Android.Packed.31986

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.463.origin
Android.DownLoader.603.origin
Android.Loki.10.origin
Android.Loki.15.origin
Android.Mixi.16.origin
Android.Mixi.21.origin
Android.Xiny.73.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) a####.w####.in:80
TCP(HTTP/1.1) a####.hitthe####.mobi:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) atracki####.appf####.com:80
TCP(HTTP/1.1) 45.79.1####.142:80
TCP(HTTP/1.1) adse####.hitthe####.mobi:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) a####.bay####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) e####.w####.in:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) y####.ottero####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(TLS/1.0) s0.2####.net:443
TCP(TLS/1.0) p####.everest####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) app####.hs.l####.net:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) ade.googles####.com:443
TCP(TLS/1.0) g.geo####.com:443
TCP(TLS/1.0) google####.g.doublec####.net:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) gl####.app####.com:443
TCP(TLS/1.0) cm.g.doublec####.net:443
TCP(TLS/1.0) bestper####.site:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) odr.moo####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) sconten####.xx.f####.net:443
TCP(TLS/1.0) s####.search####.spotxch####.####.net:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) a####.app####.com:443

DNS requests:

a####.app####.com
a####.bay####.com
a####.hitthe####.mobi
a####.w####.in
ade.googles####.com
adse####.hitthe####.mobi
adser####.go####.com
adser####.go####.nl
ak.icec####.org
app####.hs.l####.net
atracki####.appf####.com
bestper####.site
cm.g.doublec####.net
d####.zhuo####.com
d3656q1####.cloudf####.net
down####.zhuo####.com
e####.w####.in
f####.google####.com
f####.gst####.com
gl####.app####.com
googl####.g.doublec####.net
google####.g.doublec####.net
gp.lik####.com
gp.miaoxi####.com
h####.b####.com
ib.a####.com
j.bay####.com
l.a####.com
odr.moo####.com
offer####.online
p####.a####.com
p####.everest####.net
pag####.googles####.com
pm.zhuo####.com
s####.se####.spotxch####.com
s0.2####.net
sconten####.xx.f####.net
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
serv####.m####.com
sh.penc####.com
st####.xx.f####.net
tpc.googles####.com
www.face####.com
www.go####.com
www.google-####.com
www.gst####.com
www.koapk####.com
www.okyes####.com
www.technol####.co.uk
www.technol####.net
y####.ottero####.com

HTTP GET requests:

a####.hitthe####.mobi/?utm_medium=####&utm_campaign=####&cid=####
a####.hitthe####.mobi/?utm_term=####&clickverify=####&utm_content=####
a####.hitthe####.mobi/proc.php?1a6b5ac####
a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
d####.zhuo####.com/Api/getPlayBanner?titleId=####&packId=####&language=#...
d####.zhuo####.com/Api/getStartFigure?packId=####
d####.zhuo####.com/Api/playGift?titleId=####&packId=####
e####.w####.in/interface/mothdnew.php?subid=####&pjid=####&uid=####&Imsi...
e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
f####.google####.com/css?family=####&ver=####
gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
gpup####.b0.a####.com/cr/sdk/dynV17041701D/des_dyV17041701Dj1so32.zip
gpup####.b0.a####.com/rtf/180562885f3e4c613c5e9844caef22755.slze
gpup####.b0.a####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
gpup####.b0.a####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
gpup####.b0.a####.com/rtf/4303e8e0c1feae973da3a9e9f6774365.slze
gpup####.b0.a####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
gpup####.b0.a####.com/rtf/6115c9af6b1c30917b41f5c378956f40.slze
gpup####.b0.a####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
gpup####.b0.a####.com/rtf/6408c259f823e8db8ced83ef353a06b4.slze
gpup####.b0.a####.com/rtf/806a6b70c891c315e00b5dfd26af42ed.slze
p####.a####.com/img/bdar40641.png
pag####.googles####.com/pagead/gen_204?id=puberror&context=165&msg=TagEr...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171004/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171004/r20170110/show_ads_impl.js
serv####.m####.com/119987?t=0.5227304715663195&ref=&lu=http://www.techno...
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...
y####.ottero####.com/?uid1=####&utm_medium1=####&1=####&utm_content=####
y####.ottero####.com/?utm_medium=####&utm_campaign=####

HTTP POST requests:

d####.zhuo####.com/Api/playDetail
e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
gp.lik####.com/cr/sv/getEPList
l.a####.com/pv.php
l.a####.com/sal.php
www.koapk####.com:8081/sm/sr/rt/ry
www.okyes####.com:8081/sdk/nsd.action?b=####

Modified file system:

Creates the following files:

<Package Folder>/app_indicators/indicator_d
<Package Folder>/app_indicators/indicator_p
<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/index
<Package Folder>/cache/intel147259786.txt
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/ntmp20552164
<Package Folder>/files/####/test
<Package Folder>/files/1507548878759_dyV17041701Dj1so32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/IlvGNfLeLnXWQUZjdynamicloader.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1507548875879
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/ehkdbiDtwbaGbOOydaemon.so
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libcuid.so
<Package Folder>/files/libiXCCVhYUvWYjNhMlbootstrap.so
<Package Folder>/files/mingsk
<Package Folder>/files/pPSqBZtGDOsuTyItstub.jar
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/sail747.so
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/wokuai.apk
<Package Folder>/files/xnPqJGuLCADgDtbpsa.jar
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/Argolisten.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/jihuos.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/userconfig.xml
<SD-Card>/.salvia/<Package>
<SD-Card>/APPMarket/####/122190031.png.tmp
<SD-Card>/Android/####/715119f29f736652abd3f673bc8acf54.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/HorseBrowser/####/080A76A8AC157B637E27F549707A37CC.png
<SD-Card>/HorseBrowser/####/08DDFCD9AC157B63445C5E3411AC11EA.jpg
<SD-Card>/HorseBrowser/####/37D1AA67AC157B624B3C07D5765AC15A.png
<SD-Card>/HorseBrowser/####/64223430AC157B636AB78C4A8C5E0524.png
<SD-Card>/HorseBrowser/####/64281E4FAC157B635E90A00F61F29893.png
<SD-Card>/HorseBrowser/####/64281E50AC157B6309A8F5D800B0FA3E.jpg
<SD-Card>/HorseBrowser/####/64281E50AC157B631600C7B04BE1E432.jpg
<SD-Card>/HorseBrowser/####/64281E50AC157B632DDF461C8143062D.jpg
<SD-Card>/HorseBrowser/####/64281E50AC157B634D4B86CE543697A4.jpg
<SD-Card>/HorseBrowser/####/64281E50AC157B637F5B6110BAB3BB78.jpg
<SD-Card>/HorseBrowser/####/CA292C74FFFFFFE24BADFC0E453793AD.png
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/test1507548877597

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0771 <Package Folder>/.syslib-
chmod 6777 <Package Folder>/files/c201708041650.apk
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ps
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Loads the following dynamic libraries:

1507548878759_dyV17041701Dj1so32
com_zhuoyian_youxizhongxing110
ehkdbiDtwbaGbOOydaemon
getuiext2
intel147259786
libiXCCVhYUvWYjNhMlbootstrap
libjni-comymrefpackagesjrrbaidu

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial