Android.Packed.40922

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.3887

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) dl.api.kyli####.com:80
TCP(HTTP/1.1) c.g####.qq.com:80
TCP(HTTP/1.1) tt.kyli####.com:80
TCP(HTTP/1.1) s####.tc.qq.com:80
TCP(HTTP/1.1) api.ila####.com:80
TCP(HTTP/1.1) 362b3d8####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) 1####.75.3.32:8711
TCP(HTTP/1.1) d####.wos####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) cdn.1####.wang:80
TCP(HTTP/1.1) api.kxcon####.com:666
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) v.g####.qq.com:80
TCP(HTTP/1.1) mt.kap####.com:80
TCP(HTTP/1.1) rcv.ila####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) 1####.75.3.32:8881
TCP(HTTP/1.1) 3####.tc.qq.com:80
TCP(HTTP/1.1) a####.b0.upa####.com:80
TCP(HTTP/1.1) dd.arg####.com:80
TCP(HTTP/1.1) js.lotu####.com:80
TCP(HTTP/1.1) d.g####.qq.com:80
TCP(HTTP/1.1) 1####.75.67.204:8961
TCP(HTTP/1.1) ss####.mogu####.com:80
TCP(HTTP/1.1) c.xz####.com:3350
TCP(HTTP/1.1) bb.dugeshe####.com:80
TCP(HTTP/1.1) p.rqco####.com:8806
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) k####.kyli####.com.####.com:80
TCP(HTTP/1.1) ttt.arg####.com:80
TCP(HTTP/1.1) cx.v####.com.####.com:80
TCP(HTTP/1.1) www.58cn####.com.####.com:80
TCP(HTTP/1.1) 2####.205.158.50:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) kl.kyli####.com:80
TCP(TLS/1.0) cdn.boo####.com.####.net:443
TCP(TLS/1.0) g####.jd.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) c####.jd.com:443
TCP(TLS/1.0) i####.360bu####.com.####.com:443
TCP(TLS/1.0) b####.m.jd.com:443
TCP(TLS/1.0) w####.jd.com:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) 362b3d8####.oss-cn-####.aliy####.com:443
TCP(TLS/1.0) r.s####.cn:443
TCP(TLS/1.0) 1####.217.20.78:443
TCP(TLS/1.0) cl####.adma####.com.cn:443
TCP(TLS/1.0) ur####.jd.com:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) p####.m.jd.com:443
TCP(TLS/1.0) i####.j####.com:443
TCP(TLS/1.0) a####.m.jd.com:443
TCP(TLS/1.0) ei.c####.com:443
TCP(TLS/1.0) ad.i####.xyz:443
TCP(TLS/1.0) l####.b####.com:443

DNS requests:

362b3d8####.oss-cn-####.aliy####.com
a####.b0.upa####.com
a####.m.jd.com
ad.i####.xyz
api.ila####.com
api.kxcon####.com
bb.dugeshe####.com
black####.m.jd.com
bx.imo####.com
c####.jd.com
c####.mm####.com
c.c####.com
c.g####.qq.com
c.xz####.com
cdn.1####.wang
cdn.boo####.com
cl####.adma####.com.cn
cx.v####.com
d####.wos####.com
d.g####.qq.com
dd.arg####.com
dd.m####.com
dl.api.kyli####.com
ei.c####.com
g####.jd.com
g####.jd.com
h5.360bu####.com
h5s####.m.jd.com
i####.360bu####.com
i####.360bu####.com
i####.360bu####.com
i####.360bu####.com
imgc####.qq.com
js.lotu####.com
k####.kyli####.com
kl.kyli####.com
l####.b####.com
m####.m.jd.com
m.360bu####.com
mi.g####.qq.com
mt.kap####.com
p####.m.jd.com
p####.ugd####.com
p.rqco####.com
pco####.c####.com
pp.m####.com
qzones####.g####.cn
r.s####.cn
rcv.ila####.com
s####.e.qq.com
s13.c####.com
s19.c####.com
s22.c####.com
ss####.mogu####.com
sto####.360bu####.com
tt.kyli####.com
ttt.arg####.com
ur####.jd.com
v.g####.qq.com
w####.jd.com
wq.360bu####.com
www.58cn####.com
www.cigo####.com
z1.c####.com
z7.c####.com
z8.c####.com

HTTP GET requests:

3####.tc.qq.com/16891/6C6299148CDE2A9C507DED8E8A6B7720.apk?fsname=####&_...
362b3d8####.oss-cn-####.aliy####.com/h.html?id=id=1####&web_id=####
a####.b0.upa####.com/paramslist
api.ila####.com/c/_ii_?_=####
api.ila####.com/c/shenzhenkeli4_sdk
api.ila####.com/e/i.html
api.ila####.com/e/i.js
api.ila####.com/update_ch/common/core.jar
api.ila####.com/update_ch/common/coreconfig.jar
bb.dugeshe####.com/yhws/channel/zy/zyikd.html
c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####&web_id=####
c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
c.g####.qq.com/gdt_trace_a.fcg?actionid=####&targettype=####&tagetid=###...
cdn.1####.wang/sc_156
cx.v####.com.####.com/es/htpddjs/css/index.css
cx.v####.com.####.com/es/htpddjs/css/item.css
cx.v####.com.####.com/es/htpddjs/css/loading.css
cx.v####.com.####.com/es/htpddjs/img/hongbao.png
cx.v####.com.####.com/es/htpddjs/img/search.png
cx.v####.com.####.com/es/htpddjs/index.html?cid=####
cx.v####.com.####.com/es/htpddjs/js/Tools.js
cx.v####.com.####.com/es/htpddjs/js/echo.js
cx.v####.com.####.com/es/htpddjs/js/index.js
cx.v####.com.####.com/es/htpddjs/js/sy.js
cx.v####.com.####.com/lh/smart/inv/pxinteraction_400555.html?td_channeli...
cx.v####.com.####.com/lh/smart/inv/pxinteraction_lx_up_81001.html?td_cha...
cx.v####.com.####.com/lh/smart/smartpull_400555.js
d.g####.qq.com/fcg-bin/gdt_appdetail.fcg?ico=####&op_appid=####
dd.arg####.com/yhws/channel/mj/jfma.html
gm.mm####.com/9.gif?abc=####&rnd=####
js.lotu####.com/lsd.js
k####.kyli####.com.####.com/1541144045285_utils.ttf
mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
p.rqco####.com:8806/c/1541389890611
pco####.ta####.com/app.gif?&cna=####
rcv.ila####.com/report2?t=####&h1=####&c=####&v=####&op1=####&op2=####&n...
s####.tc.qq.com/gdt/0/DAAhefbAEsAEsAARBbxZgPCDbyvEy6.jpg/0?ck=####
s####.tc.qq.com/gdt/0/transformer_82826764648418947_1540913012_80.jpg/0?...
s####.tc.qq.com/ma_icon/0/icon_52638197_1540904771/256
ss####.mogu####.com/singlefun/jspullup/recentjspullup?ggid=####&cid=####...
ttt.arg####.com/getStatus?id=MgV9####&h=####
ttt.arg####.com/getStatus?id=cMev####&h=####
ttt.arg####.com/z_stat.js?m=tM5zv####
v.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####&gap=####
www.58cn####.com.####.com/
www.58cn####.com.####.com/skin/wapimg/TouchSlide.1.1.js
www.58cn####.com.####.com/skin/wapimg/foot.js
www.58cn####.com.####.com/skin/wapimg/ico-home.png
www.58cn####.com.####.com/skin/wapimg/ico-nav.png
www.58cn####.com.####.com/skin/wapimg/index.js
www.58cn####.com.####.com/skin/wapimg/index20180927.css
www.58cn####.com.####.com/skin/wapimg/jquery-1.9.1.min.js
www.58cn####.com.####.com/skin/wapimg/top.png
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

HTTP POST requests:

api.kxcon####.com:666/v1/config
c.xz####.com:3350/s/
d####.wos####.com/upload/event.jsp
d####.wos####.com/upload/event2.jsp
d####.wos####.com/upload/event3.jsp
d####.wos####.com/upload/longheartbeat.jsp
d####.wos####.com/upload/sdklongheartbeat.jsp
dl.api.kyli####.com/v2/load/mobile
kl.kyli####.com/klv2/sdkkl/mobile
mt.kap####.com/v1/st
p.rqco####.com:8806/p/1541389891293
s####.e.qq.com/activate
s####.e.qq.com/click
s####.e.qq.com/msg
tt.kyli####.com/v2/task/mobile

Modified file system:

Creates the following files:

/data/data/####/04C6522B7AA56FD8827878EF4F34CDB0.jar
/data/data/####/04C6522B7AA56FD8827878EF4F34CDB0.tmp
/data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
/data/data/####/ApplicationCache.db-journal
/data/data/####/BuglySdkInfos.xml
/data/data/####/CachedGeoposition.db
/data/data/####/CachedGeoposition.db-journal
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/RSS_PL_COUNTLY_STORE.xml
/data/data/####/android-util.zip
/data/data/####/app_spf_scli.xml
/data/data/####/bbc4b2c294f217b37d22bce274a621d2.temp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/core.jar.tm
/data/data/####/coreconfig.jar.tm
/data/data/####/corelib.jar.tm
/data/data/####/corelib.tmp.jar
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/default.xml
/data/data/####/default_sp.xml
/data/data/####/defaultpref1.xml
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/f984f397f53e9ab4ad077a9cd34c5918
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/http_api.ilabtap.com_0.localstorage-journal
/data/data/####/http_www.58cnnews.com_0.localstorage-journal
/data/data/####/https_pro.m.jd.com_0.localstorage-journal
/data/data/####/imagedb
/data/data/####/imagedb-journal
/data/data/####/index
/data/data/####/lnkumv
/data/data/####/mobclick_agent_cached_protect.eye.filterv22
/data/data/####/odddk.xml
/data/data/####/oddzg.xml
/data/data/####/pl_o_sp.xml
/data/data/####/pl_sp.xml
/data/data/####/rws_sp.xml
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sp_config.xml
/data/data/####/sp_iconfig.xml
/data/data/####/sp_iconfig.xml.bak
/data/data/####/spf_configss.xml
/data/data/####/tray.db-journal
/data/data/####/umengOnEvent.db
/data/data/####/umengOnEvent.db-journal
/data/data/####/umengOnEventValue.db
/data/data/####/umengOnEventValue.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/update_lc
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wp_sp.xml
/data/data/####/xconfig.xml
/data/data/####/xsdk_preference.xml
/data/media/####/adv
/data/media/####/com.wedobest.szhrd.apk_0
/data/media/####/config
/data/media/####/deviceId
/data/media/####/f337777a182abcb6517c6e553f9a6a6e
/data/media/####/master
/data/media/####/master.lock

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq

Uses the following algorithms to encrypt data:

AES-ECB-PKCS7Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS7Padding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, IMEI, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial