Android.Packed.43657

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.455.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) cdn.l####.fm.####.com:80
TCP(HTTP/1.1) 1####.145.147.217:80
TCP(HTTP/1.1) cd####.gz####.com.####.com:80
TCP(HTTP/1.1) app.1####.cn:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) s####.l####.fm.####.com:80
TCP(HTTP/1.1) ff.t####.com.####.com:80
TCP(HTTP/1.1) qq.i####.com:80
TCP(HTTP/1.1) cd####.l####.fm:80
TCP(HTTP/1.1) cd####.l####.fm.####.com:80
TCP(HTTP/1.1) t####.talking####.net:80
TCP(HTTP/1.1) res####.a####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) m.1####.cn:80
TCP(TLS/1.0) 2####.58.211.110:443
TCP(TLS/1.0) redi####.network####.com:443
TCP(TLS/1.0) dc1.network####.com:443
TCP p1.jz####.com:7801
TCP 1####.122.219.177:80
TCP p2.jz####.com:7803
TCP 1####.122.219.180:80
TCP p2.jz####.com:7802

DNS requests:

a####.u####.com
api####.a####.com
app.1####.cn
cd####.gz####.com
cd####.l####.fm
cd####.l####.fm
cdn.l####.fm
dc1.network####.com
ff.t####.com
ip.ta####.com
m.1####.cn
m.i####.com
oc.u####.com
p1.jz####.com
p2.jz####.com
p3.jz####.com
redi####.network####.com
res####.a####.com
s####.l####.fm
t####.talking####.net
www.l####.fm

HTTP GET requests:

app.1####.cn/ad/outer
app.1####.cn/ad/recommend
app.1####.cn/app
app.1####.cn/platform
app.1####.cn/recomm/list
cd####.gz####.com.####.com/audio/cesu_hd.mp3
cd####.l####.fm.####.com/audio/cesu_hd.mp3
cd####.l####.fm/audio/cesu_hd.mp3
cdn.l####.fm.####.com/android/lizhifm_sub.apk
cdn.l####.fm.####.com/radio_cover/2014/08/23/13905693502380804_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2014/11/17/15899175730213636_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2015/01/02/16969559426708868_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2015/03/19/18736136920401284_160x120.png
cdn.l####.fm.####.com/radio_cover/2015/03/28/18946994582509444_160x120.png
cdn.l####.fm.####.com/radio_cover/2015/05/23/20234428745037700_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2015/08/05/21962317417438468_160x120.jpg
cdn.l####.fm.####.com/radio_cover/2016/01/09/25589162019114756_160x120.png
cdn.l####.fm.####.com/radio_cover/2016/04/03/27561519446273668_160x120.png
cdn.l####.fm.####.com/radio_cover/2016/06/19/29341550409645444_160x120.png
cdn.l####.fm.####.com/radio_cover/2017/04/25/2598231379925273092_160x120...
cdn.l####.fm.####.com/radio_cover/2017/05/18/2602471287889136132_160x120...
cdn.l####.fm.####.com/radio_cover/2017/07/24/2614936111756414468_160x120...
cdn.l####.fm.####.com/radio_cover/2017/08/18/2619589264317789700_160x120...
ff.t####.com.####.com/d/41d3.png
ip.ta####.com/service/getIpInfo2.php?ip=####
m.1####.cn/res/ad/33021791362416726.jpeg
qq.i####.com/cfg/appkey-cfff20554a781b91
s####.l####.fm.####.com/android/lizhifm_sub.apk

HTTP POST requests:

a####.u####.com/app_logs
app.1####.cn/point/current
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time
qq.i####.com/rec/se?_iwt_t=####&sv=####
res####.a####.com/v3/config/resource?
res####.a####.com/v3/log/init
s####.l####.fm.####.com/v1/postclientdata
s####.l####.fm.####.com/v1/postevent
t####.talking####.net/g/d

File system changes:

Creates the following files:

/data/data/####/-366188723-1257941271
/data/data/####/-366188723-939871283
/data/data/####/.imprint
/data/data/####/015533461238671.jar
/data/data/####/1533051580-1041054485
/data/data/####/2799588331199708934
/data/data/####/279958833187243908
/data/data/####/517413695-250722021
/data/data/####/E_ID356507059351895.db
/data/data/####/E_ID356507059351895.db-journal
/data/data/####/LizhiFM.db
/data/data/####/LizhiFM.db-journal
/data/data/####/MATSharedPreferences.xml
/data/data/####/MATSharedPreferences.xml (deleted)
/data/data/####/TD_CHANNEL_ID.xml
/data/data/####/TDtcagent.db
/data/data/####/TDtcagent.db-journal
/data/data/####/_ire-journal
/data/data/####/app.cfg
/data/data/####/cdn_host_main.cfg
/data/data/####/cdn_host_player.cfg
/data/data/####/cdn_host_push.cfg
/data/data/####/cn.com.mma.mobile.tracking.other.xml
/data/data/####/com.gk.zw-1.apk.classes-505344409.zip
/data/data/####/com.gk.zw_preferences.xml
/data/data/####/com.networkbench.agent.impl.v2_com.gk.zw.xml
/data/data/####/config.cfg
/data/data/####/dns_ex_addr.cfg
/data/data/####/i.xml
/data/data/####/i_fac_pre356507059351895.xml
/data/data/####/i_finfo_pre356507059351895.xml
/data/data/####/i_fionf_pre356507059351895.xml
/data/data/####/last_known_location.xml
/data/data/####/mobclick_agent_online_setting_com.gk.zw.xml
/data/data/####/multidex.version.xml
/data/data/####/op.log
/data/data/####/pref_longtime.xml
/data/data/####/pref_shorttime.xml
/data/data/####/process.xml
/data/data/####/sub_app_file
/data/data/####/td.lock
/data/data/####/tdid.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ums_agent_online_setting.xml
/data/media/####/-1025529633_160x120
/data/media/####/-1136888646_160x120
/data/media/####/-1727245558_160x120
/data/media/####/-1918398496_160x120
/data/media/####/-2045308605_160x120
/data/media/####/-820007917_160x120
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/1389008293_160x120
/data/media/####/1575764829_160x120
/data/media/####/1904037753_160x120
/data/media/####/2101961978_160x120
/data/media/####/368585240_160x120
/data/media/####/41d3.png.dat
/data/media/####/427853127_160x120
/data/media/####/674249103
/data/media/####/761873113_160x120
/data/media/####/804822423_160x120
/data/media/####/backup.db
/data/media/####/backup.db-journal
/data/media/####/cesu
/data/media/####/journal.tmp
/data/media/####/lz.ini
/data/media/####/mobclick_agent_cached

Miscellaneous:

Executes the following shell scripts:

getprop
sh <Package Folder>/lib/libdaemon.so <Package>/com.igexin.sdk.PushService <Package>:push &

Loads the following dynamic libraries:

audioprocess
crashcapture
decoder
encoder
launcher
mresearch
myspinnative
resample
rtmpdump
tpnsSecurity

Uses the following algorithms to encrypt data:

AES-ECB-PKCS5Padding
AES-ECB-ZeroBytePadding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

DES
DES-CBC-PKCS5Padding

Accesses camera interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial