Android.Packed.25284

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSpy.677.origin

Downloads the following detected threats from the Web:

Android.SmsSpy.677.origin

Network activity:

Connecting to:

1####.####.65
1####.####.65:3702
a####.####.com
hangzho####.####.com
i####.####.com
m####.####.net
p####.####.com
q####.####.com:14302
z####.####.com
z####.####.com:9500
zxc####.####.com
zxc####.####.com:8200

HTTP GET requests:

hangzho####.####.com/qiyi/client/sdk/so/libzxvps.so
i####.####.com/a/315432f0c34a6005ff1c18a57a27f742e

HTTP POST requests:

1####.####.65/forwardupdate/update
1####.####.65:3702/forwardlog/users/new
a####.####.com/app_logs
m####.####.net/sc/s.action
p####.####.com/api/q/a/315432f0c34a6005ff1c18a57a27f742e
q####.####.com:14302/sdk_login?t=####
z####.####.com/
z####.####.com:9500/
zxc####.####.com/qy/acceptSdkFileReq
zxc####.####.com:8200/qy/acceptSdkFileReq

Modified file system:

Creates the following files:

<Package Folder>/2094.dex
<Package Folder>/2286.dex
<Package Folder>/app_td-cache/td_database_push
<Package Folder>/app_td-cache/tdandroidgame
<Package Folder>/cache/2094.dex (deleted)
<Package Folder>/cache/2286.dex (deleted)
<Package Folder>/code_cache/####/PayUtils-370.dex
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/qy_db_pay
<Package Folder>/databases/qy_db_pay-journal
<Package Folder>/databases/talkingdata_app.db
<Package Folder>/databases/talkingdata_app.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/files/####/about_str.gifppic
<Package Folder>/files/####/baidu
<Package Folder>/files/####/bg_cover.mp3
<Package Folder>/files/####/chg_b_cl.gifppic
<Package Folder>/files/####/chg_b_ok0.gifppic
<Package Folder>/files/####/chg_b_ok1.gifppic
<Package Folder>/files/####/chg_b_ok2.gifppic
<Package Folder>/files/####/chg_gift0.gifppic
<Package Folder>/files/####/chg_gift1.gifppic
<Package Folder>/files/####/chg_gift10.gifppic
<Package Folder>/files/####/chg_gift2.gifppic
<Package Folder>/files/####/chg_gift3.gifppic
<Package Folder>/files/####/chg_gift4.gifppic
<Package Folder>/files/####/chg_gift5.gifppic
<Package Folder>/files/####/chg_gift6.gifppic
<Package Folder>/files/####/chg_gift7.gifppic
<Package Folder>/files/####/chg_gift8.gifppic
<Package Folder>/files/####/chg_gift9.gifppic
<Package Folder>/files/####/chg_kefu.gifppic
<Package Folder>/files/####/chg_yuan.gifppic
<Package Folder>/files/####/cover.gifppic
<Package Folder>/files/####/cover_b0.gifppic
<Package Folder>/files/####/cover_b1.gifppic
<Package Folder>/files/####/cover_b2.gifppic
<Package Folder>/files/####/cover_b3.gifppic
<Package Folder>/files/####/cover_b4.gifppic
<Package Folder>/files/####/cover_b5.gifppic
<Package Folder>/files/####/cover_b6.gifppic
<Package Folder>/files/####/cover_b7.gifppic
<Package Folder>/files/####/cover_b8.gifppic
<Package Folder>/files/####/cover_b9.gifppic
<Package Folder>/files/####/cover_kefu.gifppic
<Package Folder>/files/####/cover_name.gifppic
<Package Folder>/files/####/cover_player_slot.gifppic
<Package Folder>/files/####/ef_burst.mp3
<Package Folder>/files/####/ef_button0.mp3
<Package Folder>/files/####/ef_fail.mp3
<Package Folder>/files/####/ef_kill.mp3
<Package Folder>/files/####/ef_succ.mp3
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/finger.gifppic
<Package Folder>/files/####/flower.gifppic
<Package Folder>/files/####/libmiguED.so
<Package Folder>/files/####/logo.gifppic
<Package Folder>/files/####/mall_b_all.gifppic
<Package Folder>/files/####/mall_b_close.gifppic
<Package Folder>/files/####/mall_b_gold_add.gifppic
<Package Folder>/files/####/mall_b_gold_bg.gifppic
<Package Folder>/files/####/mall_b_got.gifppic
<Package Folder>/files/####/mall_bg.gifppic
<Package Folder>/files/####/mall_deco.gifppic
<Package Folder>/files/####/mall_skin_achi.gifppic
<Package Folder>/files/####/mall_skin_bg0.gifppic
<Package Folder>/files/####/mall_skin_bg1.gifppic
<Package Folder>/files/####/mall_skin_btn0.gifppic
<Package Folder>/files/####/mall_skin_btn1.gifppic
<Package Folder>/files/####/mall_skin_btn2.gifppic
<Package Folder>/files/####/mall_skin_btn3.gifppic
<Package Folder>/files/####/mall_skin_btn4.gifppic
<Package Folder>/files/####/mall_skin_btn5.gifppic
<Package Folder>/files/####/mall_skin_btn6.gifppic
<Package Folder>/files/####/mall_skin_locked.gifppic
<Package Folder>/files/####/mall_skin_names.gifppic
<Package Folder>/files/####/mall_skin_price.gifppic
<Package Folder>/files/####/mall_skins.gifppic
<Package Folder>/files/####/mall_title.gifppic
<Package Folder>/files/####/mall_title_bg.gifppic
<Package Folder>/files/####/num1.gifppic
<Package Folder>/files/####/num10.gifppic
<Package Folder>/files/####/num11.gifppic
<Package Folder>/files/####/num12.gifppic
<Package Folder>/files/####/num13.gifppic
<Package Folder>/files/####/num14.gifppic
<Package Folder>/files/####/num15.gifppic
<Package Folder>/files/####/num16.gifppic
<Package Folder>/files/####/num2.gifppic
<Package Folder>/files/####/num3.gifppic
<Package Folder>/files/####/num4.gifppic
<Package Folder>/files/####/num5.gifppic
<Package Folder>/files/####/num6.gifppic
<Package Folder>/files/####/num7.gifppic
<Package Folder>/files/####/num8.gifppic
<Package Folder>/files/####/num9.gifppic
<Package Folder>/files/####/over_b_back.gifppic
<Package Folder>/files/####/over_b_replay.gifppic
<Package Folder>/files/####/over_bg.gifppic
<Package Folder>/files/####/over_title.gifppic
<Package Folder>/files/####/particle_shape.gifppic
<Package Folder>/files/####/pass_deco0.gifppic
<Package Folder>/files/####/pass_deco1.gifppic
<Package Folder>/files/####/pass_deco2.gifppic
<Package Folder>/files/####/pass_title.gifppic
<Package Folder>/files/####/pause_b_0.gifppic
<Package Folder>/files/####/pause_b_1.gifppic
<Package Folder>/files/####/pause_b_2.gifppic
<Package Folder>/files/####/pause_bg.gifppic
<Package Folder>/files/####/run_b_burst.gifppic
<Package Folder>/files/####/run_b_grow.gifppic
<Package Folder>/files/####/run_b_invi.gifppic
<Package Folder>/files/####/run_b_pause.gifppic
<Package Folder>/files/####/run_bg.gifppic
<Package Folder>/files/####/run_move_panel.gifppic
<Package Folder>/files/####/run_move_point.gifppic
<Package Folder>/files/####/run_rank_title.gifppic
<Package Folder>/files/####/run_rank_top.gifppic
<Package Folder>/files/####/run_score.gifppic
<Package Folder>/files/####/setting_bg.gifppic
<Package Folder>/files/####/setting_close.gifppic
<Package Folder>/files/####/setting_sel.gifppic
<Package Folder>/files/####/skin_00.gifppic
<Package Folder>/files/####/skin_01.gifppic
<Package Folder>/files/####/skin_10.gifppic
<Package Folder>/files/####/skin_100.gifppic
<Package Folder>/files/####/skin_101.gifppic
<Package Folder>/files/####/skin_11.gifppic
<Package Folder>/files/####/skin_110.gifppic
<Package Folder>/files/####/skin_111.gifppic
<Package Folder>/files/####/skin_112.gifppic
<Package Folder>/files/####/skin_120.gifppic
<Package Folder>/files/####/skin_121.gifppic
<Package Folder>/files/####/skin_130.gifppic
<Package Folder>/files/####/skin_131.gifppic
<Package Folder>/files/####/skin_132.gifppic
<Package Folder>/files/####/skin_140.gifppic
<Package Folder>/files/####/skin_141.gifppic
<Package Folder>/files/####/skin_142.gifppic
<Package Folder>/files/####/skin_143.gifppic
<Package Folder>/files/####/skin_150.gifppic
<Package Folder>/files/####/skin_151.gifppic
<Package Folder>/files/####/skin_152.gifppic
<Package Folder>/files/####/skin_153.gifppic
<Package Folder>/files/####/skin_154.gifppic
<Package Folder>/files/####/skin_160.gifppic
<Package Folder>/files/####/skin_161.gifppic
<Package Folder>/files/####/skin_20.gifppic
<Package Folder>/files/####/skin_21.gifppic
<Package Folder>/files/####/skin_22.gifppic
<Package Folder>/files/####/skin_23.gifppic
<Package Folder>/files/####/skin_30.gifppic
<Package Folder>/files/####/skin_31.gifppic
<Package Folder>/files/####/skin_32.gifppic
<Package Folder>/files/####/skin_40.gifppic
<Package Folder>/files/####/skin_41.gifppic
<Package Folder>/files/####/skin_42.gifppic
<Package Folder>/files/####/skin_43.gifppic
<Package Folder>/files/####/skin_44.gifppic
<Package Folder>/files/####/skin_45.gifppic
<Package Folder>/files/####/skin_46.gifppic
<Package Folder>/files/####/skin_47.gifppic
<Package Folder>/files/####/skin_50.gifppic
<Package Folder>/files/####/skin_51.gifppic
<Package Folder>/files/####/skin_52.gifppic
<Package Folder>/files/####/skin_53.gifppic
<Package Folder>/files/####/skin_60.gifppic
<Package Folder>/files/####/skin_61.gifppic
<Package Folder>/files/####/skin_70.gifppic
<Package Folder>/files/####/skin_71.gifppic
<Package Folder>/files/####/skin_80.gifppic
<Package Folder>/files/####/skin_81.gifppic
<Package Folder>/files/####/skin_90.gifppic
<Package Folder>/files/####/skin_91.gifppic
<Package Folder>/files/####/skin_invi_bg.gifppic
<Package Folder>/files/####/skin_invi_deco0.gifppic
<Package Folder>/files/####/skin_invi_deco1.gifppic
<Package Folder>/files/####/skin_invi_deco2.gifppic
<Package Folder>/files/####/skin_invi_deco3.gifppic
<Package Folder>/files/####/skin_invi_deco4.gifppic
<Package Folder>/files/####/skin_invi_deco5.gifppic
<Package Folder>/files/####/skin_invi_deco6.gifppic
<Package Folder>/files/####/skin_player_name.gifppic
<Package Folder>/files/####/statistic_info_bg.gifppic
<Package Folder>/files/.imprint
<Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.cod
<Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.dat
<Package Folder>/files/PaySDK-1.2.13.16-UR_yx.jar
<Package Folder>/files/PaySDK-1.2.13.16-UR_yx.zip
<Package Folder>/files/PayUtils-370.jar
<Package Folder>/files/exid.dat
<Package Folder>/files/getprop
<Package Folder>/files/libmgRun_04.22.09_01.so
<Package Folder>/files/mgAS.dat
<Package Folder>/files/mgSS.dat
<Package Folder>/files/mgid.dat
<Package Folder>/files/pid
<Package Folder>/files/process.jar
<Package Folder>/files/process.zip
<Package Folder>/files/sdk_prefs
<Package Folder>/files/talkingdata_app_process_preferences_file
<Package Folder>/files/talkingdata_app_version_preferences_file
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/unique_id
<Package Folder>/libzxvps/####/libzxvps.so
<Package Folder>/libzxvps/####/tmp_so
<Package Folder>/shared_prefs/<IMSI>|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/unknown.xml
<SD-Card>/.Systemp/.cfg
<SD-Card>/.Systemp/device
<SD-Card>/.tcookieid

Miscellaneous:

Executes next shell scripts:

/system/bin/sh
<dexopt>
app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.tencent.mm.f.s.a
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/lib/process
dd if=<Package Folder>/lib/libprocess.so of=<Package Folder>/lib/process
getprop
ls -l /sbin/su
ls -l /system/bin/su
ls -l /system/sbin/su
ls -l /system/xbin/su
ls -l /vendor/bin/su
ps | grep <Package>
ps | grep com.qihoo360.mobilesafe.ssdlz.zxb
sh

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial