Android.Packed.22511

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.BackDoor.312
Android.Triada.155.origin
Android.Triada.248.origin
Tool.SMSSend.76.origin
Android.Backdoor.547.origin

Downloads the following detected threats from the Web:

Android.BackDoor.325

Network activity:

Connecting to:

i####.####.com
j####.####.com
p####.####.com:8066
p####.####.com
r####.####.com
d####.####.net:6677
j####.####.com:20000
d####.####.net
a####.####.com

HTTP GET requests:

r####.####.com/ads/img/a0e8ad379e604e07871685e5c5c37dba.png
r####.####.com/ads/img/7cb09c6b20524c14b12d24557611883a.png
r####.####.com/ads/img/cd79222e114c4c158c07d90dee4f96d5.jpg
i####.####.com/ando-res/m/4HjBJu51SRZ6w2qcEzn09SbmXnxQ8vbP2y*I88C1gtWjo-...
r####.####.com/ads/img/2cd5ec31a1f84798a4920cb12a9710bb.png
r####.####.com/ads/pri/1459226725432.slz
r####.####.com/ads/pri/b4844bf032ed438686c8edde6b5d989b.apk
r####.####.com/ads/img/36871e05b15f44e9b229bce19ce5ba93.png

HTTP POST requests:

p####.####.com:8066/s/
d####.####.net/
d####.####.net:6677/
a####.####.com/ando/x/liv?app_id=18195706-f375-4a00-86e2-c6ed41992e96&r=...
j####.####.com:20000/
j####.####.com/
p####.####.com/s/

Modified file system:

Creates the following files:

<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/3TunN3S_doM7_odnW0zJKw==/zlXxAs0TYQtVW8gQ.zip
<Package Folder>/databases/webview.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/rtMPxt4G8FdDgVhPwrmz3A==/rfK6nuWUi_YKmM5r3SBCGw==
<Package Folder>/files/dex/cj.jar
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/Nw-aWFNapt8jidi3udz11g==.new
<Package Folder>/databases/notepad.db-journal
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/Nw-aWFNapt8jidi3udz11g==
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/rtMPxt4G8FdDgVhPwrmz3A==/1OSpZVdMaLFcKnH_
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/A8n-4kcrxzaC_avviOP6rQ==.new
<Package Folder>/databases/MF_ENH-journal
<Package Folder>/shared_prefs/initdata.xml
<Package Folder>/shared_prefs/indion.xml.bak
<Package Folder>/files/myfvu.jar
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/df-uq4lrY3AOJWRJzMHw0w==/data.dat.tmp
<Package Folder>/files/5e1e058e0a5/2328da0c-1f10-47ab-a972-3e6572eb530a.zip
<Package Folder>/shared_prefs/ad_config.xml
<Package Folder>/files/avcecr
<Package Folder>/files/cfg.data
<Package Folder>/databases/MF_SQdb-journal
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/setting.xml
<Package Folder>/databases/MF_CFG-journal
<Package Folder>/shared_prefs/sp_haoapp.xml
<Package Folder>/files/6hOm8UepBqS2AKhQVj_aZGGFwRQmbq6oOuZkZ7viemg=/F94oXGb4SJu92mK1
<Package Folder>/databases/com_ex_dsp.db-journal
<Package Folder>/shared_prefs/indion.xml
<Package Folder>/files/look
<Package Folder>/files/sxbfvq_d/sxbfvq_f.zip