Android.Packed.37480

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.657.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cdn.app.dn####.####.com:80
TCP(HTTP/1.1) app.1####.cn:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) cdn.l####.fm.####.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) s####.l####.fm.####.com:80
TCP(HTTP/1.1) 1####.145.147.206:80
TCP(HTTP/1.1) cd####.l####.fm:80
TCP(HTTP/1.1) m.i####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) t####.talking####.net:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) apilo####.a####.com:80
TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(TLS/1.0) redi####.network####.com:443
TCP(TLS/1.0) dc1.network####.com:443
TCP(TLS/1.0) v####.dn####.top:443
TCP 2####.14.152.200:80
TCP 2####.14.155.189:80

DNS requests:

a####.u####.com
api####.a####.com
app.1####.cn
cd####.gz####.com
cd####.l####.fm
cd####.l####.fm
cdn.app.dn####.top
cdn.app.h####.top
cdn.img.h####.top
cdn.l####.fm
d14uy7w####.cloudf####.net
dc1.network####.com
ip.ta####.com
m.1####.cn
m.i####.com
oc.u####.com
redi####.network####.com
res####.a####.com
s####.l####.fm
t####.talking####.net
v####.dn####.top

HTTP GET requests:

app.1####.cn/ad/outer
app.1####.cn/ad/recommend
app.1####.cn/app
app.1####.cn/platform
app.1####.cn/recomm/list
app.1####.cn/res/ad/35750100617724102.jpeg
cd####.l####.fm/audio/cesu_hd.mp3
cdn.app.dn####.####.com/sfile/201805/11/all/cp_V3.1.2.txt
cdn.app.dn####.####.com/upload/201805/10/app/20180510210304434.apk
cdn.app.dn####.####.com/upload/201805/10/img/20180510210257372.png
cdn.l####.fm.####.com/audio/cesu_hd.mp3
cdn.l####.fm.####.com/radio_cover/2013/11/28/7679385693949570_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2014/02/25/9753246892033154_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2014/05/14/11571401032847620_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2014/05/23/11776189966258308_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2015/01/27/17548800190630532_160x120.png
cdn.l####.fm.####.com/radio_cover/2015/06/03/20499695857898372_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2015/12/21/25157237288721924_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2016/04/13/27801140510801156_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2016/06/04/29007531066009348_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2017/09/27/2626940042861383172_160x120...
d14uy7w####.cloudf####.net/download/key
ip.ta####.com/service/getIpInfo2.php?ip=####
m.i####.com/cfg/appkey-cfff20554a781b91

HTTP POST requests:

a####.u####.com/app_logs
apilo####.a####.com/v3/log/init
app.1####.cn/point/current
m.i####.com/rec/se?_iwt_t=####&sv=####
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
res####.a####.com/v3/config/resource?
s####.l####.fm.####.com/v1/postclientdata
s####.l####.fm.####.com/v1/postevent
t####.talking####.net/g/d

Modified file system:

Creates the following files:

/data/data/####/-366188723-1257941271
/data/data/####/-366188723-939871283
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1533051580-1041054485
/data/data/####/21fede27-5582-4384-8104-7c4bfeec8265.jar
/data/data/####/2799588331199708934
/data/data/####/279958833187243908
/data/data/####/517413695-250722021
/data/data/####/LizhiFM.db
/data/data/####/LizhiFM.db-journal
/data/data/####/MATSharedPreferences.xml
/data/data/####/SUBOXLOG_
/data/data/####/TD_CHANNEL_ID.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/V3.1.2.txt
/data/data/####/V3.1.2.xml
/data/data/####/_ire-journal
/data/data/####/app.cfg
/data/data/####/cdn_host_main.cfg
/data/data/####/cdn_host_player.cfg
/data/data/####/cdn_host_push.cfg
/data/data/####/cn.com.mma.mobile.tracking.other.xml
/data/data/####/com.ljfsyj.othag_preferences.xml
/data/data/####/com.networkbench.agent.impl.v2_com.ljfsyj.othag...leted)
/data/data/####/com.networkbench.agent.impl.v2_com.ljfsyj.othag.xml
/data/data/####/com.networkbench.agent.impl.v2_com.ljfsyj.othag.xml.bak
/data/data/####/config.cfg
/data/data/####/dns_ex_addr.cfg
/data/data/####/eb151c21-0ce2-40ed-a3da-d4b87992b44a
/data/data/####/hn.jar
/data/data/####/ht.jar
/data/data/####/inittime.xml
/data/data/####/kr.xml
/data/data/####/last_known_location.xml
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_online_setting_com.ljfsyj.othag.xml
/data/data/####/multidex.version.xml
/data/data/####/op.log
/data/data/####/pref_longtime.xml
/data/data/####/pref_shorttime.xml
/data/data/####/process.xml
/data/data/####/sub_app_file
/data/data/####/t_u.db-journal
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml (deleted)
/data/data/####/umeng_it.cache
/data/data/####/ums_agent_online_setting.xml
/data/data/####/vbz.xml
/data/media/####/-1272331943_160x120
/data/media/####/-1876390127_160x120
/data/media/####/-371638502_160x120
/data/media/####/-526247796_160x120
/data/media/####/-582019701
/data/media/####/-754543386_160x120
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/1176761398_160x120
/data/media/####/1519709509_160x120
/data/media/####/1612506776_160x120
/data/media/####/1948521109_160x120
/data/media/####/4cb36fb85bff56d757a092288077c3b0.apk
/data/media/####/880443351_160x120
/data/media/####/b.tmp
/data/media/####/backup.db
/data/media/####/backup.db-journal
/data/media/####/cesu
/data/media/####/e82134ad92409
/data/media/####/journal.tmp
/data/media/####/lz.ini
/data/media/####/mobclick_agent_cached

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/4cb36fb85bff56d757a092288077c3b0.apk
getprop
sh <Package Folder>/lib/libdaemon.so <Package>/com.igexin.sdk.PushService <Package>:push &

Loads the following dynamic libraries:

audioprocess
crashcapture
decoder
encoder
launcher
libjiagu
mresearch
myspinnative
resample
rtmpdump
tpnsSecurity

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
AES-ECB-ZeroBytePadding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

DES
DES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to camera interface.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial