Android.Packed.32052

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.164.origin
Android.Xiny.166.origin
Android.Xiny.202.origin
Android.Xiny.72.origin
Android.Xiny.73.origin

Prompts to install third-party applications.

Removes its shortcut from the home screen.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.mobsi####.com:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) d####.mobsi####.com:80
TCP(HTTP/1.1) 45.79.1####.160:80
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) 45.79.1####.48:80
TCP(HTTP/1.1) re.1s####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) 1.mobiupp####.com:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) 4####.33.0.176:80
TCP(HTTP/1.1) www.pitayam####.com:9000
TCP(HTTP/1.1) 45.79.1####.142:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(HTTP/1.1) 4####.79.77.161:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) 45.79.1####.230:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) clk.apxadtr####.net:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) ggg.koapk####.com:80
TCP(HTTP/1.1) n####.mobsi####.com:80
TCP(TLS/1.0) p####.lead####.com:443
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) adse####.leblonm####.com:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) sconten####.xx.f####.net:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

1.mobiupp####.com
a####.u####.com
adse####.leblonm####.com
adser####.go####.com
adser####.go####.nl
and####.b####.qq.com
clk.apxadtr####.net
d####.mobsi####.com
f####.google####.com
f####.gst####.com
ggg.koapk####.com
googl####.g.doublec####.net
lh3.googleu####.com
mt####.go####.com
n####.mobsi####.com
p####.lead####.com
pag####.googles####.com
re.1s####.com
sconten####.xx.f####.net
securep####.g.doublec####.net
serv####.m####.com
st####.xx.f####.net
tpc.googles####.com
www.face####.com
www.go####.com
www.google-####.com
www.gst####.com
www.koapk####.com
www.mobsi####.com
www.okyes####.com
www.pitayam####.com
www.technol####.co.uk
www.technol####.net

HTTP GET requests:

1.mobiupp####.com/?utm_medium=####&utm_campaign=####&1=####&cid=####
1.mobiupp####.com/?utm_term=####&clickverify=####&utm_content=####
1.mobiupp####.com/proc.php?4a8d105####
d####.mobsi####.com/api_service.php?channel=####&ver=####&name=####&uuid...
d####.mobsi####.com/url_jiechi.php?channel=####&uuid=####&ver=####&adver...
d####.mobsi####.com/url_jiechi_two.php?channel=####&uuid=####&ver=####&a...
f####.google####.com/css?family=####&ver=####
f####.gst####.com/s/lato/v14/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4...
f####.gst####.com/s/robotoslab/v7/dazS1PrQQuCxC3iOAJFEJTdGNerWpg2Hn6A-Bx...
n####.mobsi####.com/api/ad_open_api.php?channel=####&ver=####&name=####
n####.mobsi####.com/api/api_sdkjc_new.php?ver=####&channelid=####&from_c...
n####.mobsi####.com/api/auth_open_api.php?channel=####&ver=####&uuid=###...
pag####.googles####.com/pagead/gen_204?id=####&rt=####&c=####
pag####.googles####.com/pagead/gen_204?id=resize&scrl=0&adk=3762866555&a...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171010/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171010/r20170110/show_ads_impl.js
serv####.m####.com/119987?t=0.6619695657864213&ref=http://www.technology...
serv####.m####.com/119987?t=0.7636136042419821&ref=&lu=http://www.techno...
serv####.m####.com/119987?t=0.7771521511022002&ref=&lu=http://www.techno...
serv####.m####.com/119987?t=0.7938453627284616&ref=http://www.technology...
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...
www.pitayam####.com:9000/getip
www.pitayam####.com:9000/js/pitaya?&type=####&from_config=####&channelid...
www.pitayam####.com:9000/new_config2?version=####&type=####&from_config=...
www.pitayam####.com:9000/static/scripts/test.js

HTTP POST requests:

d####.mobsi####.com/clickAd.php
ggg.koapk####.com/pgm/sr/gm/gy
n####.mobsi####.com/CommunityJSON.php
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/run/hy
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8080/sdk/cb.action
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...

