Android.Packed.21484

Added to the Dr.Web virus database: 2017-05-14

Virus description added: 2017-05-15

Malicious functions:

Executes code of the following detected threats:

Network activity:

Connecting to:

HTTP POST requests:

Modified file system:

Creates the following files:

/sdcard/.hand/developkeyecda6606-d8b7-4a85-bc63-454259696d8a.tmp
/sdcard/sdtmp/id1855d237e-b95b-4a44-8624-9e3f4e5672b4.tmp
/data/data/####/app_pload_lib/libhelper.so
/sdcard/tmpsd11012/test.datab78b5c0-4db8-40c4-8338-0ba7cb5eaeb3.tmp
/data/data/####/files/rdata_comodpeqpxv.new
/sdcard/mmt/widegets/data/test.datacc26532-f9c4-4b9b-be21-79a942ddeae5.tmp
/sdcard/.uct/uuid37a19a3a7-e129-48dd-8565-dbb1f6ace8d7.tmp
/data/data/####/app_res_out/rs.apk
/sdcard/tmpsd11012/test.dat63cbc69b-ecf6-4b27-9dba-86e7b860a950.tmp
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/cSCgoGEGKTvl0LYURuuxBlPUWweBl5XG/qn51wcZ7WsX-auyTy-RkDQ==
/data/data/####/files/cSCgoGEGKTvl0LYURuuxBlPUWweBl5XG/SBsyB0YYxDFTQxtCs58_7w==/3j6NUvBzDgXr1KG6PSTrSw==
/data/data/####/files/cSCgoGEGKTvl0LYURuuxBlPUWweBl5XG/yOe60LFKJFnWPCC7MbjuQQ==/data.dat.tmp
/data/data/####/app_pload_odex/pload.dex
/data/data/####/files/mobclick_agent_cached_####1
/sdcard/mmt/widegets/data/test.dat61762f56-d57f-4cab-ac08-0f71338bc62d.tmp
/sdcard/.hand/lastacc9d919c17-00ff-40a9-a498-231eb4f64364.tmp
/data/data/####/app_pload_odex/pload.inf
/sdcard/mmt/widegets/data/droidinfo-journal
/sdcard/Android/data/####/cache/.nomedia
/sdcard/sdtmp/id27ff84aca-0142-4c10-8a36-04ba0a6860f4.tmp
/data/data/####/app_pload_odex/pload.apk
/sdcard/mmt/widegets/data/droidinfo

Miscellaneous:

Executes next shell scripts:

/system/bin/.nbwayxwzt
conbb od2gf04pd9
/system/bin/dexopt --dex 27 40 40 521048 /data/data/####/app_pload_odex/pload.apk 1234543554 -553765784 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
cat /sys/class/net/wlan0/address
ls -l /system/bin/su
/system/bin/dexopt --dex 27 42 40 95712 /data/data/####/files/huffbg_d/huffbg_f.zip 1230985454 -1124487637 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syste

Contains functionality to send SMS messages automatically.