Android.Packed.33011

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.88.origin
Android.Xiny.73.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) re####.site:80
TCP(HTTP/1.1) smart####.google####.com:80
TCP(HTTP/1.1) vi####.ddf####.com:80
TCP(HTTP/1.1) d.billyaf####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) www.technol####.net:80
TCP(HTTP/1.1) t####.snapbac####.com:80
TCP(HTTP/1.1) a####.hitthe####.mobi:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) api.pings####.com:80
TCP(HTTP/1.1) thiscli####.com:80
TCP(HTTP/1.1) tretras####.com:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) adse####.hitthe####.mobi:80
TCP(HTTP/1.1) offence####.accountant:80
TCP(HTTP/1.1) api.ki####.com:80
TCP(HTTP/1.1) www.zfr####.com:80
TCP(HTTP/1.1) verak####.com:80
TCP(HTTP/1.1) api.bi####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) amc.jiek####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) www.cu####.com:80
TCP(HTTP/1.1) cpgnrot####.com:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) c.n####.com:443
TCP(TLS/1.0) digital####.com:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) f####.google####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) billmsc####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) sconten####.xx.f####.net:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

a####.hitthe####.mobi
adse####.hitthe####.mobi
adser####.go####.com
adser####.go####.nl
amc.jiek####.com
api.bi####.com
api.ki####.com
api.pings####.com
billmsc####.com
c.n####.com
cpgnrot####.com
d.billyaf####.com
digital####.com
f####.google####.com
googl####.g.doublec####.net
ilv####.com
offence####.accountant
pag####.googles####.com
re####.site
sconten####.xx.f####.net
serv####.m####.com
smart####.google####.com
st####.xx.f####.net
t####.snapbac####.com
thiscli####.com
verak####.com
vi####.ddf####.com
www.cu####.com
www.face####.com
www.google-####.com
www.koapk####.com
www.okyes####.com
www.technol####.co.uk
www.technol####.net
www.zfr####.com

HTTP GET requests:

a####.hitthe####.mobi/?utm_medium=####&utm_campaign=####&cid=####
a####.hitthe####.mobi/?utm_term=####&clickverify=####&utm_content=####
a####.hitthe####.mobi/proc.php?045d0c7####
amc.jiek####.com/sdkcp/plugUpdate.php?uid=####&model=####&plugVersion=##...
amc.jiek####.com/sdkcp/push_msgcp_new.php?uid=####&model=####&plugVersio...
amc.jiek####.com/sdkcp/user_visit_appcp.php?uid=####&model=####&plugVers...
api.bi####.com/sdkOffer?os=####&model=####&gaid=####&imei=####&androidId...
api.ki####.com/click?tid=####
api.ki####.com/express?tid=####
offence####.accountant/10.jpg
offence####.accountant/11.jpg
offence####.accountant/7.jpg
offence####.accountant/8.jpg
offence####.accountant/9.jpg
offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
offence####.accountant/flag.png
offence####.accountant/index.html
offence####.accountant/ip7.png
offence####.accountant/iphone6.jpg
offence####.accountant/iphone7.jpg
offence####.accountant/item1.png
offence####.accountant/item2.png
offence####.accountant/item3.png
offence####.accountant/like.png
offence####.accountant/search.png
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171023/r20170110/show_ads_impl.js
serv####.m####.com/119987?t=0.09424321656115353&ref=&lu=http://www.techn...
serv####.m####.com/119987?t=0.7516815715935081&ref=&lu=http://www.techno...
smart####.google####.com/?utm_medium=####&utm_campaign=####&1=####&cid=#...
smart####.google####.com/?utm_term=####&clickverify=####&utm_content=####
smart####.google####.com/proc.php?73ffe6f####
tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
www.cu####.com/20171024172323.BD_Ob_521Dex_10241721.zip
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...

HTTP POST requests:

api.bi####.com/un
vi####.ddf####.com/api/o
vi####.ddf####.com/api/va
www.koapk####.com:8081/sm/sr/rt/ry
www.okyes####.com:8081/sdk/nsd.action?b=####
www.zfr####.com/up.do

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_0 (deleted)
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_1 (deleted)
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_2 (deleted)
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/data_3 (deleted)
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index (deleted)
<Package Folder>/cache/bb.jar
<Package Folder>/databases/####/file__0.localstorage-journal
<Package Folder>/databases/####/http_www.technologycraze.co.uk_...ournal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/easv.data-journal
<Package Folder>/databases/plug.dataBase
<Package Folder>/databases/plug.dataBase-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/201709211650.apk
<Package Folder>/files/SW01.jar
<Package Folder>/files/c201709211650.apk
<Package Folder>/files/ob1.dex
<Package Folder>/files/ob1.zip
<Package Folder>/files/so.jar
<Package Folder>/files/so.jar (deleted)
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/MobikokCache_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml (deleted)
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak
<Package Folder>/shared_prefs/MobikokConfig_Type_1.xml.bak (deleted)
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/SpZvPrefs.xml
<Package Folder>/shared_prefs/WebViewSettings.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/cn_rs.xml
<Package Folder>/shared_prefs/com.solo.adsdk.preference.optimize.xml
<Package Folder>/shared_prefs/com.solo.adsdk.preference.user.xml
<Package Folder>/shared_prefs/duspf6030945.xml
<Package Folder>/shared_prefs/local_storage0.xml
<Package Folder>/shared_prefs/local_storage999.xml
<Package Folder>/shared_prefs/m_cfg.xml
<Package Folder>/shared_prefs/ops_data.xml
<Package Folder>/shared_prefs/sp.xml
<Package Folder>/shared_prefs/t_ini.xml
<SD-Card>/APPMarket/####/122190031.png.tmp
<SD-Card>/test1508143336857

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
c201709211650.apk -p <Package> -c <Package>:yieldformula
chmod 6777 <Package Folder>/files/c201709211650.apk
logcat -d -v time
ps
sh

Loads the following dynamic libraries:

com.beginning

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial