Android.Packed.43367

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.589.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) up####.huicho####.net:80
TCP(HTTP/1.1) large11####.c####.l####.####.com:80
TCP(HTTP/1.1) da####.c####.qini####.com:80
TCP(HTTP/1.1) p####.tc.qq.com:80
TCP(HTTP/1.1) c.isds####.qq.com:80
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) 1####.89.97.82:8000
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(HTTP/1.1) a####.a####.m.####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) v####.dn####.top:443
TCP openj####.m.ta####.com:443
TCP 1####.205.160.76:443

DNS requests:

a####.m.ta####.com
ag####.m.ta####.com
api.map.b####.com
c.c####.com
c.isds####.qq.com
cdn.app.dn####.top
cdn.img.p####.top
imgc####.qq.com
log.u####.com
mi.g####.qq.com
qzones####.g####.cn
s####.e.qq.com
s####.u####.com
s11.c####.com
umengj####.m.ta####.com
up####.huicho####.net
v####.dn####.top
www.huicho####.net
z13.c####.com

HTTP GET requests:

c.c####.com/core.php?web_id=####&t=####
c.c####.com/z_stat.php?id=####
c.isds####.qq.com/code.cgi?domain=mi.gdt.qq.com&time=1382&rate=100&code=...
da####.c####.qini####.com/upload/201903/13/img/20190313155659359.png
large11####.c####.l####.####.com/sfile/201903/14/all/cp_V3.1.2.txt
mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
up####.huicho####.net/bootstrap/dist/css/bootstrap.min.css
up####.huicho####.net/bootstrap/dist/js/bootstrap.min.js
up####.huicho####.net/images/location_mocker.png
up####.huicho####.net/images/location_qr.png
up####.huicho####.net/images/qq.png
up####.huicho####.net/images/reward_qq.jpg
up####.huicho####.net/images/reward_weixin.jpg
up####.huicho####.net/images/reward_zhifubao.jpg
up####.huicho####.net/images/weibo.png
up####.huicho####.net/images/weixin.png
up####.huicho####.net/images/weixin_mp_qr.jpg
up####.huicho####.net/javascripts/recommend.js
up####.huicho####.net/jquery-json/dist/jquery.json.min.js
up####.huicho####.net/jquery/dist/jquery.min.js
up####.huicho####.net/location_mocker/instruction.html
up####.huicho####.net/manage_app/get_recommend
up####.huicho####.net/patch/query?appKey=####&pkgName=####&versionCode=#...
up####.huicho####.net/stylesheets/style.css
up####.huicho####.net/update/query?appKey=####&pkgName=####&versionCode=...
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...

HTTP POST requests:

a####.a####.m.####.com/amdc/mobileDispatch?appkey=####&platform=####&v=#...
s####.e.qq.com/activate

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/ACCS_BIND.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/CustomIndex
/data/data/####/DVDirectory.cfg
/data/data/####/DVHotMap.cfg
/data/data/####/DVHotcity.cfg
/data/data/####/DVIndoor.cfg
/data/data/####/DVVersion.cfg
/data/data/####/DaemonServer
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/ResPack.rs
/data/data/####/ResPackIndoorMap.rs
/data/data/####/V3.1.2.txt
/data/data/####/V3.1.2.xml
/data/data/####/_andfix_.xml
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/authStatus_com.dsjfklsdajfdsaf.gjdksal.xml
/data/data/####/authStatus_com.dsjfklsdajfdsaf.gjdksal;channel.xml
/data/data/####/authStatus_com.dsjfklsdajfdsaf.gjdksal;sgzsut.xml
/data/data/####/baseindoormap.sty
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.dsjfklsdajfdsaf.gjdksal.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/eudemon
/data/data/####/ev.jar
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/index
/data/data/####/inittime.xml
/data/data/####/kr.xml
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/map_pref.xml
/data/data/####/map_state.xml
/data/data/####/mapstyle.sty
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mobclick_agent_cached_com.dsjfklsdajfdsaf.gjdksal630
/data/data/####/satellitestyle.sty
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/t_u.db-journal
/data/data/####/trafficstyle.sty
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_socialize.xml
/data/data/####/update_lc
/data/data/####/vbz.xml
/data/data/####/ver.dat
/data/data/####/we.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/786dd0187e11e
/data/media/####/96696429e0724f989f796311e666c3f6
/data/media/####/Alvin2.xml
/data/media/####/ApplicationCache.db-journal
/data/media/####/ContextData.xml
/data/media/####/DTTempdat.dat
/data/media/####/DTTempdat.idx
/data/media/####/HMTempdat.dat
/data/media/####/HMTempdat.idx
/data/media/####/ITTempdat.dat
/data/media/####/ITTempdat.idx
/data/media/####/accs_election
/data/media/####/b205cb6a439a41f4ba75f915a9f722cc
/data/media/####/c8b30974d740429f8aef54bd29304a81
/data/media/####/test.0

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:54f55604fd98c5a0fb0010be","utdid":"XIohYL7NhsADAGdzx1EAQ6f/","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
chmod 755 <Package Folder>/.jiagu/libjiagu.so
sh

Loads the following dynamic libraries:

BaiduMapSDK_base_v4_0_0
BaiduMapSDK_map_v4_0_0
BaiduMapSDK_search_v4_0_0
andfix
libjiagu
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial