Android.Packed.20519

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Triada.155.origin
Android.Triada.151.origin

Network activity:

Connecting to:

i####.####.com
o####.####.com
6####.####.140
w####.####.cn
1####.####.136
i####.####.cn
1####.####.136:8090
a####.####.com

HTTP GET requests:

i####.####.com/ando-res/m/i0r*lg6v0h8-VWU1P*FQdeOi4Rt063q4kkFbwd7Db1IzyT...

HTTP POST requests:

1####.####.136:8090/main.aspx
6####.####.140/ando/x/liv?app_id=####&r=####
w####.####.cn/ip.jsp
o####.####.com/check_config_update
1####.####.136/main.aspx
i####.####.cn/iplookup/iplookup.php?format=####
a####.####.com/app_logs

Modified file system:

Creates the following files:

/data/data/####/files/Gljd-UwnP23BbGscDdjO_hzcGIs_aIrg/TRyethJPEcN3dlGIttnhtA==/data.dat.tmp
/sdcard/mmt/widegets/data/test.datac5fd18d-2586-4507-b4f6-3479deba4ba2.tmp
/data/data/####/files/Gljd-UwnP23BbGscDdjO_hzcGIs_aIrg/VrqDezoScu8NXpAbWo9w0w==.new
/data/data/####/app_res_out/rs.apk
/sdcard/.uct/uuid3a34f5c2f-2967-4455-8481-7553c99ddee3.tmp
/sdcard/tmpsd11012/test.dat70d9fcb2-268c-4804-af68-e4397f4e28eb.tmp
/sdcard/sdtmp/id1afcf79a6-9a7d-425a-aefc-97d979f8f221.tmp
/sdcard/tmpsd11012/test.datda354217-6c70-4dd2-9e3e-e6d843fe431d.tmp
/sdcard/sdtmp/id138847f83-c535-4a7d-95ed-b79da68172ac.tmp
/sdcard/.hand/developkey0bc2b370-07bc-434f-92d2-3c5f16a7dfe8.tmp
/data/data/####/files/Gljd-UwnP23BbGscDdjO_hzcGIs_aIrg/xdUTB5kYWqJUnZzY7y7AOg==/cN7XNDvVCOjvCVdy.temp
/data/data/####/app_pload_lib/libhelper.so
/sdcard/.env/.uunique.new
/sdcard/sdtmp/id27c61f4bb-b9c1-4b38-9625-1539bd43026a.tmp
/sdcard/sdtmp/id2eb09c327-182f-42ed-836e-9ebb0f897439.tmp
/data/data/####/app_pload_odex/pload.dex
/data/data/####/files/Gljd-UwnP23BbGscDdjO_hzcGIs_aIrg/xdUTB5kYWqJUnZzY7y7AOg==/toXcJ3dsW2KUbga1YI1sTg==
/data/data/####/files/rdata
/sdcard/sdtmp/id2c4876169-b6a9-4d20-beb5-f1cc259aa143.tmp
/data/data/####/app_pload_odex/pload.apk
/data/data/####/app_pload_odex/pload.inf
/sdcard/mmt/widegets/data/droidinfo-journal
/sdcard/sdtmp/id10f15baa0-8062-44f4-9c9b-eb11f4e1e40b.tmp
/sdcard/tmpsd11012/test.dat3b07b1b2-5e94-4878-b894-d17e04409d54.tmp
/sdcard/sdtmp/id2bf72d0c5-1dbe-4b90-9262-7ed51c0cb703.tmp
/data/data/####/files/Gljd-UwnP23BbGscDdjO_hzcGIs_aIrg/BzwnopcEPcsXTmhv.new
/sdcard/Android/data/####/cache/.nomedia
/sdcard/mmt/widegets/data/test.datc98758c3-c164-401f-8b01-bad73feb5746.tmp
/sdcard/mmt/widegets/data/test.dat83683740-7fd4-4ea8-bb49-27d33b3627ca.tmp
/sdcard/sdtmp/id1955fce6b-a180-4c1f-b7cb-a861800fcbc4.tmp
/sdcard/mmt/widegets/data/droidinfo