Android.Packed.32524

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Loki.10.origin
Android.Loki.15.origin

Gains access to the ITelephony private interface.

Deletes an active device administrator.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c.s####.co:80
TCP(HTTP/1.1) api.t####.tech:80
TCP(HTTP/1.1) a####.r####.iches####.net:80
TCP(HTTP/1.1) serv####.m####.com:80
TCP(HTTP/1.1) adv.zk####.com:80
TCP(HTTP/1.1) j.bay####.com:8888
TCP(HTTP/1.1) f####.google####.com:80
TCP(HTTP/1.1) www.technol####.co.uk:80
TCP(HTTP/1.1) apptr####.com:80
TCP(HTTP/1.1) lh3.googleu####.com:80
TCP(HTTP/1.1) www.face####.com:80
TCP(HTTP/1.1) atracki####.appf####.com:80
TCP(HTTP/1.1) mob####.network:80
TCP(HTTP/1.1) n28adsh####.com:80
TCP(HTTP/1.1) trac####.suma####.com:80
TCP(HTTP/1.1) duc####.b####.com:80
TCP(HTTP/1.1) subt####.click####.com:80
TCP(HTTP/1.1) 5k5.612####.com:80
TCP(HTTP/1.1) c####.jq####.com:80
TCP(HTTP/1.1) f####.gst####.com:80
TCP(HTTP/1.1) gl####.ymtrac####.com:80
TCP(HTTP/1.1) a####.bay####.com:80
TCP(HTTP/1.1) down####.prizes####.online:80
TCP(HTTP/1.1) got.pubna####.net:80
TCP(HTTP/1.1) adc####.zk####.com:80
TCP(HTTP/1.1) cdn.zk####.com:80
TCP(HTTP/1.1) ud.zk####.com:80
TCP(HTTP/1.1) sty.zk####.com:80
TCP(HTTP/1.1) a####.com:80
TCP(HTTP/1.1) pag####.googles####.com:80
TCP(HTTP/1.1) real####.icec####.org:80
TCP(HTTP/1.1) c####.a####.com:80
TCP(HTTP/1.1) t####.hxc####.com:80
TCP(HTTP/1.1) a####.google####.com:80
TCP(HTTP/1.1) md.apptr####.com:80
TCP(HTTP/1.1) ak.icec####.org:80
TCP(HTTP/1.1) sub.zk####.com:80
TCP(HTTP/1.1) a####.adsbt####.com:80
TCP(HTTP/1.1) dsa.startap####.edg####.net:80
TCP(HTTP/1.1) c####.gowa####.com:80
TCP(HTTP/1.1) am.appw####.mobi:80
TCP(TLS/1.0) c####.apprev####.com:443
TCP(TLS/1.0) c####.appsam####.com:443
TCP(TLS/1.0) googl####.g.doublec####.net:443
TCP(TLS/1.0) tpc.googles####.com:443
TCP(TLS/1.0) api.lead####.net:443
TCP(TLS/1.0) ad4sc####.go2af####.com:443
TCP(TLS/1.0) cl####.dis####.io:443
TCP(TLS/1.0) adser####.go####.nl:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) con####.koc####.com:443
TCP(TLS/1.0) pag####.googles####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) st####.xx.f####.net:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

5k5.612####.com
a####.bay####.com
a####.com
a####.google####.com
a####.r####.iches####.net
adc####.zk####.com
adser####.go####.com
adser####.go####.nl
adv.zk####.com
ak.icec####.org
am.appw####.mobi
api.lead####.net
api.t####.tech
apptr####.com
atracki####.appf####.com
c####.a####.com
c####.apprev####.com
c####.appsam####.com
c####.gowa####.com
c####.jq####.com
c####.startap####.com
c.s####.co
cdn.zk####.com
cl####.dis####.io
con####.koc####.com
down####.prizes####.online
duc####.b####.com
f####.google####.com
f####.gst####.com
gl####.ymtrac####.com
googl####.g.doublec####.net
got.pubna####.net
h####.b####.com
j.bay####.com
l####.safepoo####.com
lh3.googleu####.com
md.apptr####.com
mob####.network
mt####.go####.com
n28adsh####.com
pag####.googles####.com
real####.icec####.org
serv####.m####.com
st####.xx.f####.net
sty.zk####.com
sub.zk####.com
subt####.click####.com
t####.hxc####.com
tpc.googles####.com
tra####.a4.tf
trac####.suma####.com
ud.zk####.com
www.face####.com
www.google-####.com
www.technol####.co.uk

HTTP GET requests:

a####.adsbt####.com/c/245d96912e3e4930
c####.gowa####.com/click?transaction_id=wadogo_emeabrand_97943_102025223...
cdn.zk####.com/appstore/richmedia/20161208/ov6n39ebqyp03acvhyx88bs2_com....
cdn.zk####.com/image/tryauto/20170424/4ee5d0605b734a9a9b804199f958811c/f...
cdn.zk####.com/image/tryauto/20170424/bbd9219423f74e248ce35fc9399817cc/1...
down####.prizes####.online/?utm_medium=####&utm_campaign=####&1=####&2=#...
down####.prizes####.online/?utm_term=####&clickverify=####&utm_content=#...
down####.prizes####.online/proc.php?251cc19####
down####.prizes####.online/proc.php?3f13792####
down####.prizes####.online/proc.php?6b43271####
dsa.startap####.edg####.net/tracking/adClick?d=IAAAA####&clickId=####&pr...
duc####.b####.com/click/affClick?aff_id=####&offer_id=####&aff_sub=####&...
f####.gst####.com/s/lato/v14/DvlFBScY1r-FMtZSYIYoYw.ttf
f####.gst####.com/s/robotoslab/v7/dazS1PrQQuCxC3iOAJFEJZ_TkvowlIOtbR7ePg...
lh3.googleu####.com/CXg771C_D06wzSVssca0KBd02x_MSmadwtfA8LEj3ViaCI5ubOqS...
lh3.googleu####.com/Mw_kQrK3SOuAvLF2AS4DDU675lh4cz9ZqoFMT2RTuiuGeK1hoqYh...
lh3.googleu####.com/QZHdj5S_52HYQumqDR82tdxT7T7qU5mjIwP6cfWY6cQB29MZwG2P...
n28adsh####.com/ads?key=####&cp_click_ID=####
n28adsh####.com/no-impression.gif?p=####&h=####&l=####&sh=####&sw=####&a...
pag####.googles####.com/pagead/js/adsbygoogle.js
pag####.googles####.com/pagead/js/r20171016/r20170110/reactive_library.js
pag####.googles####.com/pagead/js/r20171016/r20170110/show_ads_impl.js
serv####.m####.com/119987?t=0.010945529211312532&ref=&lu=http://www.tech...
serv####.m####.com/119987?t=0.20288273901678622&ref=&lu=http://www.techn...
serv####.m####.com/119987?t=0.7575815785676241&ref=&lu=http://www.techno...
subt####.click####.com/v1/sub/ad/click?pubid=####&campid=####&sub=####&s...
ud.zk####.com/stat/v2/request?afi=####&ai=####&ll=####&ce=####&odk=####&...
www.face####.com/plugins/likebox.php?href=####&w####&height=####&colorsc...

HTTP POST requests:

sty.zk####.com/cc/v1/api?sid=####
ud.zk####.com/stat?sid=####

Modified file system:

Creates the following files:

<Package Folder>/app_indicators/indicator_d
<Package Folder>/app_indicators/indicator_p
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/f_000018
<Package Folder>/cache/####/f_000019
<Package Folder>/cache/####/f_00001a
<Package Folder>/cache/####/f_00001b
<Package Folder>/cache/####/f_00001c
<Package Folder>/cache/####/f_00001d
<Package Folder>/cache/####/f_00001e
<Package Folder>/cache/####/f_00001f
<Package Folder>/cache/####/f_000020
<Package Folder>/cache/####/f_000021
<Package Folder>/cache/####/index
<Package Folder>/databases/Datebase-journal
<Package Folder>/databases/applock.db
<Package Folder>/databases/applock.db-journal
<Package Folder>/databases/arrkii.asa.sdk.db-journal
<Package Folder>/databases/arrkii.native.sdk.db-journal
<Package Folder>/databases/tracking_refer.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/BLRPHdhQhINDyvHrdynamicloader.dex
<Package Folder>/files/BLRPHdhQhINDyvHrdynamicloader.jar
<Package Folder>/files/ZCxBYspKkAezcCknstub.dex
<Package Folder>/files/ZCxBYspKkAezcCknstub.jar
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/bULCddIHBDvoFJNGdaemon.so
<Package Folder>/files/liblZQYQDEmVdzFKZqDbootstrap.so
<Package Folder>/files/qhCxnghGMYIGJywZsa.dex
<Package Folder>/files/qhCxnghGMYIGJywZsa.jar
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ak.native.sdk.xml
<Package Folder>/shared_prefs/ak.native.sdk.xml (deleted)
<Package Folder>/shared_prefs/ak.salvia.sdk.xml
<Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
<Package Folder>/shared_prefs/dayupdate.xml
<Package Folder>/shared_prefs/shared_refer.xml
<Package Folder>/shared_prefs/sharepreference_common_record.xml
<Package Folder>/shared_prefs/sharepreference_common_record.xml.bak
<Package Folder>/shared_prefs/sharepreference_url_param.xml
<Package Folder>/shared_prefs/trigsdk.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.salvia/<Package>
<SD-Card>/Android/####/-1129887485.0.tmp
<SD-Card>/Android/####/-1190887917.0.tmp
<SD-Card>/Android/####/-557433479.0.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1782521401.0.tmp
<SD-Card>/Android/####/618227503.0.tmp
<SD-Card>/Android/####/919103796.0.tmp
<SD-Card>/Android/####/journal
<SD-Card>/Android/####/journal.tmp
<SD-Card>/backups/####/.cuid

Miscellaneous:

Executes next shell scripts:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.arcapps.applock.applocker.service.TaskDetectService

Loads the following dynamic libraries:

arc_service
bULCddIHBDvoFJNGdaemon
liblZQYQDEmVdzFKZqDbootstrap

Gains access to camera interface.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial