Android.Packed.24549

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSend.1848.origin
Android.SmsSend.1848.origin

Downloads the following detected threats from the Web:

Android.SmsSend.1848.origin
Android.SmsSend.1848.origin

Network activity:

Connecting to:

1####.####.211
a####.####.com
and####.####.com
i####.####.com
i####.####.com:10003
m####.com
m####.com:8088
p####.####.cc
p####.####.com
quanzh####.com:8088
re####.####.com
re####.####.com:10002

HTTP GET requests:

i####.####.com/a/3db355750bea842d8ee0cece950aa5ecd
p####.####.com/cityjson?ie=####
re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...

HTTP POST requests:

1####.####.211/amb/rhi.html
a####.####.com/app_logs
and####.####.com/rqd/async?aid=####
i####.####.com:10003/v2/chis
m####.com/sdk-selector/sdk/select
m####.com:8088/sdk-selector/sdk/select
p####.####.cc/index.php/MC/HB
p####.####.com/api/q/a/3db355750bea842d8ee0cece950aa5ecd
quanzh####.com:8088/MakeJoyJson/JsonRead

Modified file system:

Creates the following files:

<Package Folder>/app_crashrecord/1004
<Package Folder>/databases/MA_epay_db
<Package Folder>/databases/MA_epay_db-journal
<Package Folder>/databases/MaiStore.db-journal
<Package Folder>/databases/bil_db
<Package Folder>/databases/bil_db-journal
<Package Folder>/databases/bugly_db_-journal
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/plus.jar
<Package Folder>/files/.imprint
<Package Folder>/files/libexec.so
<Package Folder>/files/local_crash_lock
<Package Folder>/files/local_crash_lock (deleted)
<Package Folder>/files/mj.apk
<Package Folder>/files/mj.dex (deleted)
<Package Folder>/files/mobclick_agent_cached_<Package>96
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/security_info
<Package Folder>/files/umeng_it.cache
<Package Folder>/pspace/nexor.jar
<Package Folder>/pspace/prim.jar
<Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
<Package Folder>/shared_prefs/CONFIG.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/b_setting.xml
<Package Folder>/shared_prefs/b_share.xml
<Package Folder>/shared_prefs/crashrecord.xml
<Package Folder>/shared_prefs/ma_call.xml
<Package Folder>/shared_prefs/ma_data.xml
<Package Folder>/shared_prefs/ma_epay_share.xml
<Package Folder>/shared_prefs/ma_epay_share.xml.bak
<Package Folder>/shared_prefs/nnt_data.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/share_data.xml
<Package Folder>/shared_prefs/share_data.xml.bak
<Package Folder>/shared_prefs/share_ecd.xml
<Package Folder>/shared_prefs/share_version.xml
<Package Folder>/shared_prefs/shared_file.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/zzconfig.xml
<SD-Card>/.tcookieid