Android.Packed.20723

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.155.origin

Network activity:

Connecting to:

s####.####.com
6####.####.140
i####.####.com
7j####.####.com
c-h####.####.com
d####.####.com
sdk####.####.com
a####.####.com

HTTP GET requests:

s####.####.com/config/hz-hzv3.conf
7j####.####.com/tdata_kHG382
a####.####.com/v1/card/gettime/
7j####.####.com/tdata_Now710
i####.####.com/ando-res/m/1gHHIXx9OA3TDGUGM4x*bE91Kpyv3RdBI11PUA
7j####.####.com/tdata_Hhd935
i####.####.com/ando-res/m/cQwKlkrR3WUaJLaKJ8f3NdmpUcWLS5800o3SdZa0E-gnxS...
a####.####.com/v2/config/funclist?cid=####

HTTP POST requests:

6####.####.140/ando/x/lis?app_id=####&r=####
sdk####.####.com/log/eventLog.htm
s####.####.com/api.php?format=####&t=####
6####.####.140/ando/x/liv?app_id=48a75bc9-9fa5-43a8-a2a3-f5dada2bfedf&r=...
d####.####.com/bos/api/v1/ai?from=####&mid=####&afid=####
c-h####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/LqToPe6H0Q9MfUQUZYrs3Q==.new
/data/data/####/files/init.pid
/data/data/####/shared_prefs/ping.xml
/data/data/####/files/tdata_Hhd935.jar
/data/data/####/shared_prefs/install.app.xml.bak
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/exVuJQtaMfKN3otoNP__jQ==/8nU8THvXpaNeqhOiazWYICAMRdGhho7x
/data/data/####/files/themefolder/res/drawable-xxhdpi/com_ucmobile__icon.png
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/xFTS3k-HnNOrzLEaQ61yItgW00hmRxR6sRCqIFYeDb0=.new
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/xI48harsc-kGQ4cnJFU_CtlUbJ7F2WKB.new
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/WNmSSJcHq4JMiX2i8fBH7TtRvCpDhXydvJDiBCxQGL8=.new
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/exVuJQtaMfKN3otoNP__jQ==/8nU8THvXpaNeqhOiazWYICAMRdGhho7x.old
/sdcard/.env/.uunique.new
/data/data/####/files/themefolder/res/drawable-xxhdpi/com_miguan_market__ic_launcher.png
/sdcard/ktheme/default.ktm
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/cSBgxLU5YO6X2fT5Jmwu8g==
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/v4ddUZr6rsdPoUTVigCZkQ==/GTNmsRiE2V7KUj1YOLx9KE7jzbI=.temp
/data/data/####/databases/pushg.db-journal
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/ULRHmvdbmIhBjp3eKfSXF29xWnM=
/data/data/####/files/themefolder/__MACOSX/res/._.DS_Store
/sdcard/libs/####.db
/data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._com_moji_mjweather__icon.png
/sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/exVuJQtaMfKN3otoNP__jQ==/8nU8THvXpaNeqhOiazWYICAMRdGhho7x.new
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/oZUjjHkRfx9nk6Zv6Bdqrw==.new
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/_wob2frdmXVOzQIG0bN-ZfHCo8oVgdSI.new
/data/data/####/files/tdata_kHG382
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/6Klqqz6510rXjASbNCdbogKEC1E=.new
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/v4ddUZr6rsdPoUTVigCZkQ==/Er17fD7enG0H040Y
/sdcard/.IdeaDesktop/.backup/.localbackup/.temp/desc.xml
/data/data/####/databases/increment.db-journal
/data/data/####/files/init_c.pid
/data/data/####/shared_prefs/trebuchet_preferences.xml
/sdcard/system/tmp/local/tdata_Hhd935
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/OGn7a8ezHlHo6GNxTa8njHSRCVdKaXpc.new
/data/data/####/shared_prefs/com.klauncher.kinflow.common.utils.CommonShareData.xml.bak
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/VTlyknd3sahlWYQXuRDIyVtxqkPxsSWN.new
/data/data/####/files/run.pid
/data/data/####/files/tdata_Hhd935
/data/data/####/shared_prefs/disguise_packages_sp.xml
/data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._.DS_Store
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/Y0ouS2F2y5szygRS/5i1-DJsLSNSAKJcGeXkgXB7JCC-8BE8xw3tVkT7YzU8=
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/hfVcXeze_6MHKVFv09ae-IVI5SM=.new
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/vRSvKcT5Z3GUUJTHb6XnVA==/data.dat.tmp
/data/data/####/files/themefolder/res.zip
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/aicm4Ap88Inb5MPpkmTO05yOjo00uuBx.new
/data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._com_chinamobile_mcloud__icon.png
/data/data/####/databases/pushgdm.db-journal
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/6pCT96SyMJISTiLOagviBL0gUYs_arqx.new
/data/data/####/files/themefolder/__MACOSX/res/drawable-xxhdpi/._com_miguan_market__ic_launcher.png
/sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
/sdcard/.armsd/alLbon3AuQynvtpS/MP8MtaBuguN9jnuSwtN1kQ==
/data/data/####/databases/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_fWqN5QIj63TW3MULH8BuGA==-journal
/data/data/####/databases/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_1M-meGn86j7Pq4Qw-journal
/data/data/####/files/txddvg_d/txddvg_f.zip
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/Fjl1rYA3GBd2i7QCZYWDCg==/runner_info.prop
/data/data/####/files/themefolder/res/drawable-xxhdpi/com_tencent_android_qqdownloader__ic_launcher.png
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/oXdB4NnuV2RNR9LVBUeUpOhAQKg=.new
/data/data/####/files/push.pid
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/ULRHmvdbmIhBjp3eKfSXF29xWnM=.new
/data/data/####/databases/pushsdk.db-journal
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/3abx-nzaOnJ9_tpSoR_bfJ8g0IOVmEDALb2w3w==.new
/data/data/####/files/mobclick_agent_cached_####1610211201
/data/data/####/databases/log-journal
/data/data/####/files/gdaemon_20161017
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/shared_prefs/com.klauncher.kinflow.common.utils.CommonShareData.xml
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/ZYeDS2v5hjmrqtcLCCo8jg==/cpi_IYUusxwRqyOy.zip
/sdcard/system/tmp/local/tdata_Now710
/data/data/####/shared_prefs/biddingos.pkg.xml
/data/data/####/databases/cc/cc.db-journal
/data/data/####/shared_prefs/install.app.xml
/data/data/####/shared_prefs/theme_preferences.xml
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/UEocnzw8CAJc0AuKxPHo0eB4_lQkf4CTgt_lgQ==.new
/data/data/####/shared_prefs/biddingos.events.xml
/data/data/####/databases/notifier.db-journal
/sdcard/.armsd/alLbon3AuQynvtpS/r_pkDgN4OhnkSa0D
/data/data/####/databases/launcher.db-journal
/data/data/####/databases/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_uH0crjKD8YNWx2Jj-journal
/data/data/####/files/themefolder/res/.DS_Store
/data/data/####/files/themefolder/res/drawable-xxhdpi/.DS_Store
/sdcard/system/tmp/local/tdata_kHG382
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/LkREeRlAQuaEy2IK/ofeG9tbdFjbB58UXCprx0ciagqIkbZs9k0hklA==
/data/data/####/files/launcher.preferences
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/8Rmg8QcjS3EcrFuPcN2OOR0bkPOQQg6mRaBlcA==.new
/sdcard/libs/com.getui.sdk.deviceId.db
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/Y0ouS2F2y5szygRS/mByCNuwHn8C50Z-EG0Xg3CyrBQI=.temp
/data/data/####/databases/cc/cc.db
/data/data/####/databases/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_VFIF_nu9ZDY67_mwsNPCNAXifhw=-journal
/data/data/####/databases/pushext.db-journal
/data/data/####/code-3531129/u9SeGNvZsUCtwuTN
/data/data/####/shared_prefs/DefaultPage.xml
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/GXfXt1_MaKzDvfU1nTTCpg==.new
/data/data/####/files/tdata_kHG382.jar
/data/data/####/files/rdata.new
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/tSMmgxb0L-hnrfDCqux6Fw==/cSBgxLU5YO6X2fT5Jmwu8g==.new
/sdcard/libs/com.igexin.sdk.deviceId.db
/data/data/####/files/stats.log.tmp
/data/data/####/files/tdata_Now710.jar
/data/data/####/files/tdata_Now710
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/v4ddUZr6rsdPoUTVigCZkQ==/bvpazi17ujzKmzQa9bpHuA==
/data/data/####/files/rdata
/sdcard/.armsd/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
/data/data/####/shared_prefs/com.android.launcher3.prefs.xml
/sdcard/libs/app.db
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_erddIQBUbliM5M-e_app/tSMmgxb0L-hnrfDCqux6Fw==/ev6xFUizAMuX3m2fs-008ABTU-qWnPbF.new
/data/data/####/files/stats.log
/data/data/####/cache/widgetpreviews.db-journal
/data/data/####/files/H31l6ST1Jn1vehsCsv8rfw==/MFQMdkjc8h_5mDecy7f3IZ3xWwU=
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/.IdeaDesktop/.backup/.localbackup/vibeui_backup.lbk
/data/data/####/files/S_6NnxDp_b5ktC62wGJYq27KnFprEEMQCl0gp9WFc2VoXdxW_files/ML2_5WDbBSpZ-ZSd/NjLD1gGYXWP_U624.new
/data/data/####/files/val_Am8mvD0Kt9CwVk91DVmnLxkEQQrJ3HYb9T6hDcdys8Z9/LqToPe6H0Q9MfUQUZYrs3Q==

Sets the 'executable' attribute to the following files:

/data/data/####/files/gdaemon_20161017

Miscellaneous:

Executes next shell scripts:

chmod 700 /data/data/####/files/gdaemon_20161017
/data/data/####/code-3531129/u9SeGNvZsUCtwuTN #### com.klauncher.cplauncher.vajcvw.a.a.c.b /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M /storage/emulated/0/Download/ladung
/data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25441 300 0

Contains functionality to send SMS messages automatically.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial