Android.Packed.35028

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Click.234
Android.DownLoader.463.origin
Android.DownLoader.603.origin
Android.Loki.10.origin
Android.Loki.47.origin
Android.Mixi.16.origin
Android.Mixi.32.origin
Android.RemoteCode.88.origin
Android.Xiny.1.origin
Android.Xiny.237.origin
Android.Xiny.73.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) api.ap####.com:80
TCP(HTTP/1.1) d3656q1####.cloudf####.net:80
TCP(HTTP/1.1) trietha####.com:80
TCP(HTTP/1.1) 2####.177.13.68:8288
TCP(HTTP/1.1) appromo####.trac####.adnova####.com:80
TCP(HTTP/1.1) afftrac####.com:80
TCP(HTTP/1.1) down####.zhuo####.com:80
TCP(HTTP/1.1) a####.w####.in:80
TCP(HTTP/1.1) t####.ray####.com:80
TCP(HTTP/1.1) m.hxc####.com:80
TCP(HTTP/1.1) down####.uni####.info:80
TCP(HTTP/1.1) l####.admobim####.com:80
TCP(HTTP/1.1) gpup####.min####.com:80
TCP(HTTP/1.1) newrota####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:8088
TCP(HTTP/1.1) www.5####.lkt####.com:80
TCP(HTTP/1.1) cl####.min####.com:80
TCP(HTTP/1.1) s####.mob####.b####.com:80
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) ads.digg####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) tra####.tc-cl####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) l.a####.com:80
TCP(HTTP/1.1) d.billyaf####.com:80
TCP(HTTP/1.1) www.admobim####.com:80
TCP(HTTP/1.1) e####.w####.in:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) mo.freeind####.com:80
TCP(HTTP/1.1) akw.e####.space:80
TCP(HTTP/1.1) octo####.afft####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) su####.icec####.org:80
TCP(HTTP/1.1) p####.a####.com:80
TCP(HTTP/1.1) www.mmmmmm####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) pr####.com:80
TCP(HTTP/1.1) 5####.77.99.53:80
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) dsa.startap####.edg####.net:80
TCP(HTTP/1.1) ali.f####.cdn.####.com:80
TCP(HTTP/1.1) d####.zhuo####.com:80
TCP(HTTP/1.1) c.secure####.com:80
TCP(HTTP/1.1) ea.sno####.1####.com:18088
TCP(HTTP/1.1) cpgnrot####.com:80
TCP(HTTP/1.1) c.ssl-l####.com:80
TCP(HTTP/1.1) en.sno####.1####.com:8088
TCP(HTTP/1.1) api.reac####.com:80
TCP(TLS/1.0) f####.gst####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) cl####.dis####.io:443
TCP(TLS/1.0) lh3.googleu####.com:443
TCP(TLS/1.0) formula####.com:443

DNS requests:

a####.u####.co
a####.u####.com
a####.w####.in
activeo####.appromo####.com
ads.digg####.com
afftrac####.com
akw.e####.space
ali.f####.cdn.####.com
api.ap####.com
api.mob####.b####.com
api.reac####.com
c####.startap####.com
c-h####.g####.com
c.s####.co
c.secure####.com
c.ssl-l####.com
cl####.dis####.io
cl####.min####.com
cpgnrot####.com
d####.zhuo####.com
d.billyaf####.com
d3656q1####.cloudf####.net
down####.uni####.info
down####.zhuo####.com
e####.w####.in
ea.sno####.1####.com
en.sno####.1####.com
f####.google####.com
f####.gst####.com
formula####.com
go.octo####.com
gp.lik####.com
gp.miaoxi####.com
gpup####.min####.com
h####.b####.com
j.bay####.com
kar####.com
l####.admobim####.com
l.a####.com
lh3.googleu####.com
m.hxc####.com
mo.freeind####.com
newrota####.com
oc.u####.co
oc.u####.com
offer####.online
p####.a####.com
pm.zhuo####.com
pr####.com
rt.hm####.com
s####.mob####.b####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sh.penc####.com
su####.icec####.org
t####.ray####.com
tra####.tc-cl####.com
www.5####.lkt####.com
www.admobim####.com
www.cu####.com
www.koapk####.com
www.mmmmmm####.com
www.okyes####.com
www.zfr####.com

HTTP GET requests:

a####.w####.in/interface/vsupdate_627du.php?kv=####&kc=####&kq=####&ku=#...
ads.digg####.com/acs.php?sid=####&adid=####&os=####&osv=####&udid=####&g...
akw.e####.space/index.php?r=####
akw.e####.space/index.php?r=####&al=####&l=####&p=####&hp=####&lc=####&s...
akw.e####.space/strategy/api/v1/rule/get?p=####&hp=####&l=####&c=####&pr...
api.reac####.com/api/s2s/goto?id=####&t=####&channel=####&appid=####&cli...
cl####.min####.com/tracking/click?clickid=####&trafficsource=####&offeri...
dsa.startap####.edg####.net/tracking/adClick?d=IAAAAAAgAAA6X1tPSEVFW1pbX...
e####.w####.in/interface/mothdvista.php?subid=####&pjid=####&uid=####&Im...
e####.w####.in/interface/sale_static_new.php?kehuid=####&xiangid=####&ch...
e####.w####.in/interface/shazinew.php?subid=####&pjid=####&uid=####&Imsi...
gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
m.hxc####.com/click?_type=####&sdk_redir=####&campid=####&sub_channel=##...
p####.a####.com/img/bdar40641.png
trietha####.com/26C47/Jvug/Ne69/cLPh5ArjvVZpsRF4mvxLL00IVwlbHOKYXUyv26GA...
www.5####.lkt####.com/adserver/delivery/click.php?site_id=####&aff_sub=#...

HTTP POST requests:

e####.w####.in/wapbill/geturlow.php?imsi=####&net=####&subid=####&pjid=#...
ea.sno####.1####.com:18088/ping
ea.sno####.1####.com:18088/sdk/api/regclient
ea.sno####.1####.com:8088/sdk/api/log/record
gp.lik####.com/cr/sv/getEPList
l####.admobim####.com/surl/api3_status.action
l.a####.com/pv.php
l.a####.com/sal.php
mo.freeind####.com/detail/getOfferListNew?enc=####
s####.mob####.b####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
su####.icec####.org/offer
su####.icec####.org/setting
www.koapk####.com:8081/sm/sr/rt/ry
www.mmmmmm####.com/osp/oaen_get.action?tasktype=####&imei=####&imsi=####...
www.mmmmmm####.com/osp/oaen_reg.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.zfr####.com/up.do

Modified file system:

Creates the following files:

<Package Folder>/app_libs/.atmp9.jar
<Package Folder>/app_libs/.atmp_8.log
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/index
<Package Folder>/cache/intel-1649541301.txt
<Package Folder>/cachemylibs/as.jar
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/adblib.db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/my.db
<Package Folder>/databases/my.db-journal
<Package Folder>/databases/pushext.db-journal
<Package Folder>/databases/pushg.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/husky.tmp
<Package Folder>/files/####/husky_10804.dex
<Package Folder>/files/####/husky_10804.jar
<Package Folder>/files/####/ntmp20792261
<Package Folder>/files/####/sf_file_provider.dat
<Package Folder>/files/####/test
<Package Folder>/files/1512565432125_libneo32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<Package>.zip
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1512565428653
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/d.zip
<Package Folder>/files/dat.dat
<Package Folder>/files/dtemp.apk
<Package Folder>/files/gdaemon_20161017
<Package Folder>/files/google.db
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/lib.dat
<Package Folder>/files/libcuid.so
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/mingsk
<Package Folder>/files/ob1.zip
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/sail752.so
<Package Folder>/files/snowfox_mid.so
<Package Folder>/files/snowfox_sdk_so-v22c.jar
<Package Folder>/files/snowfox_v22c.jar
<Package Folder>/files/snowfox_v22c.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/files/wokuai.apk
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/ActivatePreUtil.xml
<Package Folder>/shared_prefs/AdsBusiness-data.xml
<Package Folder>/shared_prefs/Argolisten.xml
<Package Folder>/shared_prefs/BusinessPreUtil.xml
<Package Folder>/shared_prefs/LoginPreUtil.xml
<Package Folder>/shared_prefs/OfferPreUtil.xml
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/ak.salvia.sdk.xml (deleted)
<Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
<Package Folder>/shared_prefs/aps.xml
<Package Folder>/shared_prefs/apsad.xml
<Package Folder>/shared_prefs/apscomm.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/device_info.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/getui_sp.xml
<Package Folder>/shared_prefs/hunter_config.xml
<Package Folder>/shared_prefs/jihuos.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/m_cfg.xml.bak
<Package Folder>/shared_prefs/other_config.xml
<Package Folder>/shared_prefs/sdk_scl_pid_config.xml
<Package Folder>/shared_prefs/sdk_scl_pid_config.xml.bak
<Package Folder>/shared_prefs/service_config.xml
<Package Folder>/shared_prefs/settingsLog.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/sp_config.xml
<Package Folder>/shared_prefs/t_ini.xml
<Package Folder>/shared_prefs/t_ini.xml (deleted)
<Package Folder>/shared_prefs/t_ini.xml.bak
<Package Folder>/shared_prefs/t_ini.xml.bak (deleted)
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/upgrade_config.xml
<Package Folder>/shared_prefs/userconfig.xml
<SD-Card>/.androidsystem/####/gads.db
<SD-Card>/.googlev7/.libx2coas
<SD-Card>/.salvia/####/-1242440745.temp
<SD-Card>/.salvia/####/-1249282825.temp
<SD-Card>/.salvia/####/230133003.temp
<SD-Card>/.salvia/####/660268379.temp
<SD-Card>/.salvia/####/951224641.temp
<SD-Card>/.salvia/<Package>
<SD-Card>/Android/####/dev_18b2e6ae.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/journal.tmp
<SD-Card>/HorseBrowser/####/37D1AA67AC157B624B3C07D5765AC15A.png
<SD-Card>/HorseBrowser/####/37D1AA68AC157B6203446B831FA23CB4.jpg
<SD-Card>/HorseBrowser/####/37D1AA69AC157B620B1B5B5228DDCB64.jpg
<SD-Card>/HorseBrowser/####/37D1AA69AC157B622032F74BD13B5308.jpg
<SD-Card>/HorseBrowser/####/37D1AA69AC157B624FBDFE462F9304B2.jpg
<SD-Card>/HorseBrowser/####/37D1AA69AC157B626F8588466D258BC5.jpg
<SD-Card>/LogG/####/sp
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/baidu/####/journal.tmp
<SD-Card>/baidu/.cuid

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0771 <Package Folder>/.syslib-
chmod 6777 <Package Folder>/files/c201708041650.apk
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-

Loads the following dynamic libraries:

1512565432125_libneo32
com_zhuoyian_youxizhongxing110
getuiext2
intel-1649541301
libjni-comymrefpackagesjrrbaidu

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial