Android.Packed.56626

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.840.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(TLS/1.0) 1####.251.39.106:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) st####.dc####.net.cn:443
TCP(TLS/1.2) 1####.251.39.106:443
TCP(TLS/1.2) 2####.58.208.99:443
TCP(TLS/1.2) 1####.217.168.238:443

DNS requests:

and####.google####.com
m####.go####.com
p####.google####.com
st####.dc####.net.cn

HTTP POST requests:

st####.dc####.net.cn:443/collect/crash

File system changes:

Creates the following files:

/data/data/####/.cl
/data/data/####/.fsgkea
/data/data/####/.jg.ac
/data/data/####/.jg.ri
/data/data/####/.jg.store.report_pid
/data/data/####/.lock
/data/data/####/.lock (deleted)
/data/data/####/12c043391f167a7709a1f709c03c40e4
/data/data/####/13b5ca75746ce63a09369c91ead3d9d5
/data/data/####/212ef3264a42eefe355a8feccd5a03ea
/data/data/####/21bad52e6ee5ebea176d35b573f8d980
/data/data/####/5836a1364125c12d8a38f89e85451d62
/data/data/####/5d533563ecfbf8ce7830730532904b60
/data/data/####/6162f33e1f5b249103ea80f040bb6e5a
/data/data/####/7b2181dce0057ff1b7c9daac8c69fd84
/data/data/####/Web Data
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/__UNI__CD705D6.xml
/data/data/####/a363741a757055568574a56f3d8ba060
/data/data/####/a6a9123962a85f255652eef4b1f8134b
/data/data/####/a8f8ef84f95c18b3288c2da1791c999e
/data/data/####/ab26c0876b473b837bd0f8623034978f
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.oat
/data/data/####/crash_dump.log
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/ef5631405872122a38404cf7aee915eb
/data/data/####/facb8b4f67602a9927c1061bdd65b351
/data/data/####/grp.prop
/data/data/####/libjiagu.so
/data/data/####/libweexjsb.so
/data/data/####/metrics_guid
/data/data/####/pdr.xml
/data/data/####/proc_auxv
/data/data/####/uni.UNICD705D6_preferences.xml
/data/data/####/webview_data.lock
/data/data/####/weex_default_settings.xml
/data/user_de/####/move_to_de_records.xml

Miscellaneous:

Executes the following shell scripts:

/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 43 46 1 /data/user/0/<Package>/app_crash/crash_dump.log
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 50 52 1 /data/user/0/<Package>/app_crash/crash_dump.log
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 87 88 1 /data/user/0/<Package>/app_crash/crash_dump.log
/system/lib/arm/houdini /data/app/<Package>-1/lib/arm//libweexjsb.so <Package>:jse 87 91 1 /data/user/0/<Package>/app_crash/crash_dump.log
<Package>:jse 80 85 1 /data/user/0/<Package>/app_crash/crash_dump.log

Loads the following dynamic libraries: