[Verizon Samsung Galaxy S 4] PWM978:
So the type of live analysis you are doing is ok, but realistically not as thorough as it needs to be. Did you realize this uses openssl to communicate? That would make the packet analysis mostly useless (unless you wanted to look at temporal patterns and try to guess what it was :))

In any case, I've spent about 10 minutes looking at this and will do more over the weekend. Here are some relevant pieces pulled out of the binary (sorry this will be messy):

*I believe the encoded lines are base64 (uuencode, mime, whatever), so we need to get all those pieces and decode it for further analysis.

10030210 db "8rT5tNG5wbf6vNfls+Cm6NCR5t6GwZnxyPms4ovOne/AqfmXpciA2pXyz/Jl3M+HIQ8WNU8TdPr1cE5l2JfN", 0 ; XREF=0x10005560

10030268 db "HmteJ0MmfBdiK2VSECFsJUx8D2UOeQxqP1U3Wour45dKKg2oe/IgBHLMkMM/PYA=", 0 ; XREF=0x1000556c

100302ac db " : omap", 0 ; XREF=0x10005717

100302b4 db "/data/local/tmp/.romaster_root.sh", 0 ; XREF=0x10005797

100302d8 db "h+OC9pe41LvYudX6juOTvJLgj+KD8IThk8y+0b7KbXm81lhew0h73kH8XPwTmfRsGg==", 0 ; XREF=0x10007dbd, 0x10008209, 0x10006094, 0x100059cb

10030320 db "2reXuNy9yaiH64TnhurFsdysg+GO4Yz/l6zes5O82LnNrIPvgOOC7sG12KiH9JynxKzBrsrq2u3Y7c3ihueT8t2x3r3csJ/rhvbZ94Xqh+aV4YT2qdu026+UI3TzJuopzMSuOsUCwPKa+idM6Q==", 0 ; XREF=0x10006116, 0x10005a4b

100303b8 db "o9Cp2q7Lponrnveb/9Gh07zMhFUQUxibp5wuxORemwJM1MlACw==", 0 ; XREF=0x10005b50

100303f0 db "h+OC9pe41LvYudX6juOTvJLgj+KD8IThk8y+0b7K6oz5mvGu3bXAocypv2X6A/btvM71eKixnolIDoacmA==", 0 ; XREF=0x10005bad

10030448 db "6p/8l8i706bHqs/1OOiSo6go2VxNffaR10IcBj9g3Q==", 0 ; XREF=0x10005bfd

10030480 db "/data/local/tmp/.romaster_root %s /system/bin/sh /data/local/tmp/.romaster_root.sh", 0 ; XREF=0x100062b0, 0x10005d75

100304d4 db "[+]finish", 0 ; XREF=0x1000633d, 0x10005dac

100304e4 db "[+]****Shuame!", 0 ; XREF=0x100062d5

100304f8 db "/data/local/tmp/.romaster_root %s ****Shuame /system/bin/sh /data/local/tmp/.romaster_root.sh", 0 ; XREF=0x10006307

1003055c dw "\*.* ", 0 ; XREF=0x10008dee, 0x10009aa5

10030568 dw "vroot_%d", 0 ; XREF=0x10006864

10030580 db 0x70 ; 'p'

10030582 db 0x6b ; 'k'

10030588 db "74Dtw6LMqNq13LiW/ZjhguqL4ozLafy94vWfLpXzKsUZHvxJ/qDc", 0 ; XREF=0x10006a8d

100305c0 db "6IfqxKXLr92y27+R4ZP8iuOH4pDjzb7br9uy3LvIngpHCw6rACGdbUlhdSLaParx2Q==", 0 ; XREF=0x10006a97

10030608 db "lPuWuNm306HOp8PtnvuP+5L8m+iOLKlAnHm0DsEd1qR8whcFhMvN", 0 ; XREF=0x10006aa1

10030640 db "Xi1UJ1M2W3QVZRU6aQx4DGULbB8xUCBLK3I8IPMy2Dq2L9aDo0eYkGkqwQ==", 0 ; XREF=0x10006b37

10030680 db "74Hll/iR9bjZt9643a7a9IzhjXsYO2XWjSLhGTvqByZWyA4Iszk=", 0 ; XREF=0x10006bc0

100306b8 db "com.mgyun.vroot.tools_13091815/android.app.Activity -a android.intent.action.MAIN", 0 ; XREF=0x10003316

1003070c db "xKDXpzkZtUQ59gLZzmCa+AMBjPFe0w8=", 0 ; XREF=0x10006ea7

10030734 db "com.mgyun.vroot.tools_13091815", 0 ; XREF=0x10006f9e

10030754 db "PVwyViRLIkZpBnVaF3IBchN0EUA1UCVAeyLrm84i0A//mHb9eJ3uUtzY+qA=", 0 ; XREF=0x1000720a

10030794 db "xqPbr4UT1EEbAqsj7YDOf/iTkYgebPA=", 0 ; XREF=0x10007404

100307b8 db "gKnlhOqO/JP6nrHerYLPqtmqy6zJ8uONv42Gt3mfadnxP6xm+jV0fIo=", 0 ; XREF=0x10007466

100307f1 db 0x00 ; '.'

100307f8 db "am start --activity-clear-top -a android.intent.action.MAIN -n com.mgyun.vroot.tools_13091815/android.app.Activity", 0 ; XREF=0x100077f4

1003086c db "wKrLvdzzn/6Q99iK/5HljOGEv2uZ/T498tfVLU0VRGJm0i2tIA8=", 0 ; XREF=0x10007870

100308a4 db "kPWB06bIvNW43RgJXPz77PtdPuXpZDnjsY/z26o=", 0 ; XREF=0x10007a50

100308d0 db "weikzq/ZuJf7mvSTvO6b9YHoheDbsi98NorKpwM+DV2wYr59bkXGAQ==", 0 ; XREF=0x10007ab2

1003090c db "6ZH0lzy7Y2yaZma5/NtPY5jfkt5p8Bs=", 0 ; XREF=0x10007ba4

10030930 db "hsqgwbfW+ZX0mv3SgfWH7oDn3PW507LEpYrmh+mOofGD7I/qmerRye/3pfZ/nXMnDC/4+3lMpoJzcw==", 0 ; XREF=0x10007c06

10030988 db "KEsjTGxLQSRHL0BgQH5ecQJ7CCdMKVs1UDwTZgN1EH4KVT1YNEQhU1l+XmBeflE1VCBBbgJtDm8DLFg1RWpENlk0VSZSN0UaaAdoHDJBKRIyUTlUO19/SH1IaEcjQjZXeBR7GHkVOk4jU3xSIE8iQzBEIVMMfhF+CiRXPwQ2zJuU1BB1MbQXAqMrV7fXjqSo", 0 ; XREF=0x10007f75

10030a4c db "gaCP/IX2gueKpceuwO+c9P5PmFSIIJygRrjC401T2PG4DcdI", 0 ; XREF=0x10007fc5

10030a80 db "geWE8JG+0r3ev9P8iOWVutit3qfFqtLygO3N4JL01Puf/orrxLTGqdm8zrrDnN6f1OXX5O7msJzpAQvklnd9oCiWGEAAppO3", 0 ; XREF=0x10007fff

10030ae8 db "iu6P+5q12bbVtNj3g+6esdOm1azOodn5lOLC7YnonP3SotC/z6rYrNX12r7fq8rlleeI+J3vm+K9/771xPbFz9ZsrATmQOOdYLHU2OsVSo/Kr+c=", 0 ; XREF=0x10008039

10030b60 db "Si5PO1p1GXYVdBg3Qy5ecRNmFWwOYRk5VD9bMkBgTytKPl9wAHIdbQh6Dnd9zEGlAmvHqGU4xr23/DSOXohIQg==", 0 ; XREF=0x10008073

10030bc0 db "XjpbL05hDWIBYAwjVzpKZQdyAXgadQ0tQS8PIlFxXi1UJwhjBnQafxM8SSxaP1ElehJ3G2sOfFxzF3YCY0w8TiFRNEYyS2RKPls2Rkz5TUA0ymwKqRaWUq4ZVSAYS1qT", 0 ; XREF=0x100080ad

10030c48 db "hOGV5Zf4iKjYvc+81abS/I/2havTutStxOqH4Jnsgqzesd6qiqXBoNS1mvaZ+pv32KzBsZ6wwq3AodKmw7HunPOc6Ma13dfj9qHt5sNA7ygyVo9AW0Kv+itT", 0 ; XREF=0x100080e7

10030cc8 db "XjpbL05hDWIBYAwjVzpKZQdyAXgadQ0tQS8PIlFxXi1UJwhqH2xDK0ImCXwZbwpkEDAfexpuDyBQIk09WCpeJwgmUjdaKiDTRCydxhhqHWqL7gDYDOkAuurS", 0 ; XREF=0x10008121

10030d48 db "jeic7J7xgaHRtMa13K/b9Yb/jKLas92kzeOO6ZDli6XWo4PihuLoyyZKk2Cm0ratHlNP2pdiP1VitQ==", 0 ; XREF=0x1000815b

10030da0 db "dxNyBmdIJEsoSSUKfhNjTC5bKFEzXCQEdhs7FmQCIg1pCHwdMkIwXy9KOEw1P2P1Rz8/n1ujTHudLiryezgrKYA=", 0 ; XREF=0x10008195

10030e00 db "XjpbL05hDWIBYAwjVzpKZQdyAXgadQ0tQDYWOV08SCkGdgRrG34MeAFeHF0WJxUmBilNLFg5FmYUewtuHGgRG/yrEMLK48bydqrIEov/K+AAqig=", 0 ; XREF=0x100081cf

10030e78 db "EnoXeBw8Cz4LKwRgAXUUO1c4WzpWeQ1gED8RYwxhAHMHYhBPPVI9STWowMJyw4lSWfyF6cPnNqBwqlg=", 0 ; XREF=0x1000825e

10030ed0 db "rm /data/local/tmp/.romaster_root; rm /data/local/tmp/.romaster_root.sh; pm uninstall com.mgyun.vroot.tools_13091815", 0 ; XREF=0x10006966

10030f48 db "rm /data/local/tmp/.romaster_root; rm /data/local/tmp/.romaster_root.sh", 0 ; XREF=0x1000859c

10030fa0 db "meizu-mx", 0 ; XREF=0x10008a06

10030fac db "meizu-m031", 0 ; XREF=0x10008a16

10030fb8 db "meizu-m032", 0 ; XREF=0x10008a26

10030fc8 db "stop ric\nmount -r -w -o remount /system;/data/local/tmp/busybox mount -orw,remount /system;rm /system/bin/su;\ncat /data/local/tmp/su>/system/bin/su;chown 0.0 /system/bin/su;chmod 6755 /system/bin/su;\ncat /data/local/tmp/Superuser.apk>/system/app/Superuser.…", 0 ; XREF=0x10008a80

100310c8 db "apk;chmod 0644 /system/app/Superuser.apk;\necho '#!/system/bin/sh\n/system/bin/stop ric\n/system/bin/su --daemon &\n'>/system/etc/install-recovery.sh;chmod 0755 /system/etc/install-recovery.sh\n", 0

10031188 db "stop ric\n/data/local/tmp/busybox mount -orw,remount /system; /data/local/tmp/busybox rm -rf /system/bin/su;\n/data/local/tmp/busybox cp /data/local/tmp/su /system/bin/su; /data/local/tmp/busybox chown 0.0 /system/bin/su; /data/local/tmp/busybox chmod 6755 /…", 0 ; XREF=0x10008a87

10031288 db "system/bin/su;\n/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app/Superuser.apk; /data/local/tmp/busybox chmod 0644 /system/app/Superuser.apk;\necho '#!/system/bin/sh\n/system/bin/stop ric\n/system/bin/su --daemon &\n'>/system/etc/install-rec…", 0

10031388 db "overy.sh; /data/local/tmp/busybox chmod 0755 /system/etc/install-recovery.sh\n", 0

100313d8 db "mount -r -w -o remount /system;/data/local/tmp/busybox mount -orw,remount /system;rm /system/bin/su;\ncat /data/local/tmp/su>/system/bin/su;chown 0.0 /system/bin/su;chmod 6755 /system/bin/su;\ncat /data/local/tmp/Superuser.apk>/system/app/Superuser.apk;chmod…", 0 ; XREF=0x10008a91

100314d8 db " 0644 /system/app/Superuser.apk;\necho '#!/system/bin/sh\n/system/bin/su --daemon &\n'>/system/etc/install-recovery.sh;chmod 0755 /system/etc/install-recovery.sh\n", 0

10031578 db "/data/local/tmp/busybox mount -orw,remount /system; /data/local/tmp/busybox rm -rf /system/bin/su;\n/data/local/tmp/busybox cp /data/local/tmp/su /system/bin/su; /data/local/tmp/busybox chown 0.0 /system/bin/su; /data/local/tmp/busybox chmod 6755 /system/bi…", 0 ; XREF=0x10008a98

10031678 db "n/su;\n/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app/Superuser.apk; /data/local/tmp/busybox chmod 0644 /system/app/Superuser.apk;\necho '#!/system/bin/sh\n/system/bin/su --daemon &\n'>/system/etc/install-recovery.sh; /data/local/tmp/busy…", 0

10031778 db "box chmod 0755 /system/etc/install-recovery.sh\n", 0

100317a8 db "stop ric\nmount -r -w -o remount /system;/data/local/tmp/busybox mount -orw,remount /system;rm /system/bin/su;\ncat /data/local/tmp/su>/system/bin/su;chown 0.0 /system/bin/su;chmod 6755 /system/bin/su;\ncat /data/local/tmp/Superuser.apk>/system/app/Superuser.…", 0 ; XREF=0x10008aa7

100318a8 db "apk;chmod 0644 /system/app/Superuser.apk;\necho '#!/system/bin/sh\n/system/bin/stop ric\n'>/system/etc/install-recovery.sh;chmod 0755 /system/etc/install-recovery.sh\n", 0

10031950 db "stop ric\n/data/local/tmp/busybox mount -orw,remount /system; /data/local/tmp/busybox rm -rf /system/bin/su;\n/data/local/tmp/busybox cp /data/local/tmp/su /system/bin/su; /data/local/tmp/busybox chown 0.0 /system/bin/su; /data/local/tmp/busybox chmod 6755 /…", 0 ; XREF=0x10008aae

10031a50 db "system/bin/su;\n/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app/Superuser.apk; /data/local/tmp/busybox chmod 0644 /system/app/Superuser.apk;\necho '#!/system/bin/sh\n/system/bin/stop ric\n'>/system/etc/install-recovery.sh; /data/local/tmp/…", 0

10031b50 db "busybox chmod 0755 /system/etc/install-recovery.sh\n", 0

10031b88 db "mount -r -w -o remount /system;/data/local/tmp/busybox mount -orw,remount /system;rm /system/bin/su;\ncat /data/local/tmp/su>/system/bin/su;chown 0.0 /system/bin/su;chmod 6755 /system/bin/su;\ncat /data/local/tmp/Superuser.apk>/system/app/Superuser.apk;chmod…", 0 ; XREF=0x10008ab8

10031c88 db " 0644 /system/app/Superuser.apk;\n", 0

10031cb0 db "/data/local/tmp/busybox mount -orw,remount /system; /data/local/tmp/busybox rm -rf /system/bin/su;\n/data/local/tmp/busybox cp /data/local/tmp/su /system/bin/su; /data/local/tmp/busybox chown 0.0 /system/bin/su; /data/local/tmp/busybox chmod 6755 /system/bi…", 0 ; XREF=0x10008abf

10031db0 db "n/su;\n/data/local/tmp/busybox cp /data/local/tmp/Superuser.apk /system/app/Superuser.apk; /data/local/tmp/busybox chmod 0644 /system/app/Superuser.apk;\n", 0