Android.Packed.24136

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSend.18879

Downloads the following detected threats from the Web:

Android.SmsSend.18879

Network activity:

Connecting to:

1####.####.193
bestpho####.mobi
c####.####.net
c####.com
cl####.####.de
cleando####.com
f####.####.biz
f####.####.com
gl####.####.com:9090
m####.####.com
namet####.com
r####.####.com
tra####.####.com
trackme####.com
u####.com
u####.com:7079

HTTP GET requests:

1####.####.193/dlv/c.php?cca=####&ccz=####&subid=####&siteid=####
bestpho####.mobi/?sl=####&data1=####&data2=####&data3=####&data4=####&tr...
c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
c####.com/?a=####&c=####&E=####&s1=####&s2=####&s3=####&campid=####&pid=...
cl####.####.de/?aff_id=####&offer_id=####&ext_id=####&campid=####&pid=####
cleando####.com/
f####.####.biz/images/xtrem/480x384y51200o.jpg/liste_559.480x384y51200o....
f####.####.com/css?family=####
f####.####.com/s/opensans/v14/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2P...
gl####.####.com:9090/app?IsOnlyCp=####&phone=####&offerid=####&affid=###...
m####.####.com/c/69c5e7f9210e673c?tid=####&trafficsource_id=####&token2=...
m####.####.com/xtrem/js/vendor/jquery-1.8.2.min.js
namet####.com/d/34558576bb5b034b07?sub=####&source=####
r####.####.com/?m=####&offer_key=####&fc=####&a=####&pubid=####
tra####.####.com/?p=####&media_type=####&click_id=####&pi=####
trackme####.com/r/9c8c11dc-6095-11e7-b8fd-11419355d4cd/0/

HTTP POST requests:

u####.com/jsdk/sd.action?b=####
u####.com:7079/jsdk/sd.action?b=####

Modified file system:

Creates the following files:

<Package Folder>/app_jiagu/mo.ca.ql.vd.uv_201707041406.ppt
<Package Folder>/app_jiagu/x.apk
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/f_000022
<Package Folder>/cache/####/f_000023
<Package Folder>/cache/####/f_000024
<Package Folder>/cache/####/f_000025
<Package Folder>/cache/####/f_000026
<Package Folder>/cache/####/f_000027
<Package Folder>/cache/####/f_000028
<Package Folder>/cache/####/f_000029
<Package Folder>/cache/####/f_00002a
<Package Folder>/cache/####/f_00002b
<Package Folder>/cache/####/f_00002c
<Package Folder>/cache/####/f_00002d
<Package Folder>/cache/####/f_00002e
<Package Folder>/cache/####/f_00002f
<Package Folder>/cache/####/f_000030
<Package Folder>/cache/####/f_000031
<Package Folder>/cache/####/f_000032
<Package Folder>/cache/####/f_000033
<Package Folder>/cache/####/f_000034
<Package Folder>/cache/####/f_000035
<Package Folder>/cache/####/f_000036
<Package Folder>/cache/####/f_000037
<Package Folder>/cache/####/f_000038
<Package Folder>/cache/####/f_000039
<Package Folder>/cache/####/f_00003a
<Package Folder>/cache/####/f_00003b
<Package Folder>/cache/####/f_00003c
<Package Folder>/cache/####/f_00003d
<Package Folder>/cache/####/f_00003e
<Package Folder>/cache/####/f_00003f
<Package Folder>/cache/####/f_000040
<Package Folder>/cache/####/f_000041
<Package Folder>/cache/####/f_000042
<Package Folder>/cache/####/f_000043
<Package Folder>/cache/####/f_000044
<Package Folder>/cache/####/f_000045
<Package Folder>/cache/####/f_000046
<Package Folder>/cache/####/f_000047
<Package Folder>/cache/####/f_000048
<Package Folder>/cache/####/f_000049
<Package Folder>/cache/####/f_00004a
<Package Folder>/cache/####/f_00004b
<Package Folder>/cache/####/f_00004c
<Package Folder>/cache/####/f_00004d
<Package Folder>/cache/####/f_00004e
<Package Folder>/cache/####/f_00004f
<Package Folder>/cache/####/f_000050
<Package Folder>/cache/####/f_000051
<Package Folder>/cache/####/f_000052
<Package Folder>/cache/####/f_000053
<Package Folder>/cache/####/f_000054
<Package Folder>/cache/####/f_000055
<Package Folder>/cache/####/f_000056
<Package Folder>/cache/####/f_000057
<Package Folder>/cache/####/f_000058
<Package Folder>/cache/####/f_000059
<Package Folder>/cache/####/f_00005a
<Package Folder>/cache/####/f_00005b
<Package Folder>/cache/####/f_00005c
<Package Folder>/cache/####/f_00005d
<Package Folder>/cache/####/f_00005e
<Package Folder>/cache/####/f_00005f
<Package Folder>/cache/####/f_000060
<Package Folder>/cache/####/f_000061
<Package Folder>/cache/####/f_000062
<Package Folder>/cache/####/f_000063
<Package Folder>/cache/####/f_000064
<Package Folder>/cache/####/f_000065
<Package Folder>/cache/####/f_000066
<Package Folder>/cache/####/f_000067
<Package Folder>/cache/####/f_000068
<Package Folder>/cache/####/f_000069
<Package Folder>/cache/####/f_00006a
<Package Folder>/cache/####/f_00006b
<Package Folder>/cache/####/f_00006c
<Package Folder>/cache/####/f_00006d
<Package Folder>/cache/####/f_00006e
<Package Folder>/cache/####/f_00006f
<Package Folder>/cache/####/f_000070
<Package Folder>/cache/####/f_000071
<Package Folder>/cache/####/f_000072
<Package Folder>/cache/####/f_000073
<Package Folder>/cache/####/f_000074
<Package Folder>/cache/####/f_000075
<Package Folder>/cache/####/f_000076
<Package Folder>/cache/####/f_000077
<Package Folder>/cache/####/index
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/fileswapsdk/####/170531080506570.dex
<Package Folder>/fileswapsdk/####/170531080506570.dex (deleted)
<Package Folder>/fileswapsdk/####/go.png
<Package Folder>/fileswapsdk/####/localCopy.data
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/tip.xml
<Package Folder>/shared_prefs/tip.xml.bak

Miscellaneous:

Executes next shell scripts:

<dexopt>

Uses special library to hide executable bytecode.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial