache/####/bd022463c18c12a547cd53bb06a0d973.1
<Package Folder>/cache/####/bd08377fa23a2e3798c4958334924cfd.0.tmp
<Package Folder>/cache/####/bd08377fa23a2e3798c4958334924cfd.1.tmp
<Package Folder>/cache/####/d149467676fd959a5a11be2498d059cc.0.tmp
<Package Folder>/cache/####/d149467676fd959a5a11be2498d059cc.1.tmp
<Package Folder>/cache/####/d4019feee87eb584ffb1ec32787a018f.0.tmp
<Package Folder>/cache/####/d4019feee87eb584ffb1ec32787a018f.1
<Package Folder>/cache/####/d5c00ba6d8782f42877959bfb7be7b58.0.tmp
<Package Folder>/cache/####/d5c00ba6d8782f42877959bfb7be7b58.1.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e645cb595a9b4e63ca75975bc68cb856.0
<Package Folder>/cache/####/e645cb595a9b4e63ca75975bc68cb856.1
<Package Folder>/cache/####/f5207858b63ffe4989d6854637e08ea1.0.tmp
<Package Folder>/cache/####/f5207858b63ffe4989d6854637e08ea1.1.tmp
<Package Folder>/cache/####/f6fd6936ee65918b5035e185ada6ad88.0.tmp
<Package Folder>/cache/####/f6fd6936ee65918b5035e185ada6ad88.1.tmp
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/fe5c93839b1d1122297543ab980f0ecd.0.tmp
<Package Folder>/cache/####/fe5c93839b1d1122297543ab980f0ecd.1.tmp
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/code_cache/####/<Package>-1.apk.classes-1866561024.zip
<Package Folder>/databases/MessageStore.db-journal
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/accs.db-journal
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/download_file.db-journal
<Package Folder>/databases/du_ad_cache.db-journal
<Package Folder>/databases/du_ad_parse.db-journal
<Package Folder>/databases/du_ad_ts.db-journal
<Package Folder>/databases/du_weather_data.db-journal
<Package Folder>/databases/evernote_jobs.db-journal
<Package Folder>/databases/message_accs_db
<Package Folder>/databases/message_accs_db-journal
<Package Folder>/databases/mobogenie.db
<Package Folder>/databases/mobogenie.db-journal
<Package Folder>/databases/mobogenie_music.db
<Package Folder>/databases/mobogenie_music.db-journal
<Package Folder>/databases/mobogenie_update.db
<Package Folder>/databases/mobogenie_update.db-journal
<Package Folder>/databases/mobpower.db-journal
<Package Folder>/databases/mobvista.msdk.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/self_ad_db
<Package Folder>/databases/self_ad_db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
<Package Folder>/databases/ztrack.db-journal
<Package Folder>/eudemon
<Package Folder>/files/####/598466FB03DA-0001-0855-B67E0B992680BeginSession.cls
<Package Folder>/files/####/598466FB03DA-0001-0855-B67E0B992680SessionApp.cls_temp
<Package Folder>/files/####/598466FB03DA-0001-0855-B67E0B992680SessionDevice.cls_temp
<Package Folder>/files/####/598466FB03DA-0001-0855-B67E0B992680SessionOS.cls_temp
<Package Folder>/files/####/598466FB03DA-0001-0855-B67E0B992680SessionUser.cls_temp
<Package Folder>/files/####/598466FC006A-0001-0837-B67E0B992680BeginSession.cls_temp
<Package Folder>/files/####/598466FC006A-0001-0837-B67E0B992680SessionApp.cls_temp
<Package Folder>/files/####/598466FC006A-0001-0837-B67E0B992680SessionDevice.cls_temp
<Package Folder>/files/####/598466FC006A-0001-0837-B67E0B992680SessionOS.cls_temp
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/initialization_marker
<Package Folder>/files/####/mp_agent_log
<Package Folder>/files/####/sa_99c7aac6-0e5f-4112-910f-3b9517a30387_1501849340447.tap
<Package Folder>/files/####/session_analytics.tap
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/cwd
<Package Folder>/files/google.db
<Package Folder>/files/mobclick_agent_cached_<Package>302161
<Package Folder>/files/rk.jar
<Package Folder>/files/uninstall
<Package Folder>/files/watch_server
<Package Folder>/shared_prefs/0def24353a3d8f0f7144f3755d8f7744.xml
<Package Folder>/shared_prefs/0def24353a3d8f0f7144f3755d8f7744.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_ui_preferences.xml
<Package Folder>/shared_prefs/ACCS_BIND.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml
<Package Folder>/shared_prefs/ACCS_SDK.xml.bak
<Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
<Package Folder>/shared_prefs/AGOO_BIND.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml.bak
<Package Folder>/shared_prefs/Agoo_AppStore.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/FLOAT_WINDOW.xml
<Package Folder>/shared_prefs/FirstNewUninstallTime.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml.bak
<Package Folder>/shared_prefs/MobogeniePrefsFile.xml
<Package Folder>/shared_prefs/MobogeniePrefsFile.xml.bak
<Package Folder>/shared_prefs/PUSH_PRE.xml
<Package Folder>/shared_prefs/PUSH_PRE.xml.bak
<Package Folder>/shared_prefs/SCORE_PRE.xml
<Package Folder>/shared_prefs/SCORE_PRE.xml.bak
<Package Folder>/shared_prefs/SETTING_DOMAIN.xml
<Package Folder>/shared_prefs/SETTING_DOMAIN.xml.bak
<Package Folder>/shared_prefs/SETTING_PRE.xml
<Package Folder>/shared_prefs/SETTING_PRE.xml.bak
<Package Folder>/shared_prefs/SUBSCRIBE_AD.xml
<Package Folder>/shared_prefs/TOKEN.xml
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/USERINFO.xml
<Package Folder>/shared_prefs/_toolbox_prefs.xml
<Package Folder>/shared_prefs/_toolbox_prefs.xml.bak
<Package Folder>/shared_prefs/_weather_prefs.xml
<Package Folder>/shared_prefs/_weather_prefs.xml.bak
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/aps.xml.bak
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apsad.xml.bak
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/clean.xml
<Package Folder>/shared_prefs/clean_version_sp.xml
<Package Folder>/shared_prefs/clean_version_sp.xml.bak
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
<Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak (deleted)
<Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
<Package Folder>/shared_prefs/com.mobpower.xml
<Package Folder>/shared_prefs/com.mobpower.xml.bak
<Package Folder>/shared_prefs/ct_default.xml
<Package Folder>/shared_prefs/dcSharedPreferences.dat.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/evernote_jobs.xml
<Package Folder>/shared_prefs/evernote_jobs.xml.bak
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/install.xml
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.q.xml
<Package Folder>/shared_prefs/last_know_location.xml
<Package Folder>/shared_prefs/mobvista.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/self_adextend.xml
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/service_config.xml.bak
<Package Folder>/shared_prefs/share_date.xml
<Package Folder>/shared_prefs/share_date.xml.bak
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/sp_config.xml.bak
<Package Folder>/shared_prefs/strategy_sp.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.androidsystem/####/49.x-3.0.1.apk
<SD-Card>/.androidsystem/####/PlugShareData
<SD-Card>/.androidsystem/####/files.db
<SD-Card>/.androidsystem/####/plugxml.xml
<SD-Card>/.androidsystem/####/syncfiles.db
<SD-Card>/.androidsystem/Plugin.zip
<SD-Card>/Android/####/.0.tmp (deleted)
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/0548391082cfd49909b29fe2d1b80226.0.tmp
<SD-Card>/Android/####/09ac570d10a28c0c08ecee080ceb90a7.0.tmp
<SD-Card>/Android/####/0b25dc3a69aa67dc4ab981654cf210409e85475c_v23_phone.mp4
<SD-Card>/Android/####/10d0f4fe07dbedb0d0b344981a7a89a4.0.tmp
<SD-Card>/Android/####/1380229154.js
<SD-Card>/Android/####/1c569af055d95d85afea5e8b9a0509e8.0.tmp
<SD-Card>/Android/####/277b2e6013d3e0d19fb2fe0c410a8b1f.0.tmp
<SD-Card>/Android/####/27895a4bc1899bce42a934e85086ee28.0.tmp
<SD-Card>/Android/####/42a55ceb87a05db410ff579c7e1a30ad.0.tmp
<SD-Card>/Android/####/48c6318a5a067fb9b7234f8e4074eb41.0.tmp
<SD-Card>/Android/####/5285044de8e4db72b86e7246f9aee7c2.0.tmp
<SD-Card>/Android/####/637bcf779e8a476965fb4296552b99c7.0.tmp
<SD-Card>/Android/####/70594694b795809267b00a383e3a0e3e.0.tmp
<SD-Card>/Android/####/71bd5e215c19e55403412e9d82bf69e0.0.tmp
<SD-Card>/Android/####/838f49755978596f822d8b720455f8c4.0.tmp
<SD-Card>/Android/####/9412abff4f1a5b74bd1f89efa6399653.0.tmp
<SD-Card>/Android/####/b4353c78e773bcb0a0fbc4a48ad7f658.0
<SD-Card>/Android/####/d71a508778a7dfd54b25610aa9fe09fb7c7fe77d_768x1024_opt_v1.jpeg
<SD-Card>/Android/####/f5207858b63ffe4989d6854637e08ea1.0.tmp
<SD-Card>/Android/####/f6fd6936ee65918b5035e185ada6ad88.0.tmp
<SD-Card>/Android/####/fe5c93839b1d1122297543ab980f0ecd.0.tmp
<SD-Card>/Android/####/journal
<SD-Card>/Android/####/journal.tmp
<SD-Card>/Android/####/jquery-1.9.1.min.js
<SD-Card>/Android/####/jquery.knob.js
<SD-Card>/Android/####/sound_off.png
<SD-Card>/Android/####/sound_on.png
<SD-Card>/Download/####/accs_election
<SD-Card>/LogN/####/sp
<SD-Card>/baidu/####/journal
<SD-Card>/baidu/.cuid
<SD-Card>/mobogenie/####/all_search_hotwords.json
<SD-Card>/mobogenie/####/all_search_hotwords.json (deleted)
<SD-Card>/mobogenie/####/facebook_ads_position.json
<SD-Card>/mobogenie/####/gl_app_home_all_json
<SD-Card>/mobogenie/####/mobogenie.uuid
<SD-Card>/mobogenie/####/splashbanner.png
<SD-Card>/mobogenie/mobosd.bin
<SD-Card>/mobogenie/mobosd.bin-journal

Miscellaneous:

Executes next shell scripts:

/data/user/0/<Package>/files/watch_server /data/user/0/<Package> http://redirect.mobogenie.com?pn=<Package>&v=302161&an=<Package>&lc=en_US&tag=mobogenie com.android.browser/com.android.browser.BrowserActivity 0
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22%22%2C%22utdid%22%3A%22WYRm%2FHGnkwUDAGdzx1FsAmvh%22%2C%22sdkVersion%22%3A%22212%22%7D -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/cwd 0
<Package Folder>/files/uninstall 0 http://m.mobogenie.com/en/uninstall/uninstall.html?channel_id=1030&uuid=00c8e6a2-cb98-4cb4-bc00-94d0225597eb&android=a967d2bb56f7bc6b&imei=<IMEI>&versionCode=302161&versionName=3.2.16.1&site=GL
<Package Folder>/files/watch_server <Package Folder> http://redirect.mobogenie.com?pn=<Package>&v=302161&an=<Package>&lc=en_US&tag=mobogenie com.android.browser/com.android.browser.BrowserActivity 0
cat /proc/cpuinfo
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 /data/user/0/<Package>/files/watch_server
chmod 755 <Package Folder>/files/watch_server
sh
sh /data/user/0/<Package>/files/watch_server /data/user/0/<Package> http://redirect.mobogenie.com?pn=<Package>&v=302161&an=<Package>&lc=en_US&tag=mobogenie com.android.browser/com.android.browser.BrowserActivity 0
sh <Package Folder>/files/cwd 0
sh <Package Folder>/files/uninstall 0 http://m.mobogenie.com/en/uninstall/uninstall.html?channel_id=1030&uuid=00c8e6a2-cb98-4cb4-bc00-94d0225597eb&android=a967d2bb56f7bc6b&imei=<IMEI>&versionCode=302161&versionName=3.2.16.1&site=GL

Loads the following dynamic libraries:

tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-NoPadding
AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial