Android.Packed.23260

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.255.origin
Android.DownLoader.343.origin

Downloads the following detected threats from the Web:

Android.DownLoader.255.origin
Android.DownLoader.343.origin

Network activity:

Connecting to:

j####.####.cn

HTTP POST requests:

j####.####.cn/app/init

Modified file system:

Creates the following files:

<Package Folder>/.lib/libexec.so
<Package Folder>/.lib/libexecmain.so
<Package Folder>/databases/COMSLLAPPCXYJIANDUIDZP-journal
<Package Folder>/databases/bmuljmyb.bz-journal
<Package Folder>/databases/downmodel.db-journal
<Package Folder>/databases/dxt_yx_sdk-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/yxsdk.jar
<Package Folder>/shared_prefs/comSLLappcxyJianduiDZ.xml
<Package Folder>/shared_prefs/comSLLappcxyJianduiDZ.xml.bak
<Package Folder>/shared_prefs/keySP.xml
<Package Folder>/shared_prefs/ukdib.xml
<Package Folder>/uwvdyp.t
<SD-Card>/Android/####/avzmkjxlzhjznwvhiqtpvchasdgv.jar
<SD-Card>/Android/####/closeMatter
<SD-Card>/Android/####/faoxhnoyvaxbyfzxclzipsfihpfmiwziwb.jar
<SD-Card>/Android/####/lmark
<SD-Card>/Android/####/loadimg
<SD-Card>/Android/####/nexjcejkqussbfpabvfqbnefzvtvvhn.jar
<SD-Card>/Android/####/notiicon
<SD-Card>/Android/####/rmark
<SD-Card>/Android/####/tb_jiance
<SD-Card>/Android/####/tb_zy
<SD-Card>/Android/####/transparent
<SD-Card>/Android/####/ukfdo
<SD-Card>/Android/####/ukfdo.jar
<SD-Card>/Android/####/uwvdyp
<SD-Card>/Android/####/xkgsvrnhgmygaoniggsplj.jar
<SD-Card>/rlqszrxkbbtdpgisbvrocavpiqmshnpqbh.jar
<SD-Card>/system.ini

Miscellaneous:

Executes next shell scripts:

/data/data/com.SLLappcxy.JianduiDZ/uwvdyp -p com.SLLappcxy.JianduiDZ -r am start --user 0 -n com.SLLappcxy.JianduiDZ/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2101
/data/data/com.SLLappcxy.JianduiDZ/uwvdyp -p com.SLLappcxy.JianduiDZ -r am start --user 0 -n com.SLLappcxy.JianduiDZ/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2220
/data/data/com.SLLappcxy.JianduiDZ/uwvdyp -p com.SLLappcxy.JianduiDZ -r am start --user 0 -n com.SLLappcxy.JianduiDZ/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2341
/data/data/com.SLLappcxy.JianduiDZ/uwvdyp -p com.SLLappcxy.JianduiDZ -r am start --user 0 -n com.SLLappcxy.JianduiDZ/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2441
/data/data/com.SLLappcxy.JianduiDZ/uwvdyp -p com.SLLappcxy.JianduiDZ -r am start --user 0 -n com.SLLappcxy.JianduiDZ/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2538
<dexopt>
chmod 777 /data/data/com.SLLappcxy.JianduiDZ/uwvdyp
chmod 777 <Package Folder>/uwvdyp
getprop ro.product.cpu.abi
sh <Package Folder>/uwvdyp -p <Package> -r am start --user 0 -n <Package>/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2101
sh <Package Folder>/uwvdyp -p <Package> -r am start --user 0 -n <Package>/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2220
sh <Package Folder>/uwvdyp -p <Package> -r am start --user 0 -n <Package>/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2341
sh <Package Folder>/uwvdyp -p <Package> -r am start --user 0 -n <Package>/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2441
sh <Package Folder>/uwvdyp -p <Package> -r am start --user 0 -n <Package>/qqnds.akorm.i.k -a zbaidu -h http://127.0.0.1:7123/report/allData -i 2538