Android.DownLoader.4965

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.RemoteCode.231.origin
Android.Triada.554.origin

Downloads the following detected threats from the Internet:

Android.RemoteCode.231.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) 13.2####.16.115:8081
TCP(HTTP/1.1) fo####.site:80
TCP(HTTP/1.1) api.dc.tkcre####.com:80
TCP(HTTP/1.1) api.applove####.com:80
TCP(TLS/1.0) sf3-ttc####.ps####.com:443
TCP(TLS/1.0) wcf.seven####.com:443
TCP(TLS/1.0) 1####.217.20.106:443
TCP(TLS/1.0) www.face####.com:443
TCP(TLS/1.0) analy####.ray####.com:443
TCP(TLS/1.0) ap####.uc.cn:443
TCP(TLS/1.0) dm.byted####.com:443
TCP(TLS/1.0) dm.tou####.com:443
TCP(TLS/1.0) api.dc.tkcre####.com:443
TCP(TLS/1.0) api16-a####.pa####.io.####.net:443
TCP(TLS/1.0) sconten####.xx.f####.net:443
TCP(TLS/1.0) api.face####.com:443
TCP(TLS/1.0) al####.u####.com:443
TCP(TLS/1.0) fk-old-####.ray####.com:443
TCP(TLS/1.0) cdn-adn####.ray####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) di####.b####.net:443
TCP(TLS/1.2) 1####.217.19.202:443
TCP(TLS/1.2) 1####.217.17.67:443
TCP(TLS/1.2) 2####.58.211.106:443

DNS requests:

analy####.ray####.com
ap####.uc.cn
api.applove####.com
api.dc.tkcre####.com
api16-a####.pa####.io
cdn-adn####.ray####.com
dig.b####.net
dig.b####.net.####.8
dm.byted####.com
dm.ps####.com
dm.tou####.com
fo####.site
g####.face####.com
googl####.g.doublec####.####.8
googl####.g.doublec####.nes
h####.b####.com
hlg.ca####.com
hlg.ca####.com.####.8
hw9####.new####.com
net.ray####.col
net.ray####.col.####.8
pang####.sn####.com
sconten####.xx.f####.net
set####.ray####.com
sf3-fe####.pglstat####.com
sf3-ttc####.ps####.com
to####.ctobsn####.com
u####.u####.com
wcf.seven####.com
www.face####.com
z12.c####.com

HTTP GET requests:

api.applove####.com/api/v3/search/get?osv=####&token=####&pm=####&os=###...
api.applove####.com/api/v3/template/get?slot_id=####&update_time=####&us...
fo####.site/upload/sdk_thridLib-release-unsigned-201214-915.apk

HTTP POST requests:

api.dc.tkcre####.com/v1/sdklog

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/Cookies-journal
/data/data/####/DATA_DETECTION_ADDRESS_1
/data/data/####/FBAdPrefs.xml
/data/data/####/REPLEHDP0DP0MOC.bati
/data/data/####/REPLEHDP0DP0MOC.end
/data/data/####/REPLEHDP0DP0MOC.hdr
/data/data/####/REPLEHDP0DP0MOC.meminfo
/data/data/####/REPLEHDP0DP0MOC.pid
/data/data/####/REPLEHDP0DP0MOC.ps
/data/data/####/REPLEHDP0DP0MOC.st
/data/data/####/REPLEHDP0DP0MOC.start
/data/data/####/REPLEHDP0DP0MOC.status
/data/data/####/REPLEHDP0DP0MOC.time
/data/data/####/REPLEHDP0DP0MOC.uptime
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/admob.xml
/data/data/####/anl.db-journal
/data/data/####/anl.db-shm (deleted)
/data/data/####/anl.db-wal
/data/data/####/app_db-journal
/data/data/####/audience_network.dex
/data/data/####/audience_network.dex.flock (deleted)
/data/data/####/b22967b1b05fec24_0 (deleted)
/data/data/####/bd_embed_tea_agent.db-journal
/data/data/####/c14d2ea416cc4f8ae8e1dc95eaa2afe7.xml
/data/data/####/c1qa2sw3de4frf5tg6yhju78ik9olp0.xml
/data/data/####/c1qa2sw3de4frf5tg6yhju78ik9olp0.xml.bak
/data/data/####/cdt.wa
/data/data/####/com.bb.c2.vv.new.の.apktemp
/data/data/####/com.bb.c2.vv.new.の.dex
/data/data/####/com.bb.c2.vv.new.の.dex.flock (deleted)
/data/data/####/com.facebook.ads.internal.btextras.xml
/data/data/####/com.facebook.internal.MODEL_STORE.xml
/data/data/####/com.facebook.internal.preferences.APP_GATEKEEPERS.xml
/data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
/data/data/####/com.facebook.sdk.USER_SETTINGS.xml
/data/data/####/com.facebook.sdk.appEventPreferences.xml
/data/data/####/com.facebook.sdk.attributionTracking.xml
/data/data/####/com.google.android.gms.measurement.prefs.xml
/data/data/####/com.pd.pdhelper_ct_default.xml
/data/data/####/com.pd.pdhelper_preferences.xml
/data/data/####/com.pd.pdhelper_preferences.xml.bak
/data/data/####/com.pd.pdhelperye_after_install_pkg.xml
/data/data/####/combbjazzkitov.
/data/data/####/combbjazzkitov.dex
/data/data/####/combbjazzkitov.dex.flock (deleted)
/data/data/####/core_asdjfadsfjsaio.so
/data/data/####/cr.wa
/data/data/####/cum.lock
/data/data/####/cv.xml
/data/data/####/delayed_transmission_flag_new.xml
/data/data/####/downloader.db-journal
/data/data/####/dt.wa
/data/data/####/embed_applog_stats.xml
/data/data/####/embed_header_custom.xml
/data/data/####/embed_last_sp_session.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fl32
/data/data/####/fwj8i3dd.data-journal
/data/data/####/g5dtf4rd.xml
/data/data/####/godzilla.xml
/data/data/####/i==1.2.0&&1.1.3.3_1607992623070_envelope.log
/data/data/####/i==1.2.0&&1.1.3.3_1607992651553_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/metrics_guid
/data/data/####/mintegral.msdk.db-journal
/data/data/####/mintegral.xml
/data/data/####/mintegral.xml.bak
/data/data/####/mobclick_agent_user_com.pd.pdhelper.xml
/data/data/####/npth.xml
/data/data/####/npth_log.db-journal
/data/data/####/om_js_content.txt
/data/data/####/proc_auxv
/data/data/####/share_date.xml
/data/data/####/share_date.xml.bak
/data/data/####/snssdk_openudid.xml
/data/data/####/spUtils.xml
/data/data/####/sp_push_time.xml
/data/data/####/sp_qwejrioqwjroierj.xml
/data/data/####/ssk_config.xml
/data/data/####/t==9.1.0&&1.1.3.3_1607992622824_envelope.log
/data/data/####/the-real-index
/data/data/####/tt_dns_settings.xml
/data/data/####/tt_sdk_settings.xml
/data/data/####/tt_sdk_settings.xml.bak
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/um_session_id.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_general_config.xml.bak (deleted)
/data/data/####/umeng_it.cache
/data/data/####/umeng_sp_oaid.xml
/data/data/####/umeng_sp_zdata.xml
/data/data/####/umeng_zcfg_flag
/data/data/####/umeng_zero_cache.db
/data/data/####/umeng_zero_cache.db-journal
/data/data/####/unique
/data/data/####/ver
/data/data/####/z==1.2.0&&1.1.3.3_1607992620551_envelope.log
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/<Package>0<Package>/combbjazzkitov. --oat-fd=173 --oat-location=/data/user/0/<Package>/files/<Package>0<Package>/<Package>/1607992650470/combbjazzkitov.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/<Package>0<Package>/combbjazzkitov. --oat-fd=184 --oat-location=/data/user/0/<Package>/files/<Package>0<Package>/<Package>/1607992620518/combbjazzkitov.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/audience_network.dex --oat-fd=40 --oat-location=/data/user/0/<Package>/app_optimized/audience_network.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/com.bb.c2.vv.new. .apk --oat-fd=206 --oat-location=/data/user/0/<Package>/cache/<Package>/com.bb.c2.vv.new. .dex --compiler-filter=speed
chmod 777 /data/user/0/<Package>/cache/Download
getprop ro.bootimage.build.date.utc
getprop ro.build.description
getprop ro.build.fingerprint
getprop ro.build.product
getprop ro.build.version.all_codenames
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.sv.version
getprop ro.lenovo.lvp.version
getprop ro.miui.ui.version.name
getprop ro.sf.lcd_density
getprop ro.smartisan.version
getprop ro.vivo.os.version
ls /
mount
ps
sh
sh -c type su

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
desede-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Displays its own windows over windows of other apps.

Tecnologías

Términos

Formación y educación

Mitos

Technical information

Curing recommendations

Free trial