Android.Packed.42385

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.850.origin

Prompts to install third-party apps.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) l####.c####.q####.####.com:80
TCP(HTTP/1.1) oth.eve.mdt.####.com:8080
TCP(HTTP/1.1) oth.str.mdt.####.com:8080
TCP(HTTP/1.1) cgi.con####.qq.com:80
TCP(HTTP/1.1) cdn.app.fr####.####.com:80
TCP(HTTP/1.1) mon####.uu.qq.com:80
TCP(HTTP/1.1) www.q####.cn:80
TCP(TLS/1.0) oth.eve.mdt.####.com:443
TCP(TLS/1.0) u####.88a####.top:443
TCP(TLS/1.0) 2####.58.211.110:443

DNS requests:

allre####.re####.qq.com
cdn.app.fr####.top
cdn.img.fly####.top
cgi.con####.qq.com
mon####.uu.qq.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
u####.88a####.top
www.q####.cn

HTTP GET requests:

cdn.app.fr####.####.com/upload/201812/21/app/20181221134443728.apk
cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
l####.c####.q####.####.com/upload/201806/22/img/20180622182119519.png
l####.c####.q####.####.com/upload/201806/22/img/20180622182133230.png
www.q####.cn/n/dpz/?app=####&uid=####&sv=####&appver=####&osver=####&cve...

HTTP POST requests:

mon####.uu.qq.com/analytics/rqdsync
oth.eve.mdt.####.com:8080/analytics/upload?rid=####&sid=####
oth.str.mdt.####.com:8080/analytics/upload
oth.str.mdt.####.com:8080/analytics/upload?sid=####

File system changes:

Creates the following files:

/data/data/####/05608455-4f0e-42b1-a7e5-3fafb42734ef.jar
/data/data/####/BIZ_CONFIG.xml
/data/data/####/Beacon_sig_1.lock
/data/data/####/BuglySdkInfos.xml
/data/data/####/DENGTA_META.xml
/data/data/####/READ_CONFIG.xml
/data/data/####/REPORT.xml
/data/data/####/SETTING.xml
/data/data/####/SYS_CONFIG.xml
/data/data/####/acfdba84-5cc4-4ee0-8755-4d4594e23237
/data/data/####/arch.xml
/data/data/####/beacon_db-journal
/data/data/####/c.jar
/data/data/####/com.qq.reader-1.apk.classes-597857330.zip
/data/data/####/com.qq.reader-1.apk.classes737028512.zip
/data/data/####/com.tencent.open.config.json.100686853
/data/data/####/config.xml
/data/data/####/core_info
/data/data/####/cs.xml
/data/data/####/cxhh.db-journal
/data/data/####/default.db
/data/data/####/default.db-journal
/data/data/####/eup_db
/data/data/####/eup_db-journal
/data/data/####/mivmi.xml
/data/data/####/multidex.version.xml
/data/data/####/online.db
/data/data/####/online.db-journal
/data/data/####/qtsession.xml
/data/data/####/remarks.db
/data/data/####/remarks.db-journal
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbslock.txt
/data/data/####/theme.xml
/data/data/####/webversion.xml
/data/media/####/-1095004204.0
/data/media/####/-1158882563.0
/data/media/####/-1196477945.0
/data/media/####/-1277835294.0
/data/media/####/-1325560664.0
/data/media/####/-1681810218.0
/data/media/####/-1705499485.0
/data/media/####/-1967192738.0
/data/media/####/-2039091584.0
/data/media/####/-2139159264.0
/data/media/####/-279988536.0
/data/media/####/-285661441.0
/data/media/####/-285661442.0
/data/media/####/-285661443.0
/data/media/####/-285661444.0
/data/media/####/-285661445.0
/data/media/####/-355051955.0
/data/media/####/-418930314.0
/data/media/####/-61648948.0
/data/media/####/-712333321.0
/data/media/####/-801601197.0
/data/media/####/-820856655.0
/data/media/####/-938312507.0
/data/media/####/-941857969.0
/data/media/####/.nomedia
/data/media/####/11_3_c.png
/data/media/####/12_4_c.png
/data/media/####/1305028890.0
/data/media/####/1396589703.0
/data/media/####/14_5_c.png
/data/media/####/1501542395.0
/data/media/####/1_1_c.png
/data/media/####/1_c.png
/data/media/####/25_6_c.png
/data/media/####/29_7_c.png
/data/media/####/2_c.png
/data/media/####/3_c.png
/data/media/####/434147411.0
/data/media/####/447d791b372ec
/data/media/####/49bbb07cf77be05c4c19e10962d00a14.apk
/data/media/####/4_c.png
/data/media/####/530369258.0
/data/media/####/5_c.png
/data/media/####/6_c.png
/data/media/####/7_c.png
/data/media/####/7df967140873a
/data/media/####/964029037.0
/data/media/####/account.db
/data/media/####/adv.db
/data/media/####/adv.db-journal
/data/media/####/cl.tmp
/data/media/####/ds.tmp
/data/media/####/ds.tmp (deleted)
/data/media/####/journal.rl
/data/media/####/journal.tmp
/data/media/####/plugin.db
/data/media/####/record.db
/data/media/####/skinlist.db
/data/media/####/skinlist.db-journal
/data/media/####/tid.db
/data/media/####/uuid
/data/media/####/webcolumn.db

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
cat /proc/cpuinfo
cat /proc/version
chmod 777 /storage/emulated/0/spxin/49bbb07cf77be05c4c19e10962d00a14.apk
getprop androVM.vbox_dpi
getprop androVM.vbox_graph_mode
getprop init.svc.droid4x
getprop init.svc.microvirtd
getprop init.svc.noxd
getprop init.svc.qemud
getprop init.svc.su_kpbs_daemon
getprop init.svc.ttVM_x86-setup
getprop init.svc.vbox86-setup
getprop init.svc.xxkmsg
getprop ro.kernel.android.qemud
getprop ro.product.manufacturer
ls -l /system/bin/su

Accesses camera interface.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial