Android.Packed.24906

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.HiddenAds.79.origin
Android.Xiny.1.origin

Downloads the following detected threats from the Web:

Android.HiddenAds.79.origin
Android.Xiny.1.origin

Network activity:

Connecting to:

1####.####.108
1####.####.108:8013
19b4b6f####.####.com
67af5ea####.####.com
a####.####.com
a42eb85####.####.net
a49a1d2####.####.net
a7faee9####.####.net
ab5f72a####.####.net
ac69c60####.####.net
acf0ff9####.####.net
ad####.####.net
ad687e2####.####.net
adda0b3####.####.net
api-ce####.####.org
b####.####.com
bi####.####.com
c####.####.co
c####.####.com
c####.####.net
c####.####.org
c2f2208####.####.com
ce####.####.org
cloudfr####.####.com
con####.####.net
con####.####.nl
d####.####.com
d####.####.net
drachts####.nl
e####.####.com
e####.####.com:8088
f####.####.com
h####.com
i####.####.com
imgs####.####.nl
m####.####.com
m####.####.nl
p####.####.com
pag####.####.com
po####.####.com:84
pocketm####.####.org
st####.####.com
stat####.####.com
syn####.####.net
t####.####.com
t####.####.nl
teleg####.nl
tr####.####.com
tra####.####.com
u####.####.com

HTTP GET requests:

1####.####.108/m/umeng:58eb5c26c8957657a0000583/600/ArmLZyKTqF911QX0349l...
1####.####.108:8013/m/umeng:58eb5c26c8957657a0000583/600/ArmLZyKTqF911QX...
19b4b6f####.####.com/596870f3761f554803511d1d_500x334.jpg
67af5ea####.####.com/5967d518761f5548033c2ae5_500x334.jpg
a####.####.com//API/Click.ashx?M=MTAwM####&gaid=####&sid=####&subid=####
a####.####.com/2017/05/25/141518643.zip
a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
a####.####.com/api/ads/record/imp/?_s=####&oc1=####&oc2=####&provider=##...
a####.####.com/articles/5967608f761f5548032c75cd
a####.####.com/link/buy/android/com.hellofresh.androidapp/e1?clinkID=###...
a42eb85####.####.net/test.png
a49a1d2####.####.net/test.png
a7faee9####.####.net/test.png
ab5f72a####.####.net/test.png
ac69c60####.####.net/test.png
acf0ff9####.####.net/test.png
ad####.####.net/index.php?m=####&p=####&app_id=####&offer_id=####&gaid=#...
ad687e2####.####.net/test.png
adda0b3####.####.net/test.png
api-ce####.####.org/v3/commentlist-1511721-c0f1a37a588717510fbbc0ae6c0ac...
b####.####.com/b2?c1=####&c2=####&c3=####&ns__t=####&ns_c=####&cv=####&c...
c####.####.co/api/v4/click?campaign_id=####&publisher_id=####&rt=####&_p...
c####.####.com/build/js/rev2.min.js?v=####&del=####&lg=####&ci=####&ab=#...
c####.####.com/cms?partner_id=####
c####.####.com/dp/navegg.php?pid=####&uid=####
c####.####.com/files/79e464325fa8c8cbe099fcdd523c9968
c####.####.com/js/2759701342.js
c####.####.com/req?v=####&id=####&acc=####&tit=####
c####.####.com/tracking/adClick?d=####&clickId=####&prod=####&advId=####...
c####.####.net/pixel?google_nid=####&googl####&id=####
c####.####.org/2015-12-12/170df2a19c6c35c9f694e3dc7c05615b.jpeg!240
c####.####.org/v2/system/startimg-NL.json
c2f2208####.####.com/54d9f5ac07830f2c0a000093.ico
ce####.####.org/v3/system/countrys.json
cloudfr####.####.com/x.png
con####.####.net/en_US/sdk.js
con####.####.nl/player/js/streamone-player-v2.adblock-detect.min.js
d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/33162962629/
d####.####.net/ibs:dpid=822&dpuuid=33162962629&redir=https%3A//sync.navd...
drachts####.nl/wp-content/plugins/bw-cookie-consent/public/js/js.cookie.js
e####.####.com/quant.js
f####.####.com/css?family=####
f####.####.com/s/opensans/v14/MTP_ySUJH_bn48VBG8sNSpS3E-kSBmtLoNJPDtbj2P...
h####.com/article/596879a0761f554803527195
i####.####.com/s
imgs####.####.nl/v1/PWVDzb5BZY_cvR17SAC0K3rhIxY=/80x80/smart/filters:for...
m####.####.nl/static/img/whatsapp-share-button.png
p####.####.com/pixel;r=2042095356;labels=Publishers.Publisher-31865%2CWi...
p####.####.com/sync/img?redir=####&mm####&mm####
p####.####.com/ul_cb/aa/y8a2thbi7v8xdodcoa82
p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####&verify=####
pag####.####.com/pagead/js/r20170712/r20170110/show_ads_impl.js
pocketm####.####.org/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
st####.####.com/c/hotjar-113364.js?sv=####
stat####.####.com/connect/xd_arbiter/r/XBwzv5Yrm_1.js?version=####
syn####.####.net/ct/upi/pid/DuqQKWX7/?redir=####&_test=####
t####.####.com/agentapi/click?cid=####&aid=####&postbac####
t####.####.com/site/31436?dt=####&r=####&sig=####&bkca=KJ####
t####.####.com/usr?v=####&acc=####&id=####&jds=####&wst=####
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.sync.js
t####.####.nl/static/build/site_759acf5a9278.min.js
teleg####.nl/telesport/28638783/___Nouri_ging_het_maken_in_Ajax_1___.html
tr####.####.com/serve.js.php?w=####&t=####&c=####&width=####&referer=####
tra####.####.com/redir/?tgds=####&tgda=####&tgdid=####&tgdredir=####
u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...

HTTP POST requests:

a####.####.com/app_logs
bi####.####.com/cdb?ptv=####&profileId=####&cb=####
e####.####.com/e
e####.####.com/ping
e####.####.com:8088/sdk/api/ad/hull_v2
m####.####.com/v2/register
po####.####.com:84/sdk/aff_getpolicy

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
<Package Folder>/app_dex/reach-sdk.zip
<Package Folder>/app_dex/reach-sdk.zip.tmp
<Package Folder>/app_tmpdex/reach-sdk.zip
<Package Folder>/cache/####/542324769-1749282151
<Package Folder>/cache/####/6016474671982023963
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_0 (deleted)
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_1 (deleted)
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_2 (deleted)
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/data_3 (deleted)
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/index
<Package Folder>/cache/####/index (deleted)
<Package Folder>/databases/MsgLogStore.db-journal
<Package Folder>/databases/UmengLocalNotificationStore.db-journal
<Package Folder>/databases/Zuoyoo_db
<Package Folder>/databases/Zuoyoo_db-journal
<Package Folder>/databases/app.manager-journal
<Package Folder>/databases/com.amplitude.api
<Package Folder>/databases/com.amplitude.api-journal
<Package Folder>/databases/db_snowfox.db
<Package Folder>/databases/db_snowfox.db-journal
<Package Folder>/databases/droid_clean_event
<Package Folder>/databases/droid_clean_event-journal
<Package Folder>/databases/reach.database.ad-journal
<Package Folder>/databases/snowfoxad_msg.db
<Package Folder>/databases/snowfoxad_msg.db-journal
<Package Folder>/databases/virgo_mpsp.db
<Package Folder>/databases/virgo_mpsp.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_68ZGVS9TVHMTQ54WBGK9_216
<Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
<Package Folder>/files/.imprint
<Package Folder>/files/.yflurrydatasenderblock.ef40f098-af1f-4b1a-b93e-21f53b668d29
<Package Folder>/files/.yflurryreport.-19a1baa3c3b56721
<Package Folder>/files/<Package>.zip
<Package Folder>/files/DaemonServer
<Package Folder>/files/agoo.pid
<Package Folder>/files/dat.dat
<Package Folder>/files/lib.dat
<Package Folder>/files/mesosphere.jar
<Package Folder>/files/snowfox_mid.so
<Package Folder>/files/snowfox_sdk_so-v22.jar
<Package Folder>/files/snowfox_v22.jar
<Package Folder>/files/snowfox_v22.so
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/AGOO_CONNECT.xml
<Package Folder>/shared_prefs/AGOO_HOST.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppStore.xml
<Package Folder>/shared_prefs/AppStore.xml.bak
<Package Folder>/shared_prefs/BSModelForPlaced.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/CountryRelevant.xml
<Package Folder>/shared_prefs/CurArticleInfo.xml
<Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
<Package Folder>/shared_prefs/GATHER.xml
<Package Folder>/shared_prefs/GATHER.xml.bak
<Package Folder>/shared_prefs/Game_recommend.xml
<Package Folder>/shared_prefs/Game_recommend.xml.bak
<Package Folder>/shared_prefs/MASTER_DATA.xml
<Package Folder>/shared_prefs/Module_Switch_DATA.xml
<Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
<Package Folder>/shared_prefs/PhoneUtil.xml
<Package Folder>/shared_prefs/Prophet.xml
<Package Folder>/shared_prefs/Reach.xml
<Package Folder>/shared_prefs/Reach.xml.bak
<Package Folder>/shared_prefs/com.amplitude.api.<Package>.xml
<Package Folder>/shared_prefs/coolook.minisite.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/snowfoxprf.xml
<Package Folder>/shared_prefs/sp_cache.xml
<Package Folder>/shared_prefs/sp_cache.xml.bak
<Package Folder>/shared_prefs/test.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/umeng_message_state.xml
<Package Folder>/shared_prefs/updateVer.xml
<Package Folder>/shared_prefs/v2_local_login.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/<Package>/####/cdc77ac119a1680b4f924ad40e7810f8.jpg
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/11177D600C52C8C5B2AD66B5CC1B31F6
<SD-Card>/Android/####/1z6zvfpz292r66bw5lmgi6f8b.0.tmp
<SD-Card>/Android/####/25rq5n07ym2zjjisy8bf92jc0.0.tmp
<SD-Card>/Android/####/2ql0blcc9oztuoqwf5zxfinte.0.tmp
<SD-Card>/Android/####/378073093673AF1CED9EEACB5FDAE223
<SD-Card>/Android/####/4iy7jxd7mwrjkadxsu7xh0o2j.0
<SD-Card>/Android/####/5151877716410788EE76CEE9839A10B6
<SD-Card>/Android/####/59bdjkv1xkb26ovo7t487fgha.0.tmp
<SD-Card>/Android/####/5j5d90d4rstsz20wimgudy55o.0
<SD-Card>/Android/####/5pkon9g2vsjkxno38qbwi40nh.0.tmp
<SD-Card>/Android/####/6i37snv1m9z7hxvuic474q7jn.0
<SD-Card>/Android/####/72ua7q3op5xoe7k7l5r4xq8ne.0.tmp
<SD-Card>/Android/####/9E575E68F6D4D201C4AA86BD3C0A919A
<SD-Card>/Android/####/delay_20170531064057090_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064111803_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064115713_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064124055_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064129685_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064135452_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064137516_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064137809_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/delay_20170531064143620_c0f1a37a588717510fbbc0ae6c0ac7cc_s.dat
<SD-Card>/Android/####/dev_772e456c.txt
<SD-Card>/Android/####/imei.txt
<SD-Card>/Android/####/journal.tmp

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A58eb5c26c8957657a0000583%22%2C%22utdid%22%3A%22WS5ldOvi3zwDAGdzx1FOKfcm%22%2C%22sdkVersion%22%3A%2220151015%22%7D -I 100.69.168.33 -O 80 -T -Z
<dexopt>
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 /data/data/com.poboo.news.headline/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.jiagu/libjiagu.so
sh

Uses special library to hide executable bytecode.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial