Android.Packed.44598

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.860.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(HTTP/1.1) hk.wagbr####.non####.####.com:80
TCP(HTTP/1.1) dc.l####.com:80
TCP(HTTP/1.1) imgc####.qq.com.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.zhuishu####.com:80
TCP(HTTP/1.1) s####.e.qq.com:80
TCP(HTTP/1.1) api.m####.adwan####.com:80
TCP(HTTP/1.1) ad####.m.ta####.com:80
TCP(HTTP/1.1) src.r####.com.####.com:80
TCP(HTTP/1.1) goldenl####.com:3000
TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) sdk.c####.com:80
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) mi.g####.qq.com:80
TCP(TLS/1.0) an####.l####.com:443
TCP(TLS/1.0) bds.sn####.com:443
TCP(TLS/1.0) is.sn####.com:443

DNS requests:

a####.man.aliy####.com
a####.u####.com
ad####.m.ta####.com
ada####.m.ta####.com
an####.l####.com
and####.b####.qq.com
api.m####.adwan####.com
api.zhuishu####.com
au.u####.co
au.u####.com
bds.sn####.com
dc.l####.com
ex####.sn####.com
feed####.u####.com
goldenl####.com
i.sn####.com
imgc####.qq.com
is.sn####.com
log.u####.com
mi.g####.qq.com
oc.u####.com
pv.s####.com
s####.e.qq.com
s####.u####.com
sdk.c####.com
sf1-ttc####.ps####.com
src.r####.com
sta####.zhuishu####.com
y####.al####.com

HTTP GET requests:

ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
api.m####.adwan####.com/sdk/configinfo.api?token=####
api.m####.adwan####.com/sdk/report.api?slotid=####&t_slotId=####&os_type...
api.zhuishu####.com/book/58c80c7f882c1f62026fbee0
api.zhuishu####.com/book/by-categories?gender=####&minor=####&major=####...
api.zhuishu####.com/ranking/550b836229cd462830ff4d1d
api.zhuishu####.com/ranking/550b83d915db45cd4b022106
et2-na6####.wagbr####.ali####.####.com/bar/get/591c5404717c1959f7000d24/...
gd.a.s####.com/cityjson?ie=####
gl####.w.kunl####.####.com/agent/http://img.1391.com/api/v1/bookcenter/c...
goldenl####.com:3000/b_src/get_forbidden_book?ts=####
goldenl####.com:3000/checkupdate
goldenl####.com:3000/v5/getconf
imgc####.qq.com.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/progu...
mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
sf1-ttc####.ps####.com/img/ad.union.api/b3bc03529de77695acae5eb413abb65c...
src.r####.com.####.com/kubo/dex/luomi_9.1.28.dex

HTTP POST requests:

a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
and####.b####.qq.com/rqd/async?aid=####
api.m####.adwan####.com/s/ads/ba2e416e3aea4e14dbeb446ca90e4288.api
api.m####.adwan####.com/sdk.api
api.m####.adwan####.com/sdk/report/errorinfo.api
dc.l####.com/adLogs/adLog
dc.l####.com/hLogs/saveHeartbeatLog
dc.l####.com/startLog/startLog
dc.l####.com/wLog/wLog
hk.wagbr####.non####.####.com/saveWb.json
oc.u####.com/check_config_update
s####.e.qq.com/activate
s####.e.qq.com/msg
sdk.c####.com/versiontapi.php?v=####&type=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

File system changes:

Creates the following files:

/data/data/####/.bak
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1004
/data/data/####/1556732775062.log
/data/data/####/21c22f492aba3de8.lock
/data/data/####/2302.yaqcookie
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/Alvin2.xml
/data/data/####/Alvin2.xml.bak (deleted)
/data/data/####/BuglySdkInfos.xml
/data/data/####/ContextData.xml
/data/data/####/GDTSDK.db
/data/data/####/GDTSDK.db-journal
/data/data/####/MultiDex.lock
/data/data/####/Q0VSVC5SU0EK.txt8fe
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/WMSplashad.xml
/data/data/####/ap.Lock
/data/data/####/app_crash_copy.xml
/data/data/####/ax_c.xml
/data/data/####/bugly_db_-journal
/data/data/####/com.biquge.book.noverls_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/data-journal
/data/data/####/devCloudSetting.cfg
/data/data/####/devCloudSetting.sig
/data/data/####/dexMethod.68778890.dat
/data/data/####/downloader.db-journal
/data/data/####/gdt_config.cfg
/data/data/####/gdt_plugin.jar
/data/data/####/gdt_plugin.jar.sig
/data/data/####/gdt_plugin.tmp
/data/data/####/gdt_plugin.tmp.sig
/data/data/####/gdt_suid
/data/data/####/gg.dex
/data/data/####/jie_noverls_book_sharedpreferences.xml
/data/data/####/jie_noverls_book_sharedpreferences.xml.bak
/data/data/####/libjiagu-1469321884.so
/data/data/####/libsgmainso-5.1.103.so.tmp.2302
/data/data/####/libyaqbasic.68778890.so
/data/data/####/libyaqpro.68778890.so
/data/data/####/local_crash_lock
/data/data/####/lock.lock
/data/data/####/mc181.dex
/data/data/####/mc_cache.xml
/data/data/####/mobclick_agent_online_setting_com.biquge.book.noverls.xml
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/sdkCloudSetting.cfg
/data/data/####/sdkCloudSetting.sig
/data/data/####/sdk_config.xml
/data/data/####/security_info
/data/data/####/sp.lock
/data/data/####/tt_materialMeta.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_splash.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/umeng_feedback_conversations.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/update_lc
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/yaqsdkcookie
/data/media/####/.nomedia
/data/media/####/4t0aiqca5wjb1oh9l57i2u5j1.0.tmp
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/dd7893586a493dc3
/data/media/####/hid.dat
/data/media/####/journal.tmp
/data/media/####/tt_splash_image_cache

Miscellaneous:

Executes the following shell scripts:

/system/bin/sh -c getprop
getprop
getprop ro.build.version.emui
getprop ro.letv.release.version
getprop ro.vivo.os.build.display.id

Loads the following dynamic libraries:

Bugly
bspatch
libjiagu-1469321884
libyaqbasic.68778890
libyaqpro.68778890
nms
sgmainso-5.1
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-ECB-PKCS5Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial