Android.Packed.20233

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.72.origin
Android.Xiny.165.origin
Android.SmsSend.15976
Android.Xiny.164.origin
Android.Mixi.13.origin
Android.Xiny.166.origin

Network activity:

Connecting to:

faceboo####.link
we####.com
show####.xyz
s####.####.com
4####.####.176
4####.####.251
woo####.com:7077
1####.####.184
quede####.com
statist####.com
4####.####.188
1####.####.85
1####.####.81
4####.####.161
4####.####.160
4####.####.163
we####.com:8081
g####.####.com
4####.####.240
c####.####.com
1####.####.190
1####.####.198

HTTP GET requests:

faceboo####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=####&s2=####&s3=####&s5=####
c####.####.com/landings/87511/1489511222/js/showhide.js?148951####
4####.####.161/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
s####.####.com/rtf/61758845ff587a9ca72eec4a182a2db1.slze
s####.####.com/rtf/6118b734c99b874ae095b036904bb948.slze
s####.####.com/rtf/421086c2eddcc74d954cb7e9ec84d72a.slze
faceboo####.link/c/da57dc555e50572d?s1=####&s2=####&s3=####&click_id=####
4####.####.176/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
1####.####.184/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
c####.####.com/landings/87511/1489511222/js/steps.js?148951####
1####.####.190/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
4####.####.160/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
quede####.com/99Q12/OjkYdA/Ljpd/KjdMJ2k/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRBoJJVfUXE-L/fGdNITc1PgMo7FOv0_nIDCk-4G4TE5o?jch=####
s####.####.com/rtf/43078249e02a6c5f401cd388aaf98eec.slze
4####.####.161/admin201506/uploadApkFile/rt/20170321/env201703211750.data
c####.####.com/landings/87511/1489511222/css/styles.css?148951####
s####.####.com/rtf/1805f9b499c8a466d9e51eed7db4bd109.slze
s####.####.com/rtf/610fea5b886716cf60b0521639405d49.slze
1####.####.198/admin201506/uploadApkFile/rt/20170113/ge25.data
4####.####.161/admin201506/uploadApkFile/rt/20160406/ToolboxAndSupolicy.zip
1####.####.85/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
c####.####.com/landings/87511/1489511222/js/progressButton.js?148951####
s####.####.com/rtf/40860393e1060fdd055a12956885d381.slze
c####.####.com/landings/87511/1489511222/js/classie.js?148951####
1####.####.198/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
4####.####.240/admin201506/uploadApkFile/rt/20170113/ge23.data
c####.####.com/landings/87511/1489511222/js/modernizer.js?148951####
quede####.com/99Q12/Ljpd/ID5N/eHIafDNiK1N-ulas0aXWWjGkEszX8e0Bi1iEcqOBRBoJJVfUXE-L?KjM=####
4####.####.240/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
4####.####.161/admin201506/uploadApkFile/rt/20170113/rs40.data
g####.####.com/cr/sdk/goplaysdk_statistics.dat
4####.####.251/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
c####.####.com/landings/87511/1489511222/css/button.css?148951####
s####.####.com/rtf/806274507dde8d7f9651585a081b9bf1.slze
show####.xyz/adult/_files/imgs/r_general1/img-4fuck.gif
1####.####.81/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
4####.####.163/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
s####.####.com/rtf/640cd07bae56fb884eb1264ece3adf87.slze
4####.####.188/admin201506/uploadApkFile/rt/20161125/lookupalldata2.zip
4####.####.161/admin201506/uploadApkFile/rt/20170316/elfm0.zip
c####.####.com/landings/87511/1489511222/js/avsc2.js?148951####
statist####.com/adv_pxl?pid=####&id=####
g####.####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=####&interval=####&v=####
1####.####.81/admin201506/uploadApkFile/rt/20170113/gp41.data
c####.####.com/landings/87511/1489511222/css/bootstrap.css?148951####

HTTP POST requests:

g####.####.com/cr/sv/getEPList
we####.com/sm/sr/ku/ky
we####.com:8081/sm/sr/rt/ry
we####.com/sm/sr/run/hy
woo####.com:7077/sdk/nsd.action?b=####
we####.com/sm/sr/sp/py

Modified file system:

Creates the following files:

/data/data/####/p.gp41/files/408.jar
/data/data/####/shared_prefs/20160121.xml
/data/data/####/com.init.env/files/debuggerd_hulu
/data/data/####/com.init.env/files/forever.sh
/data/data/####/files/100/1003/env201703211750.data
/data/data/####/app_DEX_OPT/70153606.dex
/data/data/####/app_DEX_OPT/91169916.dex
/data/data/####/databases/webview.db-journal
/data/data/####/com.init.env/files/toolbox
/sdcard/test
/data/data/####/files/c201703312050.apk
/data/data/####/com.init.env/files/kcol_ysy
/data/data/####/files/100/1003/ge25.data
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/p.gp41/files/.S1CH1S/4AB712239B2BDBC7C0FFCE3039D3C027
/data/data/####/p.gp41/files/forever.sh
/data/data/####/databases/rtr.db-journal
/data/data/####/p.gp41/files/.S1CH1S/9736F0C22830D365D59E26ABED4AF856
/data/data/####/p.gp41/files/.S1CH1S/A148B677DB524630C21ECA13C2D9E225
/data/data/####/p.gp41/files/1485418762213.jar
/data/data/####/p.gp41/files/640.jar
/data/data/####/files/100/1003/ge23.data
/data/data/####/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
/data/data/####/p.gp41/files/611.jar
/data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
/data/data/####/app_DEX_OPT/72703871.dex
/data/data/####/files/100/1003/gp41.data
/data/data/####/p.gp41/files/617.jar
/data/data/####/p.gp41/files/806.jar
/data/data/####/files/100/1003/70153606.apk
/data/data/####/com.init.env/files/install-recovery.sh
/data/data/####/databases/rtr.db
/data/data/####/shared_prefs/20160121.xml.bak
/data/data/####/p.gp41/files/.gepd/gpdu
/data/data/####/p.gp41/files/.S1CH1S/B11C222F5B18FADD2FFA4C70E35F4AC8
/data/data/####/com.init.env/files/cdrom_msuf_stop
/data/data/####/p.gp41/shared_prefs/p.gp41_preferences.xml
/data/data/####/files/100/1003/78101468.apk
/data/data/####/p.gp41/files/430.jar
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/201703312050.apk
/data/data/####/com.init.env/files/elfm1485418754622.zip
/data/data/####/files/100/1003/rs40.data
/data/data/####/p.gp41/files/421.jar
/data/data/####/shared_prefs/ar.xml
/data/data/####/p.gp41/files/.S1CH1S/1489ACE5DD2C3FC346A4B1D3C2022642
/data/data/####/com.init.env/files/toolbox1485418754736.zip
/data/data/####/p.gp41/files/.S1CH1S/3C009D66CAABD433CCD1D841E6AF0BF3
/data/data/####/files/100/1003/72703871.apk
/data/data/####/p.gp41/shared_prefs/p.gp41_preferences.xml.bak
/data/data/####/databases/swith1014.db-journal
/data/data/####/com.init.env/files/setsebool_sfum_usbcharger
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/com.init.env/files/supolicy
/data/data/####/app_DEX_OPT/83464179.dex
/data/data/####/p.gp41/files/.S1CH1S/E8EE0B0E8C98EFCC1566F520B5CF12B0
/data/data/####/p.gp41/files/.play/.md
/data/data/####/p.gp41/files/.S1CH1S/2A63DF2C983CE370A9205B913A7F4B45
/data/data/####/com.init.env/files/elfm
/data/data/####/app_DEX_OPT/78101468.dex
/data/data/####/p.gp41/files/.S1CH1S/834C8EAFCA3DB238A4EF547DDC644C6B
/data/data/####/databases/bdownloaders.db-journal
/data/data/####/p.gp41/files/610.jar
/data/data/####/files/100/1003/83464179.apk
/data/data/####/p.gp41/files/.play/test
/data/data/####/files/100/1003/91169916.apk
/data/data/####/cache/webviewCacheChromium/index

Sets the 'executable' attribute to the following files:

/data/data/####/com.init.env/files/toolbox
/data/data/####/com.init.env/files/forever.sh
/data/data/####/files/c201703312050.apk
/data/data/####/p.gp41/files/.play/test

Miscellaneous:

Executes next shell scripts:

chmod 770 /data/data/####/p.gp41/files/.play/test
getenforce
cdrom_msuf_stop
chmod 0771 /data/data/####/p.gp41/.syslib-
syssp -h e4e9bd1629b64d73b7c51387df1e1406 /data/data/####/p.gp41/.syslib-
c201703312050.apk
.hulu
logcat -d -v time
.hulu -c id
sh
/data/data/####/p.gp41/files/.play/test /data/data/####/p.gp41/files/.play/ e4e9bd1629b64d73b7c51387df1e1406
cdrom_msuf_stop -c id

Contains functionality to send SMS messages automatically.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial