Android.Packed.21058

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.99.origin
Android.Xiny.122.origin
Android.DownLoader.441.origin
Android.Xiny.115.origin

Network activity:

Connecting to:

1####.####.198
g####.####.com
1####.####.198:8088
b####.####.com

HTTP GET requests:

g####.####.com/game-log/api.do?op=####&ei=####&si=####&chn=####&ver=####...

HTTP POST requests:

b####.####.com/billing/action.json
b####.####.com/billing/action.json?checksum=####
1####.####.198:8088/charge/judgeIfBlack.htm
1####.####.198/charge/judgeIfBlack.htm

Modified file system:

Creates the following files:

/data/data/####/cache/CommandCache/75fa4bdbf2c1284c6ce1a9057bcc2062
/data/data/####/shared_prefs/com.avos.avoscloud.RequestStatisticsUtil.data.xml
/data/data/####/0c071c180a0c270848786.dex
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/mj.apk
/data/data/####/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
/data/data/####/databases/database-journal
/data/data/####/cache/CommandCache/fbd52b3bd2bff43014d214c3c3e1c9e5
/data/data/####/shared_prefs/yoypaysdk_pref.xml
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/shared_prefs/3051b094348b98ff9cdf9e83ea5a4d601|account_file.xml
/data/data/####/databases/yoypaysdk.db
/data/data/####/shared_prefs/zhangpay_sms_info.xml
/data/data/####/cache/Analysis/avoscloud-analysis
/data/data/####/files/0c071c180a0c476182928.jar
/data/data/####/files/0c071c180a0c220759443.jar
/data/data/####/files/.yoypay/account/tourist.act
/sdcard/.yoypay/account/tourist.act
/sdcard/.tcookieid
/data/data/####/databases/yoypaysdk.db-journal
/data/data/####/files/installation
/data/data/####/files/mj.dex
/data/data/####/0909181a13010f141319236830.dex
/data/data/####/files/0c071c180a0c980993444.jar
/sdcard/Sonnenblume/res.apk.u
/data/data/####/shared_prefs/com.freepay.sdk.a.xml.bak
/data/data/####/files/0c071c180a0c270848786.jar
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/shared_prefs/zhangpay_share.xml.bak
/data/data/####/cache/CommandCache/bcb757498a149a1f5bcd968582129c4c
/data/data/####/files/0909181a13010f141319236830.jar
/sdcard/Sonnenblume/4A72F2DFFDBD84EB0C5C797BB76AFC44
/data/data/####/shared_prefs/tdid.xml
/data/data/####/cache/CommandCache/8c296e8cea027e52e238853c5c8d404d
/data/data/####/shared_prefs/com.freepay.sdk.a.xml
/data/data/####/shared_prefs/zhangpay_share.xml
/data/data/####/shared_prefs/AVOSCloud-SDK.xml
/sdcard/Sonnenblume/EE53AF5B170264468E95E783E26D76C2

Miscellaneous:

Executes next shell scripts:

dumpsys meminfo 2268
dumpsys meminfo 2071
/system/bin/dexopt --dex 27 87 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
/system/bin/dexopt --dex 27 55 40 747688 /data/data/####/app_dex/tmp.apk 1217570341 -728224948 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framewor
/system/bin/dexopt --dex 27 70 40 365500 /storage/emulated/0/Sonnenblume/res.apk 1220118214 339181203 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
cat /proc/meminfo
dumpsys meminfo 2436
/system/bin/dexopt --dex 27 82 40 365500 /storage/emulated/0/Sonnenblume/res.apk 1220118214 339181203 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
/system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c220759443.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
/system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c1535893303.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
/system/bin/dexopt --dex 27 80 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
cat /proc/cpuinfo
/system/bin/dexopt --dex 27 87 40 365500 /storage/emulated/0/Sonnenblume/res.apk 1220118214 339181203 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
/system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c980993444.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
/system/bin/dexopt --dex 27 92 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
/system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c270848786.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
/system/bin/dexopt --dex 27 45 40 158684 /data/data/####/files/0909181a13010f141319236830.jar 1200268050 -1513649776 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
/system/bin/dexopt --dex 27 81 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j
/system/bin/dexopt --dex 27 44 40 25640 /data/data/####/files/0c071c180a0c476182928.jar 1217568120 354108880 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fram
/system/bin/dexopt --dex 27 86 40 123976 /data/data/####/files/mj.apk 1217814149 2110890602 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.j

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial