Android.Packed.38405

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.683.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) pis.al####.com:80
TCP(HTTP/1.0) 4####.92.62.1:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) pus.al####.com:80
TCP(HTTP/1.1) app.9####.com:8102
TCP(HTTP/1.1) cdn.game####.org:80
TCP(HTTP/1.1) cdn.app.h####.####.com:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) pns.al####.com:443
TCP(TLS/1.0) app.9####.com:443
TCP(TLS/1.0) l####.4####.top:443
TCP c####.g####.ig####.com:5224
UDP 1####.168.66.254:4466
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.u####.com
app.9####.com
c####.g####.ig####.com
c-h####.g####.com
cdn.app.h####.top
cdn.game####.org
l####.4####.top
log.u####.com
pis.al####.com
pns.al####.com
pss.al####.com
pub-####.qin####.com
pus.al####.com
s####.u####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

app.9####.com:8102/changes/20420910.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420911.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420912.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420913.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420914.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420915.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420916.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420917.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420918.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420919.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420920.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420921.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420922.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420923.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420924.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420925.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420926.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420927.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420928.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420929.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420930.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420931.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420932.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420933.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420934.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/changes/20420935.js?sign=####&xg_token=####&user_toke...
app.9####.com:8102/live/oddlives_get?sign=####&Mstate=####&xg_token=####...
app.9####.com:8102/live/odds_change_get?sign=####&xg_token=####&app_id=#...
cdn.app.h####.####.com/swenjian/321
cdn.app.h####.####.com/swenjian/321m
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
t####.c####.q####.####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_OWn962
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

a####.u####.com/app_logs
c-h####.g####.com/api.php?format=####&t=####
pis.al####.com/p/pcdn/i.php?v=####
pss.al####.com/iku/log/acc
pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1528662110814.log
/data/data/####/1740c449fc10be62df60ba0f18696c9f
/data/data/####/23940af2-a853-467f-a568-00cdb4e73082
/data/data/####/32edd79a240b5f1e461d069caab1ec3e
/data/data/####/386c3610-e8fa-41d9-8ecf-bbfdf7309331.jar
/data/data/####/39f91b4c-4bf3-4aef-a66f-ae73d963e134
/data/data/####/42782110-b0fe-4081-a83a-aac39ca443c0
/data/data/####/5950df91-87cb-4169-845c-1bdc73f040a1
/data/data/####/75e2f817-c72c-4f23-82a4-a5fded8257d7
/data/data/####/8b6f263391259b7a8e5f58ee71852ca8
/data/data/####/9d7dc0ae-e1ed-4442-a8e8-eebba69c29c3
/data/data/####/9f1d91c89b0c
/data/data/####/Ay.xml
/data/data/####/Gect.jar
/data/data/####/Gect.xml
/data/data/####/Matrix
/data/data/####/QALConfigStore.dat
/data/data/####/SUBOXLOG_
/data/data/####/TLS_DEVICE_INFO.xml
/data/data/####/WLOGIN_DEVICE_INFO.xml
/data/data/####/ab5a4e48-ada9-4edb-aa31-47a5d5370fe1
/data/data/####/b0141e478b25af7c40a8cca8de6c4708
/data/data/####/b18a021d11a3004d25017230b681476b
/data/data/####/bzwn.db-journal
/data/data/####/c61913b615fb6224701377a119081f36
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/d2853f4b-5498-4ff0-b659-8637484d3cd9
/data/data/####/ddexe
/data/data/####/debuggerd
/data/data/####/device.db
/data/data/####/df19f6de-571e-49b6-878c-cb212f41b26a
/data/data/####/ebn.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fileWork
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/install-recovery.sh
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/libjiagu.so
/data/data/####/libpcdn_acc.zip
/data/data/####/libpcdn_acc_new.so
/data/data/####/pcdnconfigs.xml
/data/data/####/pidof
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qalimid_v2
/data/data/####/report_v5.msgstore-journal
/data/data/####/root3
/data/data/####/run.pid
/data/data/####/su
/data/data/####/supolicy
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_OWn962
/data/data/####/tdata_OWn962.jar
/data/data/####/tls_device.dat
/data/data/####/toolbox
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/wlogin_device.dat
/data/data/####/wsroot.sh
/data/media/####/app.18.06.10.20.log
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/fsdg.xv.ygtf.bin
/data/media/####/fsdg.xv.ygtf.db
/data/media/####/imsdk_20180610.log
/data/media/####/myself.dat
/data/media/####/sdk.18.06.10.20.log
/data/media/####/tdata_MkX219
/data/media/####/tdata_OWn962
/data/media/####/test.log

Miscellaneous:

Executes next shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.skyin.receiver.PushService 24192 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
mount
sh

Loads the following dynamic libraries:

_imcore_group_ext_gyp
_imcore_jni_gyp
_imcore_msg_ext_gyp
_imcore_sns_ext_gyp
getuiext2
gnustl_shared
ijkffmpeg
libjiagu
libpcdn_acc
libwtcrypto
liteavsdk
msc
pcdn_acc
qalcodecwrapper
qalmsfboot
saturn
stlport_shared

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding
DES-CBC-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial