Android.Packed.21987

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Hmad.2
Android.Hmad.1.origin
Tool.Rooter.49.origin

Removes its shortcut from the home screen.

Network activity:

Connecting to:

a####.####.com
r####.####.com

HTTP GET requests:

a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=#...

HTTP POST requests:

r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dp...
a####.####.com/app_logs
r####.####.com/rqd/sync

Modified file system:

Creates the following files:

<Package Folder>/cache/loading/config
<Package Folder>/cache/loading/module.jar
<Package Folder>/shared_prefs/duapp_shared.xml.xml
<Package Folder>/shared_prefs/fxssp.xml
<Package Folder>/app_jc/tfx.jar
<Package Folder>/shared_prefs/_toolbox_prefs.xml
<Package Folder>/em/cm.zip
<Package Folder>/shared_prefs/fpssp.xml
<Package Folder>/files/.imprint
<Package Folder>/databases/flow_duapp.db-journal
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/databases/fpdown.db-journal
<Package Folder>/app_jc/dfx.jar
<Package Folder>/files/mobclick_agent_cached_<Package>3
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/databases/clean_short_cut.db-journal
<Package Folder>/shared_prefs/flow_app_shared.xml.xml.bak
<Package Folder>/shared_prefs/fpksp.xml.bak
<Package Folder>/daemon.t.tmp
<Package Folder>/databases/fx_kit_unlock-journal
<Package Folder>/files/.umeng/exchangeIdentity.json
<Package Folder>/app_jc/dfp.jar
<Package Folder>/shared_prefs/bugly_data.xml
<Package Folder>/shared_prefs/fxkit.xml.bak
<Package Folder>/databases/fp.db-journal
<Package Folder>/databases/bugly_db_-journal
<Package Folder>/shared_prefs/fxkit.xml
<Package Folder>/shared_prefs/flowapp_shared.xml.xml
<Package Folder>/databases/du_ad_ts.db-journal
<Package Folder>/files/umeng_it.cache
<Package Folder>/app_jc/tfp.jar
<Package Folder>/shared_prefs/fpksp.xml
<Package Folder>/databases/fxlock.db-journal
<Package Folder>/shared_prefs/bugly_data.xml.bak
<Package Folder>/cache/loading/module_encrypt.jar
<Package Folder>/shared_prefs/flow_app_shared.xml.xml

Miscellaneous:

Executes next shell scripts:

chmod 777 <Package Folder>/daemon
/data/data/####/daemon -p #### -r am broadcast --user 0 -a com.zdt.action -f 32 -e key daemon -h http://www.baidu.com -m -i 2135
chmod 777 /data/data/####/daemon
sh <Package Folder>/daemon -p <Package> -r am broadcast --user 0 -a com.zdt.action -f 32 -e key daemon -h http://www.baidu.com -m -i 2135
getprop ro.board.platform
/system/bin/sh -c getprop ro.board.platform
/system/bin/cat /proc/version
<dexopt>

Uses administrator priveleges.

Contains functionality to send SMS messages automatically.