Modified file system:

Creates the following files:

/data/.xbin/api
/data/.xbin/bksepolicy_hwkg_radish
/data/.xbin/cid
/data/.xbin/disp
/data/.xbin/mid
/data/.xbin/release
/data/.xbin/uid
/data/data/####/1004
/data/data/####/INFO.xml
/data/data/####/MUYOU_DATA.xml
/data/data/####/WebpageIcons.db-journal
/data/data/####/ZIRCO
/data/data/####/ZIRCO-journal
/data/data/####/bookmarks.db-journal
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.wiet.super22_preferences.xml
/data/data/####/config.json
/data/data/####/crashrecord.xml
/data/data/####/device_id.xml.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/security_info
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/weave.db-journal
/data/data/####/webview.db-journal
/data/local/####/api
/data/local/####/cid
/data/local/####/disp
/data/local/####/mid
/data/local/####/release
/data/local/####/uid
/system/bin/####/api
/system/bin/####/bkroot_ghkw_hd
/system/bin/####/cid
/system/bin/####/disp
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/.install-recovery.luno.sh
/system/bin/debuggerd
/system/bin/debuggerd_hulu
/system/bin/debuggerd_server
/system/bin/install-recovery.sh
/system/bin/kcol_ysy
/system/bin/sepolicy_hwkg_radish
/system/etc/install-cm-recovery.sh
/system/etc/install-recovery-2.sh
/system/etc/install-recovery.sh
/system/etc/install_recovery.sh
/system/xbin/.kugua
/system/xbin/root_ghkw_hd
/system/xbin/supolicy
<Package Folder>/app_DEX_OPT/22169810.dex
<Package Folder>/app_DEX_OPT/32123713.dex
<Package Folder>/app_DEX_OPT/50054226.dex
<Package Folder>/app_DEX_OPT/51827737.dex
<Package Folder>/app_DEX_OPT/61721912.dex
<Package Folder>/app_DEX_OPT/69801209.dex
<Package Folder>/app_DEX_OPT/73785364.dex
<Package Folder>/app_DEX_OPT/81154567.dex
<Package Folder>/app_DEX_OPT/91880386.dex
<Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
<Package Folder>/com.init.env/####/data_0
<Package Folder>/com.init.env/####/data_1
<Package Folder>/com.init.env/####/data_2
<Package Folder>/com.init.env/####/data_3
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1507808550893.zip
<Package Folder>/com.init.env/####/f_000001
<Package Folder>/com.init.env/####/f_000002
<Package Folder>/com.init.env/####/f_000003
<Package Folder>/com.init.env/####/f_000004
<Package Folder>/com.init.env/####/f_000005
<Package Folder>/com.init.env/####/f_000006
<Package Folder>/com.init.env/####/f_000007
<Package Folder>/com.init.env/####/f_000008
<Package Folder>/com.init.env/####/f_000009
<Package Folder>/com.init.env/####/f_00000a
<Package Folder>/com.init.env/####/f_00000b
<Package Folder>/com.init.env/####/f_00000c
<Package Folder>/com.init.env/####/f_00000d
<Package Folder>/com.init.env/####/f_00000e
<Package Folder>/com.init.env/####/f_00000f
<Package Folder>/com.init.env/####/f_000010
<Package Folder>/com.init.env/####/f_000011
<Package Folder>/com.init.env/####/f_000012
<Package Folder>/com.init.env/####/f_000013
<Package Folder>/com.init.env/####/f_000014
<Package Folder>/com.init.env/####/f_000015
<Package Folder>/com.init.env/####/f_000016
<Package Folder>/com.init.env/####/f_000017
<Package Folder>/com.init.env/####/f_000018
<Package Folder>/com.init.env/####/f_000019
<Package Folder>/com.init.env/####/f_00001a
<Package Folder>/com.init.env/####/f_00001b
<Package Folder>/com.init.env/####/f_00001c
<Package Folder>/com.init.env/####/f_00001d
<Package Folder>/com.init.env/####/f_00001e
<Package Folder>/com.init.env/####/f_00001f
<Package Folder>/com.init.env/####/f_000020
<Package Folder>/com.init.env/####/f_000021
<Package Folder>/com.init.env/####/f_000022
<Package Folder>/com.init.env/####/f_000023
<Package Folder>/com.init.env/####/f_000024
<Package Folder>/com.init.env/####/f_000025
<Package Folder>/com.init.env/####/f_000026
<Package Folder>/com.init.env/####/f_000027
<Package Folder>/com.init.env/####/f_000028
<Package Folder>/com.init.env/####/f_000029
<Package Folder>/com.init.env/####/f_00002a
<Package Folder>/com.init.env/####/f_00002b
<Package Folder>/com.init.env/####/f_00002c
<Package Folder>/com.init.env/####/f_00002d
<Package Folder>/com.init.env/####/f_00002e
<Package Folder>/com.init.env/####/f_00002f
<Package Folder>/com.init.env/####/f_000030
<Package Folder>/com.init.env/####/f_000031
<Package Folder>/com.init.env/####/f_000032
<Package Folder>/com.init.env/####/f_000033
<Package Folder>/com.init.env/####/f_000034
<Package Folder>/com.init.env/####/f_000035
<Package Folder>/com.init.env/####/f_000036
<Package Folder>/com.init.env/####/f_000037
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/index
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/root_ghkw_hd
<Package Folder>/com.init.env/####/sepolicy_hwkg_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1507808551055.zip
<Package Folder>/com.init.env/####/webview.db-journal
<Package Folder>/com.init.env/####/webviewCookiesChromium.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/files/####/22169810.apk
<Package Folder>/files/####/32123713.apk
<Package Folder>/files/####/50054226.apk
<Package Folder>/files/####/51827737.apk
<Package Folder>/files/####/61721912.apk
<Package Folder>/files/####/69801209.apk
<Package Folder>/files/####/73785364.apk
<Package Folder>/files/####/81154567.apk
<Package Folder>/files/####/91880386.apk
<Package Folder>/files/####/N2025.data
<Package Folder>/files/####/N2051.data
<Package Folder>/files/####/dk691.data
<Package Folder>/files/####/dk813.data
<Package Folder>/files/####/dk833.data
<Package Folder>/files/####/dk867.data
<Package Folder>/files/####/dk903.data
<Package Folder>/files/####/ja201710112150.data
<Package Folder>/files/####/rs40.data
<Package Folder>/files/201710121650.apk
<Package Folder>/files/c201710121650.apk
<Package Folder>/p.dk691/####/forever.sh
<Package Folder>/p.dk691/####/krcfg.txt
<Package Folder>/p.dk691/####/krmain
<Package Folder>/p.dk691/####/krmain1507808553180.zip
<Package Folder>/p.dk691/####/krsdk.cert
<Package Folder>/p.dk813/####/forever.sh
<Package Folder>/p.dk813/####/krcfg.txt
<Package Folder>/p.dk813/####/krmain
<Package Folder>/p.dk813/####/krmain1507808596135.zip
<Package Folder>/p.dk813/####/krsdk.cert
<Package Folder>/p.dk833/####/forever.sh
<Package Folder>/p.dk833/####/krcfg.txt
<Package Folder>/p.dk833/####/krsdk.cert
<Package Folder>/p.dk867/####/forever.sh
<Package Folder>/p.dk867/####/krcfg.txt
<Package Folder>/p.dk867/####/krmain
<Package Folder>/p.dk867/####/krmain1507808576807.zip
<Package Folder>/p.dk867/####/krsdk.cert
<Package Folder>/p.dk903/####/forever.sh
<Package Folder>/p.dk903/####/krcfg.txt
<Package Folder>/p.dk903/####/krmain
<Package Folder>/p.dk903/####/krmain1507808584460.zip
<Package Folder>/p.dk903/####/krsdk.cert
<Package Folder>/p.sr40/####/cnVuc2hlbGwy
<Package Folder>/p.sr40/####/cnVuc2hlbGwy1507808551634.zip
<Package Folder>/p.sr40/####/forever.sh
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ae.xml.bak
<SD-Card>/APPMarket/####/5202534.apk
<SD-Card>/APPMarket/####/621153251.png.tmp
<SD-Card>/test1507808549725

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
/system/bin/sh -c getprop
/system/bin/sh -c type su
/system/bin/sh <Package Folder>/p.dk691/files/forever.sh
app_process /system/bin com.android.commands.pm.Pm path com.wiet.super22
c201710121650.apk -p <Package> -c <Package>:mu
chmod 0755 <Package Folder>/com.init.env
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk691/files/forever.sh
chmod 0777 <Package Folder>/p.dk691/files/krmain
chmod 0777 <Package Folder>/p.dk691/files/krsdk.cert
chmod 0777 <Package Folder>/p.dk813/files/forever.sh
chmod 0777 <Package Folder>/p.dk813/files/krmain
chmod 0777 <Package Folder>/p.dk833/files/forever.sh
chmod 0777 <Package Folder>/p.dk867/files/forever.sh
chmod 0777 <Package Folder>/p.dk867/files/krmain
chmod 0777 <Package Folder>/p.dk903/files/forever.sh
chmod 0777 <Package Folder>/p.dk903/files/krmain
chmod 0777 <Package Folder>/p.sr40/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.sr40/files/forever.sh
chmod 777 <Package Folder>/p.dk691/files/krcfg.txt
chmod 777 <Package Folder>/p.dk813/files/krcfg.txt
chmod 777 <Package Folder>/p.dk833/files/krcfg.txt
chmod 777 <Package Folder>/p.dk867/files/krcfg.txt
chmod 777 <Package Folder>/p.dk903/files/krcfg.txt
getprop
logcat -d -v time
ls -l /system/bin/su
ps
root_ghkw_hd
root_ghkw_hd -c id
sh
sh /system/bin/root_ghkw_hd
sh /system/bin/root_ghkw_hd -c id
su
su -c id

Loads the following dynamic libraries:

info.it

Uses elevated priveleges.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial