Android.Packed.38988

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.405.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) wap.n.sh####.com:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) fc####.b####.com:80
TCP(HTTP/1.1) you####.b####.com:80
TCP(HTTP/1.1) c####.tv.itc.cn:80
TCP(HTTP/1.1) www.a.sh####.com:80
TCP(HTTP/1.1) j####.kb####.cn:80
TCP(HTTP/1.1) se####.b####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) ch####.jom####.com:80
TCP(HTTP/1.1) si####.jom####.com:80
TCP(HTTP/1.1) sta####.itc.cn.####.com:80
TCP(HTTP/1.1) g####.bdst####.com:80
TCP(HTTP/1.1) f.hiph####.b####.com:80
TCP(HTTP/1.1) js.tv.i####.cn:80
TCP(HTTP/1.1) t####.jom####.com:80
TCP(HTTP/1.1) gs.a.s####.com:80
TCP(TLS/1.0) c####.tv.itc.cn:443
TCP(TLS/1.0) www.a.sh####.com:443
TCP(TLS/1.0) sb.scoreca####.com.####.net:443
TCP(TLS/1.0) g####.b####.com:443
TCP(TLS/1.0) 001.img.pu.####.cn:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) z2.m.tv.####.com:443
TCP(TLS/1.0) fex.bdst####.com:443
TCP(TLS/1.0) gs.a.s####.com:443
TCP(TLS/1.0) s####.i####.com:443
TCP(TLS/1.0) moun####.zh####.b####.com:443
TCP(TLS/1.0) c####.b####.com:443
TCP(TLS/1.0) t####.jom####.com:443
TCP(TLS/1.0) ikno####.b####.com:443
TCP(TLS/1.0) rc.vrs.s####.com:443
TCP(TLS/1.0) js.tv.i####.cn:443
TCP(TLS/1.0) gv.a.s####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) r####.zh####.b####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) 39d0825####.cdn.so####.####.com:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) cambria####.cdn.bc####.####.com:443
TCP(TLS/1.0) i####.b####.com:443

DNS requests:

001.img.pu.####.cn
39d0825####.cdn.so####.com
5b0988e####.cdn.so####.com
a.appj####.com
a1.i####.cn
api.k.s####.com
api.tv.s####.com
c####.b####.com
c####.baidu####.cn
c####.baidust####.com
c####.tv.itc.cn
cambria####.cdn.bc####.com
f.hiph####.b####.com
fc####.b####.com
fex.bdst####.com
g####.b####.com
g####.bdst####.com
g####.bdst####.com
hm.b####.com
ikno####.b####.com
j####.kb####.cn
js.s####.com
js.tv.i####.cn
k.s####.com
m.b####.com
m.s####.com
m.tv.s####.com
moun####.zh####.b####.com
phot####.tv.s####.com
pl.hd.s####.com
pos.b####.com
pv.s####.com
r####.zh####.b####.com
rc.vrs.s####.com
s####.i####.com
s####.my.tv.####.com
s.bdst####.com
sb.scoreca####.com
se####.b####.com
sp1.b####.com
sta####.itc.cn
t10.b####.com
t11.b####.com
t12.b####.com
t7.b####.com
t8.b####.com
t9.b####.com
ti####.b####.com
tv.s####.com
www.b####.com
you####.b####.com
z.m.tv.####.com
z2.m.tv.####.com
zh####.b####.com

HTTP GET requests:

c####.tv.itc.cn/m/player.css
ch####.jom####.com/it/u=1076006532,2138038038&fm=190&app=7&size=r3,2&n=0...
ch####.jom####.com/it/u=4093228604,3818431005&fm=190&app=7&size=r3,2&n=0...
ch####.jom####.com/it/u=865741344,3335459078&fm=190&app=7&size=r3,2&n=0&...
ch####.jom####.com/it/u=999826741,2311884715&fm=190&app=7&size=r3,2&n=0&...
f.hiph####.b####.com/baike/whfpf=400,225,0/sign=d3b83cbcc41b9d168a92c921...
fc####.b####.com/w.gif?baiduid=####&query=####&queryUtf8=####&searchid=#...
g####.bdst####.com/5foUcz3n1MgCo2Kml5_Y_D3/graph/static/resource/sdk/mob...
g####.bdst####.com/5foUcz3n1MgCo2Kml5_Y_D3/graph/static/resource/sdk/v1....
gd.a.s####.com/20180604/n600534388.shtml?src=####
gd.a.s####.com/static/ui-open/3.1/js/open.min.js
gs.a.s####.com/a/233967165_100165783
gs.a.s####.com/promotion?posId=50010101&itemId=6680&link=/m.tv.sohu.com/...
gs.a.s####.com/pv.js?_t=####
js.tv.i####.cn/m/player/inc-all.js
se####.b####.com/mwb.gif?type=####&fm=####&data=####&qid=####&did=####&q...
si####.jom####.com/common/openjs/openBox.js?_v=####
si####.jom####.com/it/u=1586871449,4006096584&fm=58
si####.jom####.com/it/u=1969291302,3436839348&fm=58
si####.jom####.com/it/u=2281275909,2540440941&fm=58
si####.jom####.com/it/u=2694597484,521337985&fm=58
si####.jom####.com/it/u=3991798261,1728313299&fm=58
si####.jom####.com/it/u=4218045044,1692329411&fm=58
sta####.itc.cn.####.com/a_auto,c_cut,x_3,y_3,w_636,h_636/images/20180502...
sta####.itc.cn.####.com/mobile/css/images/sicon-2b31ed9b.ttf
sta####.itc.cn.####.com/mobile/css/images/sohu_text-43560455.png
sta####.itc.cn.####.com/mobile/css/main-cfb081e06b.css
sta####.itc.cn.####.com/mobile/js/lib-84c5889aed.js
sta####.itc.cn.####.com/mobile/js/main-d35f8171ec.js
sta####.itc.cn.####.com/q_70,c_zoom,w_640/images/20180604/074a3212de924f...
sta####.itc.cn.####.com/q_70,c_zoom,w_640/images/20180604/4072744afbd344...
sta####.itc.cn.####.com/spm/prod/js/1.0.1/index.js
t####.jom####.com/timg?wiseala####&size=####&quality=####&sec=####&di=##...
t####.jom####.com/timg?wisealaddin&size=f593_395&quality=100&sec=1532966...
wap.n.sh####.com/error.jsp?traceid=####
wap.n.sh####.com/s?word=####
wap.n.sh####.com/se/static/atom/search-ui/v2/core_1a43fb1.js
wap.n.sh####.com/se/static/img/iphone/logo.png
wap.n.sh####.com/se/static/js/fusion/b-scroll/b-scroll_e0b3634.js
wap.n.sh####.com/se/static/js/fusion/b-share/b-share_4aecd60.js
wap.n.sh####.com/se/static/js/fusion/deps/naboo_5b6a5d7.js
wap.n.sh####.com/se/static/js/log/taiji_device_e2f4d3c.js
wap.n.sh####.com/se/static/js/modules/baiduappFixedButton_4edbe08.js
wap.n.sh####.com/se/static/js/modules/device_data_dep/murmur3_e901bf7.js
wap.n.sh####.com/se/static/js/modules/feedback/feedback_15ec746.js
wap.n.sh####.com/se/static/js/uiamd/bdbox/base_ebba34e.js
wap.n.sh####.com/se/static/pmd/pmd/deps/detect_2a7ba24.js
wap.n.sh####.com/se/static/wiseatom/pagenav/pack_6eaba35.js
wap.n.sh####.com/tc?tcreq4log=####&ssid=####&from=####&bd_page_type=####...
www.a.sh####.com/5b1ZeDe5KgQFm2e88IuM_a/wbcj.gif?pid=####&ts=####&lid=##...
www.a.sh####.com/error
www.a.sh####.com/error.jsp?traceid=####
www.a.sh####.com/from=0/bd_page_type=1/ssid=0/uid=0/pu=usm@0,sz@1320_100...
www.a.sh####.com/his?callback=####&type=####&ishome=####&islogin=####&pi...
www.a.sh####.com/rec?platform=####&ms=####&lsAble=####&rset=####&word=##...
www.a.sh####.com/s?word=####&rq=####&sa=####&rsf=####&pqid=####&rqid=####
www.a.sh####.com/se/static/ala_atom/app/vid_hor/bundle_c4a76b0.js
www.a.sh####.com/se/static/ala_atom/app/yl_music_lyrics/bundle_2d7f5fd.js
www.a.sh####.com/se/static/aladdin/bk_polysemy/logo_big_94ece1f.png
www.a.sh####.com/se/static/aladdin/bk_polysemy/miaodong-logo_d5aa8ae.png
www.a.sh####.com/se/static/amd_modules/@baidu/better-scroll/better-scrol...
www.a.sh####.com/se/static/amd_modules/@baidu/better-scroll_3ccd1d2.js
www.a.sh####.com/se/static/amd_modules/@baidu/web-animations-js/web-anim...
www.a.sh####.com/se/static/amd_modules/@baidu/web-animations-js_8257915.js
www.a.sh####.com/se/static/amd_modules/@baidu/webb_5c95663.js
www.a.sh####.com/se/static/font/pmd/cicon_a5b2811.ttf
www.a.sh####.com/se/static/img/iphone/input_bearicon.png
www.a.sh####.com/se/static/img/iphone/logo.png
www.a.sh####.com/se/static/js/base/ala/util_7874520.js
www.a.sh####.com/se/static/js/base/atom/atomWrapper_a81161e.js
www.a.sh####.com/se/static/js/dep/fingerprint2.min_c6eb516.js
www.a.sh####.com/se/static/js/fusion/b-popup/b-popup_3e28331.js
www.a.sh####.com/se/static/js/fusion/b-scroll/bdscroll_3c59879.js
www.a.sh####.com/se/static/js/fusion/b-scroll/scroll_1b8ba32.js
www.a.sh####.com/se/static/js/fusion/b-toast/b-toast_89597a6.js
www.a.sh####.com/se/static/js/fusion/deps/aio_34bb973.js
www.a.sh####.com/se/static/js/fusion/deps/detect_59e6096.js
www.a.sh####.com/se/static/js/fusion/deps/fusion.best_a88de11.js
www.a.sh####.com/se/static/js/fusion/deps/fusion_ad9ac7f.js
www.a.sh####.com/se/static/js/fusion/deps/spark_e2da817.js
www.a.sh####.com/se/static/js/log/exp_db2b53e.js
www.a.sh####.com/se/static/js/log/taiji_behavior_84e8fa7.js
www.a.sh####.com/se/static/js/modules/advanced_filter/advanced_filter_17...
www.a.sh####.com/se/static/js/modules/device_data_dep/h5_support_info_4f...
www.a.sh####.com/se/static/js/modules/device_data_dep/murmur3_e901bf7.js
www.a.sh####.com/se/static/js/modules/device_data_dep/support_fonts_ac84...
www.a.sh####.com/se/static/js/modules/device_data_dep/zoom_info_abaf8bb.js
www.a.sh####.com/se/static/js/modules/safariicon/safariicon_d1dec0d.js
www.a.sh####.com/se/static/js/modules/vsl/vslUtil_2bffe78.js
www.a.sh####.com/se/static/js/uiamd/bdbox/follow_b1f1a38.js
www.a.sh####.com/se/static/js/uiamd/bdbox/util_efa4068.js
www.a.sh####.com/se/static/pmd/pmd/share/share_02e5b88.js
www.a.sh####.com/se/static/wiseatom/relative/pack_e4f409a.js
www.a.sh####.com/search/error.html
www.a.sh####.com/speed/static/tj.gif?pagetype=####&logid=####&ta_net=###...
www.a.sh####.com/static/search/clear.png
www.a.sh####.com/static/search/image_default.png
www.a.sh####.com/static/searchbox/openjs/share.js?v=####
www.a.sh####.com/static/tj.gif?time=####
www.a.sh####.com/tc?tcreq4log=####&ssid=####&from=####&bd_page_type=####...
you####.b####.com/s?type=####&p=quer####&ppim=####&im=####&rs=####&from=...

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
j####.kb####.cn/app/init
j####.kb####.cn/ts/image

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/11697329721582758219
/data/data/####/11697329721973813182
/data/data/####/INITSP.xml
/data/data/####/config.db4-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/downmodel.db-journal
/data/data/####/dxt_yx_sdk-journal
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/gmodel.db-journal
/data/data/####/index
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/qsap.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/sanzijing.db

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/files/libjiagu.so

Loads the following dynamic libraries:

libjiagu

Uses the following algorithms to decrypt data:

DES
DESede-CBC-PKCS7Padding

Uses special library to hide executable bytecode.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial